Configure an Impersonation Account to User Mailboxes

On your local computer, open Windows PowerShell and run the following command

PowerShell: $UserCredential = Get-Credential

• In the Windows PowerShell Credential Request dialog box, type your Exchange Online user name and password, and then click OK.

Run the following command:

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic –AllowRedirection

Import-PSSession $Session

If the Import-PSSession fails with this error message:

• Close the current PowerShell window, and open a new PowerShell window and choose to run as administrator

• Run: Set-ExecutionPolicy RemoteSigned
• Select 'Yes'

Now try this procedure (from the beginning of Step 2 – Create the Management Scope) again.

Next we need to get the distinguished name of the group we are going to use (this is the distribution group we just created). The easiest way to do this is to get a handle on the group object and then read out the distinguished name

$Group = Get-Group "OnePlaceSolutionsEmailTrackingUsers"

Now get the distinguished name of the group as we will need it for the next command

$Group.DistinguishedName

In the example above, the distinguished group name for the below command is:

CN=OnePlaceSolutionsEmailTracker,OU=oneplacetest.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations, DC=PRO1A003, DC=POD, DC=OUTLOOK, DC=COM

New-ManagementScope –Name "OnePlaceMailServiceAccount" –RecipientRestrictionFilter {MemberofGroup -eq "your-distinguished-group-value-here"}

You may get an error indicating you cannot run this command and you need to run Enable-OrganizationCustomization first.

Here's an article describing what this means

If this is the case, you just need to run the stated command:

Enable-OrganizationCustomization

Then trying to create the Management Scope should work

Now that we have the new Management Scope defined I like to test it by running the following command which will list out all the users that are included in this Management Scope. This should be the users that you have added to the distribution group.

$myMS = (Get-ManagementScope | Where-Object Name -eq "OnePlaceMailServiceAccount")

Get-Recipient -RecipientPreviewFilter $myMS.RecipientFilter

Be sure to disconnect the remote PowerShell session when you're finished. If you close the Windows PowerShell window without disconnecting the session, you could use up all the remote PowerShell sessions available to you, and you'll need to wait for the sessions to expire.

To disconnect the remote PowerShell session, run the following command:

Remove-PSSession $Session

Launch the Exchange Management Shell.

First we need to get the distinguished name of the group we are going to use (this is the distribution group we just created). The easiest way to do this is to get a handle on the group object and then read out the distinguished name.

$Group = Get-Group "OnePlaceSolutionsEmailTrackingUsers"

$Group.DistinguishedName

Use the following command to create the new management scope now that you have the distinguished name of the group.

New-ManagementScope –Name "OnePlaceMailServiceAccount" –RecipientRestrictionFilter {MemberofGroup -eq "your-distinguished-group-value-here"}

Now that we have the new Management Scope defined I like to test it by running the following command which will list out all the users that are included in this Management Scope. This should be the users that you have added to the distribution group.

$myMS = (Get-ManagementScope | Where-Object Name -eq "OnePlaceMailServiceAccount")

Get-Recipient -RecipientPreviewFilter $myMS.RecipientFilter

Return to the Exchange Admin Center

Select Permissions | Admin Roles | Add New Role Group

The important information on the New Role Group dialog are:

• Write Scope – Select the new Management Scope (OnePlaceMailServiceAccount) we created. This determines which mailboxes the permission applies to.
• Roles – Select ApplicationImpersonation. This is the type of permission to grant to mailboxes within the write scope.
• Members – Specify the name of your service account (OnePlaceSolutions EmailTracking) that is going to be connecting to all the mailboxes and performing the updates. Effectively we are granting this user the ability to impersonate within mailboxes within the write scope.