Trouble with impersonation using custom write scopes

[woelki]

Dear all,

in the tenant of a customer we have now configured the Exchange impersonation. In the past I have done this many times with OnPrem servers creating a new write scope based on an OU which never was a problem.

Now in O365 we are not able to base this on an OU so we have chosen the ExchCustomAttribute1 which we filled with a specific string. Unfortunately it does not work at all.  We tested it with the application outside of O365 and with the Remote Connectivity Analyzer (EWS section for service account access). Both fails.

Interestingly if I change the writescope to default it works immediately.

Is it possible that there are issues with the custom write scopes in Exchange Online?

Kind regards,

woelki

[#2]

I haven't had issues restricting impersonation via scopes in ExO, what are the exact steps you are following?

[#3]

@Vasil Michev 

Creation of a service account "ExchImpersonation"

Tagging the accounts which should be impersonated with "MyString" in ExchCustomAttribute1

New-ManagementScope -Name "Sales" -RecipientRestrictionFilter {ExchCustomAttribute1 -Like "Sales*" }

New-ManagementRoleAssignment -Name "Sales_Impersonation" -Role "ApplicationImpersonation" -User "ExchImpersonation" -CustomConfigWriteScope "Sales"

That's it. May I have forgotten a further option for creating the management scope?

[#4 · Accepted solution]

That's all you should need to configure, excluding the obvious mismatch between the "MyString" value you referenced in as being stamped, and the fact that the actual attribute name is "CustomAttribute1". So I'd say double-check your settings, and make sure the filer you are using for the scope actually matches the given users.

[#5]

@Vasil Michev

The value of the attribute was indeed a mismatch here in the post, but the real issue was the naming of the custom attribute. I fetched the naming from "get-mailbox" and selected it from the output. So I have entered ExtensionCustomAttribute1 and the shell accepted it because the whole parameter is a string :(

I have now chosen "CustomAttribute1" and it seems to work.

[#6]

Another victim to copy/paste :D

[#7]

@Vasil Michev 

Yes, but to be honest the KB article about New-ManagementScope has not the proper examples.

Afterwards I found this one, which exactly names the possible filters.

https://docs.microsoft.com/en-us/powershell/exchange/exchange-server/recipient-filters/recipientfilt...