Exchange Online User can't add users to onpremises distribution list?

[Krusty_the_admin]

Hi,

I migrated a few test users to Exchange Online, but they are Owners of an Distributions Group OnPremises, on my Exchange 2019.

When they where OnPremises Mailboxes they are able to add and remove users to/from this group. On is superior of this group (I'm not shure, if I translated this right).

We built explicitly an User Role: MyDistributionGroups, 
MyDistributionGroupMembership

but now they can't make any changes at their group. With Online groups it is working, but I dont want to create all DL at the cloud during this test.

Error: Änderungen an der Mitgliedschaft der öffentlichen Gruppen können nicht gespeichert werden. Sie besitzen nicht die erforderlichen Berechtigungen, um diesen Vorgang mit diesem Objekt auszuführen. 

in Englisch like:Changes to public group membership cannot be saved. You do not have the required permissions to perform this operation on this object.

How can I grant this rights again for Online Users?

[#2]

That's the expected behavior, read here: https://learn.microsoft.com/en-us/exchange/troubleshoot/groups-and-distribution-lists/cannot-manage-...

[#3]

Yes, this is right, but I want to manage OnPremises Distribution Group, not Online.
When my non Adminuser goes: https://outlook.office365.com/ecp/
I receive:

Fehler bei Vorgang für Identität "******", da sie außerhalb des Schreibbereichs für den aktuellen Benutzer lieFehler bei Vorgang für Identität "******", da sie außerhalb des Schreibbereichs für den aktuellen Benutzer liegt. Die Aktion 'Update-DistributionGroupMember', 'Identity,Membergt. Die Aktion 'Update-DistributionGroupMember', 'Identity,Members', kann nicht für das Objekt "******" durchgeführt werden, weil dieses Objekt von lokal synchronisiert wird. Diese Aktion sollte lokal für das Objekt durchgeführt werden.

Error in operation for identity '******' because it is outside the write range for the current userError in operation for identity '******' because it is outside the write range for the current user. The action 'Update-DistributionGroupMember', 'Identity,Membergt. The action 'Update-DistributionGroupMember', 'Identity,Members', cannot be performed for the object "******" because this object is synchronised from locally. This action should be performed locally for the object.

On local OWA I got:


Use the following link to open this mailbox with the best performance:
https://outlook.office.com/mail/email address removed for privacy reasons
X-FEServer IRSEX05
Date:5/24/2023 11:54:49 AM

[#4]

You need to add members to the DL synced to azure from the local active directory and run the sync back to azure.

[#5]

The Enduser (List Owners) added it in the past, over their Adressbook.
Now the Endusers are Online and can't.
They cant do it over Adressbook and cant over OWA/ECP..

The Exchange Admins are able to add Members all the time and yes, we can sync, but we want the endusers to self do, we dont want to work on many DL and the Endusers dont want it, too.

[#6]

did you enable the group writeback feature using the Azure AD Connect ?

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-group-writeba...

[#7]

Not until now, did you think it will work then?

[#8]

sure , because to be able to modify DL on prem from cloud you need to enable the group write back feature since your DLs are synced from on prem

[#9]

@eliekarkafy 

Thank you, I‘ll communicate this here and try to geht a change. 

I give feedback of it works.

[#10]

Hm.. no i have groupwrite back Feature... my Users still cant modifiy their DL an DL i created at the cloud are not sync back.

I can just create group wiht @onmicrsoft .com and use them for mail, I still have no Solution for my DLs.

I can modify DL at the cloud but Onpremises User dont see the online DL in their adress book.

[#11]

Me stupid, I can create an O365 Group, an after creation I assign the right e-mail...
So far so good, the group is visible in the specified OU in my AD, but it still does not appear at my onpremise adressbook..

I can achieve this status without group feedback by simply creating a distribution list online.

But all the Onprem Users are not able to find the distribution list until everybody is migrated to online...