When end users mailboxes are migrated to Exchange Online from Exchange on premises the users' ability to manage email enabled on premises directory distribution groups in Microsoft Outlook is impacted. The users' Outlook is no longer connecting to the on premises directory service. While Outlook will have visibility to the synchronized representation of the on premises email enabled distribution groups those synchronized groups are not directly editable in the online directory.
As an alternative to using Outlook to manage Distribution Groups users have access to the Exchange Control Panel (ECP), a web interface that is a native part of Microsoft Exchange for end user and administrative access to Exchange features. However, access to the ECP for end users is typically tied to having a Mailbox in the same Exchange environment. Because of this dependency for typical ECP access by end users, when a user mailbox is migrated to Exchange Online, the user's access to ECP is typically terminated. To extend the access to the ECP to the user after their mailbox is migrated a custom Exchange Administrative role must be created. This will result in a slightly different distribution group management experience for the users before migration and after migration.
The distribution group management experience in ECP for end users includes the following features:
- Ability to Create New Distribution Groups (if not turned off) and the user becomes an owner of the group.
- Ability to Manage the Membership of Mail-Enabled Groups (including Security Groups) that the user is an owner of (the user is specified in the 'ManagedBy' attribute of the group in the directory).
- Ability to Delete Distribution Groups the user is an owner of (if not turned off).
- Before migration, ability to Add and Remove themselves from mail enabled non-Security Groups that allow this (MemberJoinRestriction and/or MemberDepartRestriction set to Open).
- After User Mailbox Migration
- the user will have visibility to all Distribution Groups but will only be able to edit the groups for which the user is an owner.
- the user will no longer be able to Add and Remove themselves from mail enabled non-Security Groups that have MemberJoinRestriction and/or MemberDepartRestriction set to Open.
The pre-migration experience only displays to the user the groups of which the user is a member and the groups of which the users is an owner. It also allows users to manage other mailbox features and functions in the ECP as visible in the other options in the left hand navigation menu in the ECP web page shown below.
The post-migration experience displays to the user all mail enabled groups. The user has to locate on their own the groups of which the user is an owner (self-membership management for distribution groups the user does not own is no longer available). If a user is added to the post-migration experience Role Group before their mailbox is migrated the user will lose access to other features of the ECP for managing mailbox features and functions. Therefore a user should only be added to the 'User Distribution Group Management' role group at cutover of the user's mailbox to Exchange Online.
Migration Process Should Include Adding users as needed to 'User Distribution Group Management' Role Group
As part of the migration process during cutover activities users that need to manage distribution groups should be assigned membership in the 'User Distribution Group Management' Role Group. This should not be done ahead of cutover because of the different user experience it will cause when it is done.
To ensure that users have only the desired group management experience before migration the following actions should be taken.
The steps below will create a new management role that allows users to modify Group Membership, but not to add or remove groups or to change the other attributes of groups they own. The role will be called 'MyDistributionGroupsMembershipOnly'.
New-ManagementRole -Name 'MyDistributionGroupsMembershipOnly' -Parent 'MyDistributionGroups'
$MyDistributionGroupsEntries = Get-ManagementRoleEntry 'MyDistributionGroups\*' | Where-Object -FilterScript { @('New-DistributionGroup', 'Set-DynamicDistributionGroup', 'Remove-DistributionGroup') -notcontains $_.Name } | Select-Object -ExpandProperty Name
$MyDistributionGroupsMembershipOnlyEntries = Get-ManagementRoleEntry 'MyDistributionGroupsMembershipOnly\*' | Select-Object -ExpandProperty Name
$MyDistributionGroupsMembershipOnlyEntries | Where-Object -FilterScript { $MyDistributionGroupsEntries -notcontains $_ } | ForEach-Object { Remove-ManagementRoleEntry -Identity "MyDistributionGroupsMembershipOnly\$_" -Confirm:$False }To be effective the 'MyDistributionGroupsMembershipOnly' role created above must be assigned to user's mailboxes in replacement of the default MyDistributionGroups role. The is accomplished by modification of the Role Assignment Policy applied to users mailboxes. In this case the 'Default Role Assignment Policy' will be modified. If other Role Assignment Policies are in use these must be modified in a similar way.
Remove-ManagementRoleAssignment -Identity 'MyDistributionGroups-Default Role Assignment Policy'
New-ManagementRoleAssignment -Role 'MyDistributionGroupsMembershipOnly' -Policy 'Default Role Assignment Policy'
The UserDistributionGroups Management Role will be based on the built-in 'Distribution Groups' role. The command entries in the role will be modified to remove permissions that end users should not have for group creation and group attribute (other than membership) modification.
New-ManagementRole -Name 'UserDistributionGroups' -Description 'Distribution Groups Management for End Users' -Parent 'Distribution Groups'
$MyDistributionGroupsEntries = Get-ManagementRoleEntry 'MyDistributionGroups\*' | Where-Object -FilterScript { @('New-DistributionGroup', 'Set-DynamicDistributionGroup', 'Remove-DistributionGroup') -notcontains $_.Name } | Select-Object -ExpandProperty Name
$MyDistributionGroupsEntries += 'Write-AdminAuditLog' #this enables Exchange to capture the user activity in the admin audit logs
$UserDistributionGroupEntries = Get-ManagementRoleEntry 'UserDistributionGroups\*' | Select-Object -ExpandProperty Name
$UserDistributionGroupEntries | Where-Object -FilterScript { $MyDistributionGroupsEntries -notcontains $_ } | ForEach-Object { Remove-ManagementRoleEntry -Identity "UserDistributionGroups\$_" -Confirm:$False }A Management Role Group is a special Security Group used to assign Exchange administrative permissions. This role group will be called 'User Distribution Group Management'. The 'UserDistributionGroups' role will be assigned to the group using a special administrative scope called MyDistributionGroups, which is a RecipientRelativeWriteScope. This scope causes the permissions granted to the user to be granted only against groups of which the user is an owner or a member.
New-RoleGroup -Name 'User Distribution Group Management'
New-ManagementRoleAssignment -SecurityGroup 'User Distribution Group Management' -RecipientRelativeWriteScope 'MyDistributionGroups' -Role 'UserDistributionGroups'
