asked on

Exchange Online Management Scope Syntax

I am trying to add multiple users to a management scope connected to Exchange Online via PowerShell. Here is the cmd I am using, but it is not working. I have tried several variations, but to no avail. I have also tried looking at the Get-Help examples, but could not figure it out from there either. Hopefully just missing something simple :)

Set-ManagementScope "Scope1" -RecipientRestrictionFilter {EmailAddresses -Eq 'user1@company.com' -or EmailAddresses -eq 'user2@company.com'}

Tom Cieslik

The RecipientRestrictionFilter parameter specifies the filter to apply to recipient objects. When the RecipientRestrictionFilter parameter is specified, only server objects that match the filter are included in the scope. If you use the RecipientRestrictionFilter parameter, you can't use the DatabaseRestrictionFilter or ServerRestrictionFilter parameters.

User mailbox is not a server object but GROUP is.
Try to add users you want use in filter to some group and use Group as parameter

Example for Group SalesForce

SET-ManagementScope "SCOPE1" -RecipientRestrictionFilter {memberofgroup -eq "CN=SalesForce,OU=Groups,OU=xxx,DC=xxx,DC=xxx,DC=com"}

slattdog

ASKER

Then why does it work if I include only 1 email address in the command? For example:

Set-ManagementScope "Scope1" -RecipientRestrictionFilter { EmailAddresses -Eq 'user1@company.com' }

Tom Cieslik

so try replace -or with -and

slattdog

ASKER

That just replaces the "-or" with "-and" in the field. It's as if it is just placing the exact text of the command into the field rather than actaully populating the addresses.

Tom Cieslik

I know that with group is working so just try,, create group, add those 2 members and use group syntax

slattdog

ASKER

When looking at the result of Get-ManagementScope | fl should the content of the RecipientFilter field be formatted EmailAddresses -eq 'smtp:user1@comapny.com' or should it just show the actual address?

slattdog

ASKER

Where should the group be created? (This is O365 Exchange Online).

slattdog

ASKER

Should I create a security group in the EAC, and then add the users there?

Tom Cieslik

It's exchange based so i think it will be distribution group.
It's even better for you because if you decide replace user in script you don't have to run script again, just replace user in group

Tom Cieslik

I think that is about security group. I'm not sure because I can;t test it right now but if you going to use "CN=SalesForce,OU=Groups,OU=xxx,DC=xxx,DC=xxx,DC=com" i think is pointing to active directory

slattdog

ASKER

How do I reference the group in the command? You said "CN=SalesForce,OU=Groups,OU=xxx,DC=xxx,DC=xxx,DC=com", but I'm wondering in this case if just 'group@company.com' would work?

ASKER CERTIFIED SOLUTION

Chris Dent

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

slattdog

ASKER

Thanks Chris: After your comment I re-applied my original PS command. For some reason it looked wrong to me when view from the Get-ManagementScope | fl output, but apparently I had just not waited long enough for the settings to take effect before testing. :(

The original syntax actually works fine.

Tom: Thanks for your input as well. I appreciate the help. (I was pretty sure there was a way to do it with the filters I was working with; I just needed a bit more patience I guess. :)

Tom Cieslik

I've spend a lot of time to try to help you and no assisted solution from you, Thank You

slattdog

ASKER

Tom: Please do not take offense. I am grateful for your assistance, but I'm not sure that your recommendations were really an "assisted solution"? You said that my original method would not work when, in fact, it does. I'm not downplaying your effort or technical expertise. I'm merely trying to reflect the actual solution for the benefit of anyone who may later view this question. If I have handled this incorrectly I apologize. If any other experts would like to comment I am happy to re-assign the points -- if that is possible? Or else, perhaps a moderator can do so?