Hi, I am trying to create a workflow to grant users FullAccess to existing shared mailboxes (exchange on-prem) by adding SID to the attribute edsva-MsExch-SharedMailboxUsers but it keeps returning error "Operation is not valid due to the current state of the object" when the WF runs.
If it get it to use Set instead of Add it works fine but Set replaces all the existing users with the new user which I don't want to do, I want the new user to be added alongside the existing FullAccess users
Hi ykara
Possibly not related if a defect has been confirmed, but could I ask if your Active Roles Service Account (or managed domain override account, depending on your configuration) is a member of Domain Admins? If not, could you check what object owns the shared mailbox user account?
This is going back a long time ago (well over 15 years), but I seem to remember after we removed Domain Admins for our service account, we had an issue changing either permissions like you mention above, or some other native ACL. It turned out that because we were neither the object owner, nor a domain admin we couldn't modify the permission/ACL. Normal day to day management of the objects after removing Domain Admins was fine, but the ACL/Permission was not. However all new accounts created via Active Roles after the removal of Domain Admin works fine. We ended up resolving the issue by changing the ownership of the objects we managed to the Active Roles Service Account (or if you use one, the managed domain override account) and then we didn't see the issue.
Also the edsva-MsExch-ShareMailboxUsers virtual attribute is defined as below in the SDK
