title: Permissions error upon running Add-DistributionGroupMember PS cmdlet on Exchange Online
body: <p>I'm currently trying to automate the user creation in Azure AD, and addition to a distribution group in Exchange Online using a PowerShell script. I've followed <a href="https://adamtheautomator.com/exchange-online-powershell-mfa/#Creating_an_Azure_AD_Application_with_API_Permissions" rel="nofollow noreferrer">this</a> guide for that - I've set up an app registration with a certificate and that's how I'm authenticating to both Azure AD and Exchange Online - without human intervention.</p>
  <p>The specific Exchange cmdlet I'm running in the script (for the EXO part) is <code>Add-DistributionGroupMember -member &quot;user@domain.com&quot; -identity &quot;dlist&quot; -BypassSecurityGroupManagerCheck</code>, and once I run it I receive the following error output:</p>
  <pre><code>Active Directory operation failed on XXXXXXXXXXXXXXX.XXXXXXXXXXX.PROD.OUTLOOK.COM. This error is not retriable. Additional information: Insufficient access rights to perform the operation.
  Active directory response: 00002098: SecErr: DSID-XXXXXXXX, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
      + CategoryInfo          : NotSpecified: (:) [Add-DistributionGroupMember], ADOperationException
      + FullyQualifiedErrorId : [Server=XXXXXXXXXXXXX,RequestId=8ac3130a-4bbe-41a0-b062-4768b6f51234,TimeStamp=1/3/2021 2:18:13 PM] [FailureCategory=Cmdlet-ADOperationException] XXXXXXX,Microsoft.Exchange.Management.RecipientTasks.AddDistribu
     tionGroupMember
      + PSComputerName        : outlook.office365.com
  </code></pre>
  <p>Other cmdlets such as
  <code>Get-Mailbox</code> work correctly, but this specific one is giving me problems constantly. I've tried giving all API permissions I can think of in Azure to the application, both Delegated and Application permissions, and yet I'm still facing the error. Here's the current full list and I've had no success whatsoever:</p>
  <p><a href="https://i.stack.imgur.com/uT2gd.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/uT2gd.png" alt="" /></a></p>
  <p>I also tried replacing some of the Delegated permissions with Application permissions to no avail either.  I tried assigning a variety of roles to the application as mentioned in the <a href="https://adamtheautomator.com/exchange-online-powershell-mfa/#Creating_an_Azure_AD_Application_with_API_Permissions" rel="nofollow noreferrer">article</a> too and every single time I get that <code>Insufficient access rights to perform the operation</code> error.</p>
  <p>Could someone tell me why? Where and how am I supposed to grant the necessary permissions for the app to add a user to a distribution (mailing) list?</p>
  <p>I've been searching around and found no answer to it for that last few days. Any help would be greatly appreciated.</p>