seanmcne
Mail Activation doesn't work on Azure AD privileged account
My company is moving towards using Azure AD privileged account (https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure) and I found out the mailbox activation command doesn't work successfully if we use privileged account. The script (Set-CrmUserMailbox) works successfully if non-privileged account with (Exchange Admin or Global Admin) is used.
@seanmcne in that issue, i used service principal but the issue i am having is while using the actual account (privilege account with exchange admin role). Unfortunately for the work i am doing, i won't be able to use service principal and have to use my actual account.
Just to make sure I understand, you have an account w/ PIM enabled and once you JIT up to a privileged admin role to approve mailboxes your permission isn't recognized as you would expect? Are you able to approve in the web/interactively once your role is activated via PIM?
Yes, that is correct. I was able to activate mailbox by logging into mailbox page through UI. Not sure if it makes difference, but my new account is cloud only account ([email protected]), meaning it doesn't sync from on-prem AD to cloud AD. I didn't had this issue when i used my other account with admin rights which sync from on-prem to azure ad and didn't had PIM setup.