Azure Automation with Exchange Online – part 2

In part 1 we looked at connecting to Exchange from a Azure Automation with the intent to move our Exchange Tasks to Azure Automation. Today I will look a little more on doing some tasks with Exchange. I will demonstrate how to set and update calendar permissions and how to keep an Hierarchical Address Book up to date, turning the groups from manual it into a dynamic groups.

Exchange calendar permissions

Let’s dive right into it and start with the most common one. Set Calendar permissions.
I created a mail-enabled Security group named Reception in Exchange and added one of my Demo users to the group. I’ll show later how the test users is able to add entries into my calendar. But first let’s have a look at the runbook and how we can check that we get the desired results.

The script I used for the task is here loops trough all users mailboxes and checks if the Reception group have the correct access. If it doesn’t we add the access rights to the calendar. It’s an easy way to always keep new users with the correct calendar premissions, according to your organizations policy. The script checks for the Calendar and for the Kalendar as the default mailboxes for me might be Norwegian. You might have a different language and need to modify the script accordingly. If you are moving scripts from on-premise and you use Write-Host, remember to change them to Write-Output to get data into the output stream. The runbook will convert Write-Host to Write-Verbose, but these are not logged by default.

The runbook looks this way, and once it has run you can see the recent jobs, output, errors etc. I’ve attached some images of the initial error I got, when I wrote the script. and the output from when it worked. There are some fucntions in the script that is not viable to use, in this case it’s the parameter -ForegroundColor.

To get most output from your script I would suggest to enable logging. If you use Versbose commands to output information the default setting so to not output this in the jobs. This needs to be done on each runbook.

The second output, when all permissions has been set, and below it is one with a combined set of results.

Hierarchy Address Book

Next we are turning a HAB from a manual/static distribution group into a dynamic group using Automation and Exchange Online. There are some limits of fields that you can get from the Exchange. In this task we are using basic feature available to us in Exchange. The runbook script looks like this and does the following. We look up mailboxes using RecipientTypeDetails and UsageLocation. We also add all groups inside the group, since we use the Update-DistributionGroupMember we effectivly replace all users (and groups) within the hierarchy. So in order for the nested groups to be displayed correctly we need to add them into the array before we update the members.

Remeber to add data to Write-Output so you can get logging in your scripts. You can see the output result below for the Resource group, but not for the other groups. This is because the Write-Output was not added for the other groups. And finally you will se the HAB in Outlook updated with the “dynamic” users and groups.

In bigger organizations we might want to filter on Company, Department or Location. This is were a combination of Azure AD and Exchange is a good match to get users from Azure AD to get even more granular or dynamic based on objet properties. We will look at this in a later article.

Schedule the tasks

The last thing we need to do is to create a schedule and link our tasks to this schedule. We don’t want to enter automation to run the scripts manually. Open Schedule in the Shared Resources section and create your new schedule. I’ve created an hourly schedule that runs on the hour.

Go back to the Runbook and press Link to schedule, and select the schedule you want to link it to. Once it is set you can see it in the runbook’s left menu under Schedules in the Resources section and verify that it is configured.