To begin with, letâ€s assume a couple things.

1. We have a Windows 2012 R2 member server with Azure AD Connect (AAD Connect) version 1.1.105.00 (or newer) and the Azure AD Module for PowerShell installed; and
2. We have an Exchange 2013 CU11 (or newer) server configured for hybrid with an active O365 tenant.

Now that weâ€ve established a baseline, there are a couple of options to perform the task of provisioning an AD user, creating a mailbox, and assigning an Office 365 license.

1. The first option would be to create an AD user, create an on premise mailbox, migrate the mailbox to Office 365, and assign a license; or
2. The second option would be to create an AD user, create a remote (or Office 365) mailbox, and assign a license.

In this post, I will cover the second option simply because it includes fewer steps and attempts to avoid confusion around where the mailbox should be created.

[su_note note_color=”#ee899a”]Do not create an AD user and then go to the Office 365 portal to create a new user and associated mailbox. This method will not properly create a synchronized O365 user and mailbox.[/su_note]

STEP 1: CREATE USER & MAILBOX

From the Exchange server, first create the AD user with remote mailbox using one command via Exchange Management Shell (EMS or Exchange PowerShell)…

New-RemoteMailbox -UserPrincipalName "[email protected]" -Alias "UserTest" -Name "UserTest" -FirstName "User" -LastName "Test" -DisplayName "User Test" -OnPremisesOrganizationalUnit "Office 365 Users" -Password (ConvertTo-SecureString "EnterPasswordHere" -AsPlainText -Force) -ResetPasswordOnNextLogon $true

In the command above, I created the AD user in an OU named “Office 365 Users”, set the password to “EnterPasswordHere”, and will require the user to change their password at next logon. However, I did not assign an SMTP address or remote routing address assuming that the email address policies are configured to be applied as new mailboxes are created.

STEP 2: SYNCHRONIZE USER

Once the AD user and mailbox are created, the AD object must to be synchronized to O365 in order to add the user with associated mailbox in the tenant. With the new version of AAD Connect, the scheduled sync time occurs every 30 minutes. In my case, Iâ€m not that patient and will manually force a sync to O365.

From the server with AAD Connect installed, via an elevated PowerShell console, run the following command to perform the sync to O365…

Start-ADSyncSyncCycle -PolicyType Delta

This task will synchronize all changes made to AD since the user and mailbox were created.

STEP 3: ASSIGN LICENSE

In the final step, I assign an O365 license to the newly created and synchronized user. The following commands can be run from any machine that has both Microsoft Online Services Sign-in Assistant for IT Professionals RTW and Windows Azure Active Directory Module for Windows PowerShell installed. In my case, they are installed on each server, as well as my admin workstation.

Connect to O365 via PowerShell from an elevated PowerShell console; or using Azure AD Module for PowerShell console.

Confirm the new user does not have an O365 license assigned.

#Connect to Office365
Import-Module MSOnline
Connect-MsolService
$O365Cred = Get-Credential
$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
Import-PSSession $O365Session

Get-MsolUser -UnlicensedUsersOnly

This command returns unlicensed O365 users in which the “isLicensed” parameter is “False”.

The next command returns the “AccountSkuId“, or subscription license(s), of my tenant that I will use to assign to the new user.

Get-MsolAccountSku

The AccountSkuId will look something similar to “tenantname:ENTERPRISEPACK“; where “ENTERPRISEPACK” represents my Office 365 Enterprise E3 subscription. Other subscriptions will have different representations.

Before I can assign any licenses to my new user, the user must be assigned a location (or country code). Since Iâ€m am located in the United States, I use “US” as the two letter country code for the user, using this command…

Set-MsolUser -UserPrincipalName [email protected] -UsageLocation US

Now that Iâ€ve set a location for the new user, I can assign a license from my associated O365 subscription, using this command…

Set-MsolUserLicense -UserPrincipalName [email protected] -AddLicenses tenantname:ENTERPRISEPACK

Finally, the user can access their assigned mailbox in Exchange Online.

In my case to check which users are covered and meeting policy and get the users addressed.

Get-MsolUser -All -DomainName "yourdomainname.com" | select DisplayName, LastPasswordChangeTimeStamp,@{Name=”PasswordAge”;Expression={(Get-Date)-$_.LastPasswordChangeTimeStamp}}

The output will be similar to:

Anyways, for someone who may come across this weird issue, here is the fix for it.

Set-Mailbox [email protected] -Type Regular

This will convert it from a shared mailbox, or a resource mailbox to a user mailbox.

I don’t understand why this option is not turned on by default because it accounts for a message sent from a shared mailbox yet there is no historical record of the message being sent from the mailbox. Apart from journaling if it is enabled or a third party software/ service.

#To enable it for emails Sent As the shared mailbox, set the enable flag to true and run the cmdlet:
Set-Mailbox <mailbox-name> -MessageCopyForSentAsEnabled $True

#To enable it on all shared mailboxes, use this cmdlet:
Get-Mailbox -ResultSize unlimited -Filter {(RecipientTypeDetails -eq 'SharedMailbox')} | Set-Mailbox -MessageCopyForSentAsEnabled $True

#If the email was Sent On Behalf of the shared mailbox, use
Set-Mailbox <mailbox-name> -MessageCopyForSendOnBehalfEnabled $True

#To disable it for emails Sent As the shared mailbox, use this cmdlet:
Set-Mailbox <mailbox-name> -MessageCopyForSentAsEnabled $False

#To disable if the email was Sent On Behalf of the shared mailbox, use
Set-Mailbox <mailbox-name> -MessageCopyForSendOnBehalfEnabled $False

Get-MailboxDatabase -identity “Mailbox Database” | Add-ADPermission -User "Trusted User"-AccessRights GenericAll

Now access to all mailboxes:


Get-Mailbox -ResultSize Unlimited -Database "Mailbox Database" | Add-MailboxPermission -User "Trusted User" -AccessRights FullAccess

For Send As:


Add-ADPermission -Identity "Mailbox Database" -User "Trusted User" -ExtendedRights Send-As

For Recieve As:


Add-ADPermission -Identity "Mailbox Database" -User "Trusted User" -ExtendedRights Receive-As

In exchange 2010 only you can use this command:


$organization = Get-OrganizationConfig; $databasesContainer = "CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups," + $organization.DistinguishedName; $user = Read-Host -Prompt:"Enter UserName to grant permissions"; Add-ADPermission -User:$user -AccessRights ExtendedRight -ExtendedRights Receive-As, Send-As, ms-Exch-Store-Admin -Identity:$databasesContainer;

Make sure you have OWA enabled for the user to view the mailbox.

•  Add a user as a full permission to the room mailbox via PowerShell:

  Assign Permission Add-MailboxPermission -Identity “[email protected]” -User “[email protected]” -AccessRights Fullaccess -InheritanceType All

• Open room mailbox with OWA
• Login to user who have the full permission of room mailbox by using OWA.
• Click on “your alias” at top right corner and select room mailbox
• When the OWA open room mailbox, we can click on “calendar” -> Share -> “Share this calendar”  and select the share permission. Then, we can select the person and send the announcement email.

On the Client Side the user will be able to the see the only if they have permissions. If no permissions are assigned it will give a warning saying it is unable to connect. This will go away once the permissions are set right!

1. Open OWA (Outlook Web apps) by opening http://mail.office365.com
2. Calendar – > My Calendars  -> open “other Calendars” ,then input the alias of the Room-mailbox

Microsoft Article: Create A New Room Mailbox

• Organiser of the meeting, and
• The subject of the meeting

Below I will demonstrate how to set the permissions so that all meetings (except those explicitly marked as ‘Privateâ€) publicise the above details to all who view its calendar.

1. First make sure you have the remote signed execution policy set to true. You can do this by running PowerShell in admin mode and running: Set-ExecutionPolicy RemoteSigned
2. Next, run the following to authenticate your self and import PowerShell commands to your local session:
   $LiveCred = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange-ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection
Import-PSSession $Session

Set the Room calendar to show ‘limited details†by default

We will do this using the Set-MailboxFolderPermission command. Click the link to see the full list of parameters you can pass in to the command. We will be using ‘limited details†for the AccessRights variable.

Set-MailboxFolderPermission -AccessRights LimitedDetails -Identity Room:\calendar -User default

Set the Room calendar to show the ‘Organiser†and ‘Subject†of the meeting

We will do this using the Set-CalendarProcessing command. Click the link to see the full list of parameters you can pass in to the command.

Set-CalendarProcessing -Identity testroom -AddOrganizerToSubject $true -DeleteComments $false -DeleteSubject $false