'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Azure AD Connect Send As Permissions Not Syncing to Exchange Online
Question details
Administrators are unable to successfully synchronize 'Send As' permissions assigned to on-premises Active Directory groups to Exchange Online using Azure AD Connect.
- Product
- Azure AD Connect / Exchange Online
- Device & OS
- not provided
- Scenario
- Assigning 'Send As' permissions for an on-premises Active Directory group to be used in Microsoft 365/Exchange Online.
- Observed behavior
- The 'Send As' permissions do not appear or function in Exchange Online. The Exchange admin portal prompts that changes must be made in the on-premises Active Directory, but updating the on-premises security group still yields no results.
Ensure you have Enterprise Admin or Domain Admin privileges in your on-premises Active Directory, as well as access to the Microsoft 365 Admin Center, before making changes to synchronization configurations.
Configure Permissions via Supported On-Premises Attributes
Since the source of authority is on-premises, you must apply the Send As permissions directly within your local Active Directory and ensure Exchange schema attributes are fully integrated.
When Azure AD Connect is active, Exchange Online looks to the on-premises directory as the definitive source. Simply modifying basic security group settings might not write to the specific Exchange attributes required for cloud synchronization.
Do not uninstall Azure AD Connect as a first step to resolve this. Proper investigation of synchronized group attributes is required.
Log in to your on-premises Domain Controller and open 'Active Directory Users and Computers' (ADUC) with Advanced Features enabled.
Right-click the synchronized group you wish to modify and select 'Properties'.
Navigate to the 'Security' tab, add the target user, and grant them 'Send As' permissions directly on the group object.
Check the Attribute Editor tab to ensure Exchange-specific attributes (such as msExchSendAsAddresses) are populating correctly if your schema is extended for Exchange.
Open PowerShell on your Azure AD Connect server and run 'Start-ADSyncSyncCycle -PolicyType Delta' to force the changes to synchronize to Exchange Online immediately.
Use a Temporary Synchronization Pause Workaround
Temporarily disable Azure AD Connect to convert synced objects to cloud-only entities, allowing direct permission management in the cloud.
Submit a Microsoft Service Request
If local configuration fails and attributes like msExchSendAsAddresses are missing, Microsoft Support engineers can investigate potential server-side synchronization bugs.
Keep Your Team Productive While Troubleshooting IT Issues
While resolving complex Exchange Online and Azure AD Connect synchronization issues, ensure your daily document workflows remain uninterrupted. WPS Office provides a lightweight, highly compatible alternative to Microsoft Office that your team can use entirely for free.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install WPS Office: Run the downloaded file and follow the standard installation prompts to set up the software in minutes.
- 3. Open Your Documents: Launch WPS Office to immediately open, edit, and collaborate on your existing Microsoft Office files.
Frequently Asked Questions
Why does the Exchange admin portal say changes must be made in on-premises Active Directory?
When using Azure AD Connect, your on-premises Active Directory is considered the 'source of authority.' This means Exchange Online locks down cloud-based editing for synced objects, requiring you to make the permission changes locally and wait for them to sync.
Should I uninstall Azure AD Connect to fix permission sync errors?
No. Uninstalling Azure AD Connect should never be used as a first-step troubleshooting method, as it breaks the identity bridge entirely. You should investigate synchronized group attributes or contact Microsoft support instead.
What if my on-premises AD attributes do not include msExchSendAsAddresses?
If Exchange-specific attributes are missing from your Active Directory, your on-premises AD schema likely hasn't been extended for Exchange. You may need to run the Exchange setup executable with the /PrepareSchema switch to make these attributes available.
How do I manually force Azure AD Connect to sync my new permissions?
You can force a synchronization by logging into your Azure AD Connect server, opening PowerShell as an Administrator, and executing the command: Start-ADSyncSyncCycle -PolicyType Delta.
