CmdletAccessDeniedException
Exchange PowerShell cmdlet access is denied
Answer: Exchange Online RBAC does not authorize the current identity to run the cmdlet in the attempted scope.
Resolution playbook
Fix it, then prove it
Use the error record as the starting point; use tenant evidence to confirm the actual cause.
Likely causes
- Having access to the Exchange admin center does not automatically grant every PowerShell cmdlet or parameter.
- The connected identity lacks the Exchange role, scope, or ownership required by the cmdlet.
- The session is stale, connected to the wrong tenant, or blocked by service health or workload policy.
Recommended fix
- Check the user's assigned management roles and role groups.
- Confirm the role assignment scope includes the target object.
- Reconnect after role changes so the session receives updated authorization.
Verify
- Repeat the smallest operation that produced the failure.
- Confirm a fresh success in the authoritative service log or admin center, not only in the client UI.
- Record the new UTC timestamp and correlation/request ID so the retry can be distinguished from cached or older failures.
Escalate when
- The failure persists after the documented prerequisites and a new authentication/session attempt.
- Multiple users, apps, devices, or networks show the same error, suggesting tenant policy or service scope.
- You can provide the exact UTC time, tenant, application/resource, correlation or request ID, and sanitized logs.
Inspect the Exchange Online session
Get-ConnectionInformation | Format-List UserPrincipalName,TenantID,ConnectionId,State,TokenStatusRead-only. Run after Connect-ExchangeOnline and redact identifiers before sharing.
Admin context
Having access to the Exchange admin center does not automatically grant every PowerShell cmdlet or parameter.
Evidence to preserve
- UTC timestamp and correlation/request ID
- Tenant, application, resource, and authentication flow
- Sanitized service log details and exact operation
Advertisement