Exchange Online denied the operation

Likely causes

• Microsoft Graph, Exchange Online PowerShell, and Exchange web services use different permission models; validate the one used by the failing request.
• The connected identity lacks the Exchange role, scope, or ownership required by the cmdlet.
• The session is stale, connected to the wrong tenant, or blocked by service health or workload policy.

Recommended fix

1. Confirm the required Exchange role assignment and scope.
2. Verify the command is running against the intended tenant and object.
3. For application access, inspect app permissions and any mailbox access policy.

Verify

1. Repeat the smallest operation that produced the failure.
2. Confirm a fresh success in the authoritative service log or admin center, not only in the client UI.
3. Record the new UTC timestamp and correlation/request ID so the retry can be distinguished from cached or older failures.

Escalate when

• The failure persists after the documented prerequisites and a new authentication/session attempt.
• Multiple users, apps, devices, or networks show the same error, suggesting tenant policy or service scope.
• You can provide the exact UTC time, tenant, application/resource, correlation or request ID, and sanitized logs.