Add-RecipientPermission返回成功但SendAs权限未实际设置的问题

问题背景 #

在Exchange混合环境中，由于微软不会同步本地SendAs权限，我将本地所有SendAs权限数据存入SQL数据库，通过PowerShell循环调用Add-RecipientPermission在云端为同步用户设置权限。脚本执行日志显示所有操作均返回成功，但使用Get-RecipientPermission查询时，发现部分权限并未实际生效；而手动逐条执行相同命令时，所有权限都能正常设置并查询到。

脚本代码 #

foreach ($userToProcess in $dtUsersToProcess) {

        $userId = $userToProcess["UserId"]
        $delegateTo = $userToProcess["DelegateTo"]
        $primarySmtpAddress = $userToProcess["PrimarySmtpAddress"]
        $delegateToSmtpAddress = $userToProcess["DelegateToSmtpAddress"]

        # Process each record
        $logger.Debug("Processing user: $userId ($primarySmtpAddress) to give delegation to $delegateTo ($delegateToSmtpAddress).")

        try {
          $result = $NULL
          $result = Add-RecipientPermission -Identity $primarySmtpAddress -Trustee $delegateToSmtpAddress -AccessRights sendas -Confirm:$false -ErrorAction Stop
          $message = "On user $($result.Identity) the trustee $($result.Trustee) has AccessContyrolType $($result.AccessControlType) and IsValid $($result.IsValid) with AccessRights $($result.AccessRights)."
          $userToProcess.RightSet = 1
          $userToProcess.FeedBack = $message
          $logger.Info($Message)
        }
        catch [System.Management.Automation.WarningRecord] {
          $message = "Warning for $userId and $delegateTo : $($_.Exception.Message)."
          $userToProcess.RightSet = 1
          $userToProcess.FeedBack = $message
          $logger.Warning($message)
        }
        catch {
          $message = "Add-RecipientPermission for $primarySmtpAddress to $delegateToSmtpAddress was not ok: $($_.Exception.Message)."
          $userToProcess.RightSet = 0
          $userToProcess.FeedBack = $message
          $logger.Error($message)
        }
        $rowCount++
}

日志与实际结果对比 #

执行日志（全部显示成功） #

Set-SendAsRights;Processing user: u3 to give delegation to user1.
Set-SendAsRights;On user u3 the trustee user1 has AccessContyrolType Allow and IsValid True with AccessRights SendAs.
Set-SendAsRights;Processing user: u3 to give delegation to user2.
Set-SendAsRights;On user u3 the trustee user2 has AccessContyrolType Allow and IsValid True with AccessRights SendAs.
Set-SendAsRights;Processing user: u3 to give delegation to user3.
Set-SendAsRights;On user u3 the trustee user3 has AccessContyrolType Allow and IsValid True with AccessRights SendAs.
Set-SendAsRights;Processing user: u3 to give delegation to user4.
Set-SendAsRights;On user u3 the trustee user4 has AccessContyrolType Allow and IsValid True with AccessRights SendAs.
Set-SendAsRights;Processing user: u3 to give delegation to user5.
Set-SendAsRights;On user u3 the trustee user5 has AccessContyrolType Allow and IsValid True with AccessRights SendAs.
Set-SendAsRights;Processing user: u3 to give delegation to user6.
Set-SendAsRights;On user u3 the trustee 12434309-1b53-4536-b6d2-2a94c284eaa4 has AccessContyrolType Allow and IsValid True with AccessRights SendAs.

实际权限查询结果 #

PS C:\Users\myUser> Get-RecipientPermission -Identity u****3

Identity Trustee                      AccessControlType AccessRights Inherited
-------- -------                      ----------------- ------------ ---------
u****3 NT AUTHORITY\SELF    Allow             {SendAs}     False
u****3 user1@blabla.com     Allow             {SendAs}     False
u****3 user4@blabla.com     Allow             {SendAs}     False

手动执行命令（全部成功） #

$result = Add-RecipientPermission -Identity u****3 -Trustee user1 -AccessRights sendas -Confirm:$false -ErrorAction Stop
$result = Add-RecipientPermission -Identity u****3 -Trustee user2 -AccessRights sendas -Confirm:$false -ErrorAction Stop
$result = Add-RecipientPermission -Identity u****3 -Trustee user3 -AccessRights sendas -Confirm:$false -ErrorAction Stop
$result = Add-RecipientPermission -Identity u****3 -Trustee user4 -AccessRights sendas -Confirm:$false -ErrorAction Stop
$result = Add-RecipientPermission -Identity u****3 -Trustee user5 -AccessRights sendas -Confirm:$false -ErrorAction Stop
$result = Add-RecipientPermission -Identity u****3 -Trustee user6 -AccessRights sendas -Confirm:$false -ErrorAction Stop

可能的原因及解决方法 #

1. 循环执行速度过快，后端未及时同步 #

脚本循环执行时命令间隔太短，Exchange Online后台还未完成上一个权限的配置，后续命令可能被限流或覆盖，导致部分操作未实际生效；手动执行时间隔足够长，后端有时间完成同步。

解决方法：
在循环中添加短暂延迟，每条命令执行后等待1-2秒：

# 在catch块之后、$rowCount++之前添加延迟
Start-Sleep -Seconds 1

2. Trustee参数格式异常 #

从日志可见，给user6设置权限时，Trustee显示为GUID而非SMTP地址，说明$delegateToSmtpAddress字段在部分记录中未正确获取到有效SMTP地址。虽然命令返回成功，但Exchange Online对GUID格式的Trustee处理可能存在延迟或异常。

解决方法：

• 检查SQL数据库中DelegateToSmtpAddress字段的值，确保所有记录都是合法的SMTP地址，而非GUID或其他格式。
• 在脚本中添加格式校验，确认地址合法后再执行命令：

# 在try块之前添加校验逻辑
if (-not $delegateToSmtpAddress -match "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$") {
    $message = "无效的SMTP地址：$delegateToSmtpAddress（委托用户：$delegateTo）"
    $userToProcess.RightSet = 0
    $userToProcess.FeedBack = $message
    $logger.Error($message)
    continue
}

3. PowerShell会话并发限流 #

Exchange Online对PowerShell会话的并发操作有隐性限制，批量循环执行可能触发限流，导致部分命令看似成功但未被后端处理。

解决方法：

• 拆分批量任务，每处理10条记录就重启一次Exchange Online PowerShell会话。
• 添加重试机制，对疑似失败的操作进行重试：

# 修改try块为带重试的逻辑
$retryCount = 3
$success = $false
do {
    try {
        $result = Add-RecipientPermission -Identity $primarySmtpAddress -Trustee $delegateToSmtpAddress -AccessRights sendas -Confirm:$false -ErrorAction Stop
        $success = $true
        $message = "On user $($result.Identity) the trustee $($result.Trustee) has AccessContyrolType $($result.AccessControlType) and IsValid $($result.IsValid) with AccessRights $($result.AccessRights)."
        $userToProcess.RightSet = 1
        $userToProcess.FeedBack = $message
        $logger.Info($message)
    }
    catch {
        $retryCount--
        if ($retryCount -gt 0) {
            $logger.Warning("重试第 $($3 - $retryCount) 次：$primarySmtpAddress -> $delegateToSmtpAddress，错误信息：$($_.Exception.Message)")
            Start-Sleep -Seconds 2
        } else {
            $message = "Add-RecipientPermission for $primarySmtpAddress to $delegateToSmtpAddress 最终失败：$($_.Exception.Message)."
            $userToProcess.RightSet = 0
            $userToProcess.FeedBack = $message
            $logger.Error($message)
        }
    }
} while (-not $success -and $retryCount -gt 0)

4. 查询缓存延迟 #

即使权限设置成功，Exchange Online的权限查询可能存在缓存，导致刚设置的权限无法立即通过Get-RecipientPermission查询到。

解决方法：

• 脚本执行完成后等待3-5分钟再查询权限。
• 在脚本中添加验证步骤，设置后立即查询确认，未生效则重试：

# 在Add-RecipientPermission执行后添加验证
$permissionSet = Get-RecipientPermission -Identity $primarySmtpAddress -Trustee $delegateToSmtpAddress -ErrorAction SilentlyContinue
if (-not $permissionSet) {
    $message = "权限设置后未查询到：$primarySmtpAddress -> $delegateToSmtpAddress"
    $userToProcess.RightSet = 0
    $userToProcess.FeedBack = $message
    $logger.Error($message)
} else {
    $message = "On user $($permissionSet.Identity) the trustee $($permissionSet.Trustee) has AccessContyrolType $($permissionSet.AccessControlType) and IsValid $($permissionSet.IsValid) with AccessRights $($permissionSet.AccessRights)."
    $userToProcess.RightSet = 1
    $userToProcess.FeedBack = $message
    $logger.Info($message)
}

内容的提问来源于stack exchange，提问作者NicCarlos