AzureAD用户创建后同进程添加通讯组报错：用户未找到

我用PowerShell脚本在Azure AD创建新用户，脚本如下：

$AzureADConnection = Connect-AzureAD
$AdminEmail = $AzureADConnection.Account.Id
Connect-ExchangeOnline -UserPrincipalName $AdminEmail -ShowProgress $false

$ADUserParameters = @{
    DisplayName         = $DisplayName
    GivenName           = $FirstName
    SurName             = $LastName
    UserPrincipalName   = $UserPrincipalName
    MailNickName        = $MailNickName
    UsageLocation       = $UsageLocation
    CompanyName         = $CompanyName
    JobTitle            = $JobTitle
    Department          = $Department
    PasswordProfile     = $PasswordProfile
    AccountEnabled      = $true
}

$NewAzureADUser = New-AzureADUser @ADUserParameters -ErrorAction Stop

用户创建成功后，在同一脚本进程中执行以下命令添加到通讯组时，报错用户未找到：

$dl = "Somegroup@testdomain.com"
Add-DistributionGroupMember -Identity $dl -Member $UserPrincipalName

错误信息：

Couldn't find object "sdtestuser2@testdomain.com". Please make sure that it was spelled correctly or specify a different
object.

• CategoryInfo : NotSpecified: (:) [Add-DistributionGroupMember], ManagementObjectNotFoundException
• FullyQualifiedErrorId : TimeStamp=8/9/202
  2 11:55:40 AM] [FailureCategory=Cmdlet-ManagementObjectNotFoundException] D103D115,Microsoft.Exchange.Management.R
  ecipientTasks.AddDistributionGroupMember
• PSComputerName : outlook.office365.com

但单独执行添加命令就能正常运行。

原因分析 #

这是因为Azure AD与Exchange Online之间存在数据同步延迟。通过New-AzureADUser创建用户后，用户数据需要从Azure AD同步到Exchange Online的目录服务，这个过程并非实时完成。在同步完成前执行Exchange Online的命令，会因目录中无该用户记录而报错。

解决方案 #

方案1：添加同步等待逻辑 #

在创建用户后，循环检查Exchange Online是否能查询到该用户，确认同步完成后再执行添加操作：

$NewAzureADUser = New-AzureADUser @ADUserParameters -ErrorAction Stop

# 等待用户同步到Exchange Online
$maxAttempts = 10
$attempt = 0
$userFound = $false
do {
    Start-Sleep -Seconds 10
    $attempt++
    try {
        Get-Recipient -Identity $UserPrincipalName -ErrorAction Stop
        $userFound = $true
    }
    catch {
        Write-Host "等待用户同步... 第 $attempt/$maxAttempts 次尝试"
    }
} while (-not $userFound -and $attempt -lt $maxAttempts)

if ($userFound) {
    $dl = "Somegroup@testdomain.com"
    Add-DistributionGroupMember -Identity $dl -Member $UserPrincipalName
    Write-Host "用户已成功添加到通讯组"
}
else {
    Write-Error "用户同步超时，未能添加到通讯组"
}

方案2：直接用Exchange Online命令创建用户 #

如果业务场景允许，跳过Azure AD的单独创建步骤，直接使用Exchange Online的命令创建用户，这样用户会立即在Exchange目录中可用：

# 适用于需要邮箱的用户，创建后直接同步到Exchange目录
$NewExchangeUser = New-Mailbox -DisplayName $DisplayName -GivenName $FirstName -Surname $LastName `
    -UserPrincipalName $UserPrincipalName -Alias $MailNickName -UsageLocation $UsageLocation `
    -Company $CompanyName -Title $JobTitle -Department $Department `
    -Password $PasswordProfile.Password -ResetPasswordOnNextLogon $true

# 立即添加到通讯组
$dl = "Somegroup@testdomain.com"
Add-DistributionGroupMember -Identity $dl -Member $UserPrincipalName

方案3：使用Azure AD组替代Exchange通讯组 #

如果无需Exchange专属的通讯组功能，可以直接操作Azure AD组，该操作是实时的：

# 查询目标Azure AD组，不存在则创建
$aadGroup = Get-AzureADGroup -Filter "DisplayName eq 'SomeGroup'" -ErrorAction SilentlyContinue
if (-not $aadGroup) {
    $aadGroup = New-AzureADGroup -DisplayName "SomeGroup" -MailNickname "SomeGroup" -SecurityEnabled $false -MailEnabled $true
}

# 立即添加用户到Azure AD组
Add-AzureADGroupMember -ObjectId $aadGroup.ObjectId -RefObjectId $NewAzureADUser.ObjectId

内容的提问来源于stack exchange，提问作者Egor Bulka