Spring Boot应用通过PowerShell移除MESG成员遇权限问题求助

我开发了一个基于Spring Boot的Web应用，用户输入邮箱地址后，可查询该用户所属的Microsoft 365组、通讯组列表（DL）及邮件启用安全组（MESG）的成员详情，并支持移除选中群组的成员。当前状态：

• Microsoft 365组的成员移除通过Graph API实现，功能正常
• 通讯组列表（DL）的成员移除通过PowerShell脚本实现，功能正常
• 邮件启用安全组（MESG）的成员移除失败，返回错误：

  "You don't have sufficient permissions. This operation can only be performed by a manager of the group."

已确认事项：

• 执行操作的邮箱已配置必要权限
• 应用采用Office 365登录，仅管理员可访问移除控制台，普通用户会被重定向至其他页面

附PowerShell脚本片段：

param ( 
    [string]$UserEmail,
    [string]$GroupId,
    [string]$GroupType,
    [string]$AccessToken
)

# === Log the inputs ===
Write-Host "UserEmail: $UserEmail"
Write-Host "GroupId: $GroupId"
Write-Host "GroupType: $GroupType"

# === Step 1: Connect to Exchange Online ===
Write-Host "Connecting to Exchange Online..."
try {
    Connect-ExchangeOnline -AccessToken $AccessToken -Organization "xxx.onmicrosoft.com"
    Write-Host "✅ Connected to Exchange Online."
} catch {
    Write-Host "❌ Failed to connect to Exchange Online."
    Write-Host $_
    exit 1
}

# === Step 2: Perform Removal Logic ===
if ($GroupType -eq "Mail-Enabled Security Group") {
    Write-Host "Removing user $UserEmail from Mail-Enabled Security Group: $GroupId"
    
    try {
        # Attempt to remove user
        Remove-DistributionGroupMember -Identity $GroupId -Member $UserEmail -Confirm:$false -ErrorAction Stop
        Write-Host "✅ User $UserEmail removed from Mail-Enabled Security Group."
    } catch {
        Write-Host "❌ Error during removal:"
        Write-Host $_.Exception.Message
        Write-Host $_.ScriptStackTrace
        Write-Host "Re-checking membership status..."

        # Get full membership details for diagnosis
        $memberDetails = Get-DistributionGroupMember -Identity $GroupId | Where-Object {$_.PrimarySmtpAddress -eq $UserEmail}
        if ($memberDetails) {
            Write-Host "❌ User $UserEmail still present after removal attempt. Member Details:"
            $memberDetails | Format-List
        } else {
            Write-Host "✅ User $UserEmail successfully removed after re-check."
        }
    }

    Disconnect-ExchangeOnline -Confirm:$false
    Write-Host "Disconnected from Exchange Online"
} else {
    Write-Host "❌ Unknown group type: $GroupType"
}

解决方向 #

1. 核对Exchange Online权限配置 #

MESG的权限逻辑与DL存在差异：

• 确保执行操作的账号拥有Exchange Online管理员角色，或至少拥有邮件收件人管理员角色（该角色允许管理邮件启用安全组的成员）
• 避免仅依赖全局管理员角色，部分场景下全局管理员需显式分配Exchange相关权限

2. 检查MESG的群组管理器设置 #

错误提示明确要求操作账号为群组管理器，可按以下步骤处理：

• 查看目标MESG的管理器配置：

  Get-DistributionGroup -Identity $GroupId | Select-Object ManagedBy
  

• 若群组已设置管理器，可选择：
  • 将操作账号添加为该群组的管理器
  • 修改群组设置，允许管理员绕过管理器限制：

    Set-DistributionGroup -Identity $GroupId -BypassSecurityGroupManagerCheck $true
    

3. 改用Graph API处理MESG移除 #

既然Microsoft 365组的移除通过Graph API正常工作，MESG也可通过相同方式操作，规避PowerShell的权限问题：

• 使用Graph API端点：DELETE /groups/{group-id}/members/{directory-object-id}/$ref
• 所需权限：GroupMember.ReadWrite.All 或 Directory.ReadWrite.All

4. 验证AccessToken的权限范围 #

脚本通过Connect-ExchangeOnline -AccessToken连接，需确保AccessToken包含足够的Exchange Online权限：

• 检查AccessToken的scope是否包含Exchange.ManageAsApp或相关Exchange权限
• 可通过解码AccessToken确认权限范围是否符合要求

内容的提问来源于stack exchange，提问作者BeginnerBro