Set-CASMailbox Returns HTTP 403 with Certificate-Based App Authentication

Question

Set-CASMailbox Returns HTTP 403 with Certificate-Based App Authentication

Ashish Roshan 0

I am connecting to Exchange Online PowerShell using an Entra ID App Registration with certificate authentication. Get-CASMailbox work successfully, but Set-CASMailbox consistently returns HTTP 403 Forbidden.

I have verified the Exchange RBAC role and recipient scope, and Test-ServicePrincipalAuthorization reports that the target mailbox is in scope. I also tried using the tenant's .onmicrosoft.com domain for -Organization, but the issue persists.

The logs show only a generic server-side error, with no specific reason for the 403.

Has anyone encountered this issue or found a solution? CertificateAuthentication = True; connection status is Connected.

Get-CASMailbox works successfully.
Custom RBAC role includes Set-CASMailbox and the required parameters.
Custom recipient scope is valid; target mailbox reports InScope = True.
.onmicrosoft.com organization domain tested; issue persists.
Individual Set-CASMailbox parameters also return HTTP 403.
Get-Mailbox and Get-CASMailbox work in the certificate-authenticated app-only session.
Set-CASMailbox fails with HTTP 403, even with -WhatIf.
Set-CASMailbox works in interactive admin PowerShell but fails with certificate authentication.
Logs show a generic server-side error with no detailed cause. Error: Write-Error: A server side error has occurred because of which the operation could not be completed. Please try again after some time. If the problem still persists, please reach out to MS support.

0 comments

1 answer

Your answer

Answer 1

Hi Ashish Roshan,

I understand how frustrating this issue must be, especially after you've already tried several troubleshooting steps. I also appreciate the detailed information you've shared, which helps clarify what you've already tested.

I've searched for similar cases and additional information that might help resolve the issue, but unfortunately, I haven't found a confirmed solution for your specific scenario.

Since you've already checked the permissions, recipient scope, and organization domain, I recommend opening a support ticket with Microsoft Support for further investigation. They may be able to look into the server-side error and help identify the underlying cause.

You can also refer to this Microsoft Learn article for detailed instructions: Get support - Microsoft 365 admin | Microsoft Learn.

Thank you for your understanding. If you have any updates or find a solution, please feel free to share them here, as they may also help others experiencing the same issue.