Exchange Online PowerShell doesn’t expose New-DynamicDistributionGroup

Question

Exchange Online PowerShell doesn’t expose New-DynamicDistributionGroup

Sergii Machulin 105

I can’t access New-DynamicDistributionGroup in Exchange Online PowerShell.
The term 'New-DynamicDistributionGroup' is not recognized as a name of a cmdlet, function, script file, or executable program.

Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
This reproduces across multiple machines, with PowerShell 7.4.x and 7.6.x and ExchangeOnlineManagement 3.9.2 and 3.10.1.

After connecting with Connect-ExchangeOnline with global admin account, Get-Command DynamicDistributionGroup -All returns Get-DynamicDistributionGroup, Get-DynamicDistributionGroupMember, and Set-DynamicDistributionGroup, but no New-DynamicDistributionGroup. The affected admin account has necessary Exchange Distribution Groups role. Get-ManagementRoleEntry confirms that New-DynamicDistributionGroup is in the Distribution Groups role, and Get-ManagementRoleAssignment -Role 'Distribution Groups' -Delegating:$false -GetEffectiveUsers shows admin account as an enabled effective user through that group, with Organization scope.

The same cmdlet is missing in fresh sessions after reconnecting.

Vasil Michev 128.6K Reputation points MVP Volunteer Moderator

2026-11-03T15:21:52.44+00:00

Is this affecting just you or all admins in the tenant? Are you able to create DDGs via the EAC?

For the record, no issues here, so it's either permissions or something broken in your tenant.
Sergii Machulin 105 Reputation points

2026-11-03T15:56:17.68+00:00

@Vasil Michev This issue appears to be affecting all admin accounts. The admin account is also unable to create DDGs through the EAC.

The diagnostic check confirms that the cmdlet is available. Looks like something broken in the tenant.
Vasil Michev 128.6K Reputation points MVP Volunteer Moderator

2026-11-03T17:18:38.41+00:00

Can you capture the network trace in the browser when you press the button to provision a DDG? Does the error again refer to missing cmdlet, or it's something else?
Sergii Machulin 105 Reputation points

2026-11-04T13:05:52.0266667+00:00

@Vasil MichevThanks for the suggestion to capture a network trace. The failed attempt was caused by an incorrect configuration of the distribution dynamic group.

After correcting the configuration, I was able to successfully create a test group. This confirms that the functionality works through EAC.
Later, after testing the connection the cmdlet became available.

Answer accepted by question author

0 additional answers

Your answer

Vasil Michev 128.6K Reputation points MVP Volunteer Moderator

2026-11-03T15:21:52.44+00:00

Is this affecting just you or all admins in the tenant? Are you able to create DDGs via the EAC?

For the record, no issues here, so it's either permissions or something broken in your tenant.
Sergii Machulin 105 Reputation points

2026-11-03T15:56:17.68+00:00

@Vasil Michev This issue appears to be affecting all admin accounts. The admin account is also unable to create DDGs through the EAC.

The diagnostic check confirms that the cmdlet is available. Looks like something broken in the tenant.
Vasil Michev 128.6K Reputation points MVP Volunteer Moderator

2026-11-03T17:18:38.41+00:00

Can you capture the network trace in the browser when you press the button to provision a DDG? Does the error again refer to missing cmdlet, or it's something else?
Sergii Machulin 105 Reputation points

2026-11-04T13:05:52.0266667+00:00

@Vasil MichevThanks for the suggestion to capture a network trace. The failed attempt was caused by an incorrect configuration of the distribution dynamic group.

After correcting the configuration, I was able to successfully create a test group. This confirms that the functionality works through EAC.
Later, after testing the connection the cmdlet became available.

Answer 1

Run Invoke-ProvisioningVerifyRbacDiagnostic against the affected user and New-DynamicDistributionGroup; the cmdlet is supported in Exchange Online, so its absence despite a confirmed effective role assignment indicates that the tenant’s effective RBAC configuration needs targeted validation rather than another module reinstall or reconnect.^1^

$User = '[Email]'

Invoke-ProvisioningVerifyRbacDiagnostic `
    -User $User `
    -CmdletName New-DynamicDistributionGroup

Get-Command New-DynamicDistributionGroup -ErrorAction SilentlyContinue

This diagnostic checks the user’s management roles, assignments, and role groups; detects missing, conflicting, duplicated, or inconsistent RBAC components; and can provide guidance or automated repair when it finds a problem.^2^ It is cloud-only, intended for targeted troubleshooting, and limited to 100 diagnostic calls per organization per hour.^3^

If PowerShell does not expose the diagnostic, run the equivalent in Exchange admin center → Troubleshoot → Diagnostics → Verify RBAC. Select the affected user and specify New-DynamicDistributionGroup.^4^

Compare with a working administrator

If another administrator in the same tenant can see the cmdlet, compare their effective RBAC configuration:

Invoke-ProvisioningVerifyRbacDiagnostic `
    -ReferenceUser '[Email]' `
    -User '[Email]'

The comparison syntax is supported by the same diagnostic and isolates effective-assignment differences that may not be obvious from inspecting the Distribution Groups role alone.^3^

Interpret the result

The diagnostic reports and repairs an inconsistency: sign out, establish a new Exchange Online session, and test Get-Command New-DynamicDistributionGroup again. Permission changes take effect after logout and login.^5^
It identifies a missing or conflicting assignment: apply the diagnostic’s recommended correction. Modifying role groups requires the Role Management role, assigned to Organization Management by default.^6^
It reports correct authorization but the cmdlet remains absent: open a Microsoft 365 support case and include:
- the diagnostic RunId and complete output;
- Get-ConnectionInformation;
- Get-Module ExchangeOnlineManagement | Format-List Name,Version,Path;
- the output showing the role entry and effective assignment;
- the output of Get-Command *DynamicDistributionGroup* -All.

Exchange Online uses RBAC to determine which cmdlets are exposed after connection, and role membership normally makes the role’s cmdlets available to the user.^7^ Since you have already reproduced this across machines, module versions, and fresh sessions—and confirmed the role entry, effective user, enabled status, and organization scope—repeating installation or ordinary role-assignment checks is unlikely to discriminate the issue further.

References