Send-As Exchange Permissions: Delegating via Distribution Group

Granting “Send As” Permission on a Universal Distribution Group Exchange doesn’t let you grant “Send As” permission on a Universal Distribution Group directly through the normal Exchange management tools the way you can with a shared mailbox or user mailbox — distribution groups aren’t mail-enabled security principals in the same way, so the Exchange Admin […]

Send As Exchange Universal Distribution Group

Granting “Send As” Permission on a Universal Distribution Group

Exchange doesn’t let you grant “Send As” permission on a Universal Distribution Group directly through the normal Exchange management tools the way you can with a shared mailbox or user mailbox — distribution groups aren’t mail-enabled security principals in the same way, so the Exchange Admin Center and Exchange Management Shell’s usual recipient-permission cmdlets won’t apply cleanly. Instead, this is set directly through Active Directory:
  • Open Active Directory Users and Computers.
  • Make sure Advanced Features is enabled (View menu), so the Security tab is visible.
  • Find the distribution group, right-click it, and open Properties.
  • Go to the Security tab, click Add, and add the user who needs to send as the group.
  • In the permissions list, tick Send As under Allow, then click OK.
It can take a little while to replicate and for Exchange/Outlook to pick up the change, so if it doesn’t work immediately, give it some time (or force AD replication between your domain controllers if you need it faster) before assuming the permission didn’t take.

Does This Work in Exchange Online? (Updated for 2026)

This AD Security-tab technique is on-premises/hybrid only — it edits an Active Directory access control entry that has no equivalent for a cloud-only group, since Entra ID doesn’t expose that kind of ACL editor. For a cloud-only distribution group, Microsoft’s own guidance is that a plain distribution group fundamentally can’t hold Send As permission in Exchange Online at all — that requires the target to be a security principal. Your options there are converting the group to a mail-enabled security group (which then supports Send As/Send on Behalf like any other security principal via the Exchange admin center or Set-DistributionGroup), or using -GrantSendOnBehalfTo, which works natively on a plain distribution group and is the closest cloud-native equivalent to what this post achieves on-prem.

Resources

🛠️

Gear We Recommend

A few general tech accessories worth having alongside this.

Browse our General Tech Accessories picks on Amazon

As an Amazon Associate, TechyGeeksHome earns from qualifying purchases.


Discover more from TechyGeeksHome

Subscribe to get the latest posts sent to your email.

Andrew Armstrong

Andrew Armstrong is a UK-based IT professional with 26+ years of hands-on experience in Windows, Windows Server, SCCM/ConfigMgr, Active Directory, PowerShell, and enterprise infrastructure.

He founded TechyGeeksHome in 2010 and has published over 1,500 practical guides covering real-world IT problems and solutions. When not solving IT problems,

Andrew develops free Windows utilities including Ultimate Settings Panel, which has been downloaded over 850,000 times.