How to Grant Exchange Online Permissions for Shared Mailbox Sync

This article explains how to grant the Barracuda Cloud Archiving Service application the Exchange Online permissions required for Shared Mailbox Sync in Microsoft 365. Complete this procedure after the application has been enrolled in your tenant and Graph permissions have been approved.

• Verify tenant enrollment and Graph permissions – Ensure the Barracuda Cloud Archiving Service application is enrolled and consented in your Microsoft 365 tenant, and that Microsoft Graph admin consent has been granted. For instructions, see How to Approve Microsoft Graph Permissions for Barracuda Cloud Archiving Service. For tenant-wide admin consent steps in Microsoft Entra ID, see the Microsoft article on granting tenant-wide admin consent.

• Install or update the Exchange Online PowerShell module – Use Install-Module ExchangeOnlineManagement for a new installation or Update-Module ExchangeOnlineManagement to update an existing installation.

• Sign in with required admin permissions – Ensure your administrator account has permission to assign Exchange Online application roles (typically requires membership in the Exchange Organization Management role group and the Microsoft Entra Exchange Administrator role).

Complete the following steps in Exchange Online PowerShell to grant permission to the Barracuda Cloud Archiving Service application.

You need the following two values from Microsoft Entra ID:

• Application (client) ID – The application ID is constant for the Barracuda Cloud Archiving Service application across all customer tenants: f2093a6d-9c74-41d8-ad61-160e6ff0510f

  Open

  

• Service principal Object ID – The unique object identifier for the Barracuda Cloud Archiving Service application in Enterprise Applications.

To locate the service principal Object ID in the Microsoft Entra admin center:

1. Sign in to the Microsoft Entra admin center.

2. Go to Applications > Enterprise applications.

3. Search for and select Barracuda Cloud Archiving Service.

4. On the Overview page, copy the Object ID value.

   Open

   

Alternatively, retrieve the service principal Object ID using Microsoft Graph PowerShell:

1. Open PowerShell and connect to Exchange Online:

   Import-Module ExchangeOnlineManagement Connect-ExchangeOnline -Organization "<your-tenant>.onmicrosoft.com"

2. Register the Barracuda Cloud Archiving Service application in Exchange Online. The Application (client) ID is constant for all customers. Replace <service-principal-object-id> with the Object ID from your Microsoft 365 tenant:

   New-ServicePrincipal ` -AppId "f2093a6d-9c74-41d8-ad61-160e6ff0510f" ` -ServiceId "<service-principal-object-id>" ` -DisplayName "Barracuda-SharedMailboxSync"

3. Assign the View-Only Recipients permission to the application using the Application ID:

   New-ManagementRoleAssignment ` -App "f2093a6d-9c74-41d8-ad61-160e6ff0510f" ` -Role "View-Only Recipients" ` -Name "Barracuda-SharedMailboxSync-ViewOnly"

Run the following command used in the assignment:

Expected Result:

• Role: View-Only Recipients

• RoleAssigneeType: ServicePrincipal (confirms assignment directly to the application rather than a user)

After this permission is granted, Shared Mailbox Sync can read the Exchange recipient and mailbox delegation information required to identify shared mailboxes and their delegates. Delegates must also have at least Reviewer permission for the shared mailbox, as described in How to Synchronize Shared Mailboxes.

• New-ServicePrincipal fails – Confirm that the Application ID and service principal Object ID belong to the same Barracuda application in Microsoft Entra ID.

• New-ManagementRoleAssignment fails – Ensure your administrator account belongs to the Exchange Organization Management role group.

• Role assignment does not appear in verification – Confirm that you used the Application (client) ID with -App and the service principal Object ID with -ServiceId.

• Sync fails immediately after setup – Allow 15 minutes for Microsoft 365 role propagation and verify that Graph admin consent was previously granted.

See also How to Synchronize Shared Mailboxes.