Connexion
How to Create an Emailable Exchange Distribution List with Internal and External Contacts?
Scenario:
If you need a distribution list in Exchange that includes both internal organization contacts and external contacts—without requiring external users to be invited as guest accounts—there’s a simple way to achieve this.
In Exchange Online, external contacts are referred to as Mail Contacts. These allow you to add external email addresses to your organization’s address book, making them available for inclusion in distribution lists. By leveraging Mail Contacts, you can create a fully functional distribution list that includes both internal users and external recipients while keeping everything manageable within Exchange.
Managing email distribution lists efficiently is crucial for organizations that need to communicate with both internal and external contacts. While Exchange Online allows us to create Mail Contacts programmatically using PowerShell scripts or the Exchange Online Management API, automating this process is key—especially when integrating it with Dynamics 365 Marketing Lists.
The Automation Challenge
In my case, I wanted to automatically add new contacts from a specific Dynamics 365 Marketing List to a corresponding Exchange Distribution List. Initially, I considered using Power Automate to invoke a PowerShell script, but that introduced additional complexities:
- Using Power Automate to trigger an Azure Automation Runbook
- Managing authentication and execution permissions
- Handling execution timing and monitoring
A More Efficient Approach: Logic Apps
Instead of relying on Power Automate, I found a better and more streamlined approach—using Azure Logic Apps. Unlike Power Automate, Logic Apps offer built-in functionality to create and execute Runbook Jobs directly within Azure Automation.
What This Blog Covers
In this post, I’ll walk you through:
Setting up an Azure Automation Account Creating a Runbook to execute a PowerShell script that adds Mail Contacts Using Azure Logic Apps to trigger the Runbook Handling authentication across these services
By the end, you’ll have an end-to-end automation setup that seamlessly adds external contacts to Exchange Distribution Lists as soon as they join a Dynamics 365 Marketing List—without requiring manual intervention.
Let’s dive in!
Step 1: Set up the Azure Automation Account
- Log in to Portal Azure https://portal.azure.com/ and in the search box, type Automation Accounts
2. Click on Create, Select your Subscription and Resource group, and type in the Automation Account Name
2. Then click the Advanced Tab, and on the Managed Identities, select User Assign; we will set up the User Managed Identity in the next steps.
3. Click Review and Create.
Step 2: Setup the User Managed Identity
A common challenge for developers is the management of secrets, credentials, certificates, and keys used to secure communication between services. Managed identities eliminate the need for developers to manage these credentials.
A common challenge for developers is the management of secrets, credentials, certificates, and keys used to secure communication between services. Managed identities eliminate the need for developers to manage these credentials.
While developers can securely store the secrets in Azure Key Vault, services need a way to access Azure Key Vault. Managed identities provide an automatically managed identity in Microsoft Entra ID for applications to use when connecting to resources that support Microsoft Entra authentication. Applications can use managed identities to obtain Microsoft Entra tokens without having to manage any credentials.
So Let’s see how to setup the account with the Required Permissions!
- On the Search, Type Managed Identities
2. Click Create, Select the subscription, Resource group, and give it a name
3. Then Press Review and Create
4. Open the automation account that we have created in Step no. 1
5. Search for Identity, open the link, select user assigned, and click Add.
6. Add the managed identity that we have just created.
7. Next comes setting the Permissions for the Managed Identity, so go back and open the Managed Identity.
8. Go to Azure Role Assignments and add the Automation Contributor Role; this is required to enable the Logic app to execute the RunBook (we will be creating this in the next step) on the automation account.
9. Grant the Exchange.ManageAsApp API permission for the managed identity to call Exchange Online, Unfortunately, this step can’t be done through the Azure / Entra Portal, so we will be using Graphy API Explorer to achieve this.
Get the Managed Identity’s Object ID
Get Exchange Online Service Principal ID
Open Grap API Explorer, Login ,and run the below query and grap the Exchange online service Principal ID
Method: Get
https://graph.microsoft.com/v1.0/servicePrincipals?$filter=appId eq '00000002-0000-0ff1-ce00-000000000000'Assign the Exchange.ManageAsApp Permission
Using Graph Explorer API again, use the below to assign the Exchange.ManageAsApp Permission
POST https://graph.microsoft.com/v1.0/servicePrincipals/{MANAGED_IDENTITY_OBJECT_ID}/appRoleAssignments
Authorization: Bearer YOUR_ACCESS_TOKEN
Content-Type: application/json
{
"principalId": "{MANAGED_IDENTITY_OBJECT_ID}",
"resourceId": "{EXCHANGE_ONLINE_SERVICE_PRINCIPAL_ID}",
"appRoleId": "dc50a0fb-09a3-484d-be87-e023b12c6440"
}
10. Assign Microsoft Entra roles to the managed identity; you will need to assign the Exchange Administrator Role
In the Search type role and select Microsoft Entra Roles and administrators
11. Open Exchange Administrator Assignments and add the user Managed Identity by clicking the Add Assignments Button .. Global administrator privileges will be required for this.
Step 4: Import Exchange Management Modules
- Open the Automation Account that we have created in step 1
- Navigate to Shared Resources -> Modules
- Click Add Module
4. Click Browse from gallery
- Open the Automation Account
- Navigate to Process Automation -> Runbooks
- Search for PackageManagement and select and choose the Runtime Version 5.1
4. Repeat for Add PowerShellGet and choose Runtime Version 5.1
5. Repeat for ExchangeOnlineManagement and choose Runtime Version 5.1
Step 5: Create a runbook in Azure Automation
- Open the Automation Account
- Navigate to Process Automation -> Runbooks
- Click on Create a runbook. Make sure you are using Runtime Version 5.1 because PowerShell works only for this Version
4. Open the Run Book and click Edit in Portal.
5. Paste the below Powershell Script that connects to exchange
//The below piece of code sets parameters on the run book so that when called from a logic app we can pass these parameters to the run book.
param (
[string]$MailContactName,
[string]$MailContactEmail,
[string]$DistributionList
)
// Connects to Exchange online via the managed Identity that have been setup in step 3
Connect-ExchangeOnline -ManagedIdentity -Organization Organisationdomain.onmicrosoft.com -ManagedIdentityAccountId {Managed Account Identity ID}
//Creates a mail contact in Exchange
New-MailContact -Name $MailContactName -ExternalEmailAddress $MailContactEmail
//Add mail Contact to the Distribution List
Add-DistributionGroupMember -Identity $DistributionList -Member $MailContactEmail
6. After that Click Save and Publish
7. You can then test the runbook by clicking the Test Pane on the Edit in Portal Screen of the runbook, entering the parameters and clicking start.
Step 5: Create the Logic App
So the Logic app will be created in a schedule and can query any enterprise connector like dataverse and then call the runbook that has been created in Step 5
- From the Azure Portal , Look for Logic Apps and click Add
- Choose the Hosting Plan, and here you can select the Consumption plan
3. Select the subscription, the Resource Group and add the logic app name
4. Click Review and Create and then Create
5. On the created Logic app, search for Identity, Navigate to user assigned and add the Managed identity created in step 2
5. Navigate to the Logic app designer. On the Add Trigger step, choose schedule and set the recurrence schedule. Then, add Action and look for Create Job and select the one under Azure Automation
6. Set the Connection Name and Choose the Authentication Type as Logic Apps Managed Identity
7. Select the Subscription, Resource Group, Automation Account, Run book and pass the required Parameters
8. Save and test the Logic App
Resources:
https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview
