Commands › Exchange Online

Add-ADPermission

Exchange Online ExchangeOnlineManagement Add-*

Add permissions to an Active Directory object.

Quick start script

# Add-ADPermission — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Add-ADPermission -Identity <ADRawEntryIdParameter> -Instance <ADAcePresentationObject> -Owner <SecurityPrincipalIdParameter> | Format-List

# 3. Export for evidence / drift tracking
Add-ADPermission | Export-Clixml .\ADPermission-$(Get-Date -Format yyyyMMdd).xml

Syntax — 3 parameter sets

AccessRights

Add-ADPermission [-Identity] <ADRawEntryIdParameter> -User <SecurityPrincipalIdParameter>
 [-AccessRights <ActiveDirectoryRights[]>]
 [-ChildObjectTypes <ADSchemaObjectIdParameter[]>]
 [-Confirm]
 [-Deny]
 [-DomainController <Fqdn>]
 [-ExtendedRights <ExtendedRightIdParameter[]>]
 [-InheritanceType <ActiveDirectorySecurityInheritance>]
 [-InheritedObjectType <ADSchemaObjectIdParameter>]
 [-Properties <ADSchemaObjectIdParameter[]>]
 [-WhatIf]
 [<CommonParameters>]

Owner

Add-ADPermission [-Identity] <ADRawEntryIdParameter> -Owner <SecurityPrincipalIdParameter>
 [-Confirm]
 [-DomainController <Fqdn>]
 [-WhatIf]
 [<CommonParameters>]

Instance

Add-ADPermission [[-Identity] <ADRawEntryIdParameter>] -Instance <ADAcePresentationObject>
 [-AccessRights <ActiveDirectoryRights[]>]
 [-ChildObjectTypes <ADSchemaObjectIdParameter[]>]
 [-Confirm]
 [-Deny]
 [-DomainController <Fqdn>]
 [-ExtendedRights <ExtendedRightIdParameter[]>]
 [-InheritanceType <ActiveDirectorySecurityInheritance>]
 [-InheritedObjectType <ADSchemaObjectIdParameter>]
 [-Properties <ADSchemaObjectIdParameter[]>]
 [-User <SecurityPrincipalIdParameter>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (14)

Parameter	Type	Required	What it controls
-Identity	ADRawEntryIdParameter	yes	The Identity parameter specifies the identity of the object that's getting permissions added. You can specify either the distinguished name (DN) of the object or the object's name if it's unique. If the DN or name...
-Instance	ADAcePresentationObject	yes	The Instance parameter enables you to pass an entire object to the command to be processed. It's mainly used in scripts where an entire object must be passed to the command.
-Owner	SecurityPrincipalIdParameter	yes	The Owner parameter specifies the owner of the Active Directory object. You can specify the following types of users or groups (security principals) for this parameter:
-User	SecurityPrincipalIdParameter	yes	The User parameter specifies who gets the permissions on the Active Directory object. You can specify the following types of users or groups (security principals) for this parameter:
-AccessRights	ActiveDirectoryRights[]		The AccessRights parameter specifies the rights that you want to add for the user on the Active Directory object. Valid values include:
-ChildObjectTypes	ADSchemaObjectIdParameter[]		The ChildObjectTypes parameter specifies what type of object the permission should be applied to.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Deny	SwitchParameter		The Deny switch specifies that the permissions you're adding are Deny permissions. You don't need to specify a value with this switch.
-DomainController	Fqdn		The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-ExtendedRights	ExtendedRightIdParameter[]		The ExtendedRights parameter specifies the extended rights needed to perform the operation.
-InheritanceType	ActiveDirectorySecurityInheritance		The InheritanceType parameter specifies how permissions are inherited. Valid values are:
-InheritedObjectType	ADSchemaObjectIdParameter		The InheritedObjectType parameter specifies what kind of object inherits this access control entry (ACE).
-Properties	ADSchemaObjectIdParameter[]		The Properties parameter specifies what properties the object contains.
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.