Verify the domain name in Microsoft® Active Directory®. When you set the permissions, you must match the domain name in Microsoft Active Directory.

1. On a computer that hosts the Microsoft® Exchange Management Shell, open the Microsoft Exchange Management Shell.
2. Type Get-MailboxDatabase | Add-ADPermission -User "BESAdmin" -AccessRights ExtendedRight -ExtendedRights Receive-As, ms-Exch-Store-Admin.
3. Type Add-RoleGroupMember "View-Only Organization Management" -Member "BESAdmin".
4. Do one of the following:
   • To set the permissions at the organizational unit level, type the following command:

     Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "OU=<organizational_unit>,DC=<domain_1>,DC=<domain_2>,DC=<domain_3>"

     For example, if the organizational unit is Texas and the domain name is example.organization.net, type Texas for <organizational_unit>, example for <domain_1>, organization for <domain_2>, and net for <domain_3>.

   • To set the permissions at the common name level, type the following command:

     Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "CN=<common_name>,DC=<domain_1>,DC=<domain_2>,DC=<domain_3>"

     For example, if the common name is Users and the domain name is example.organization.net, type Users for <common_name>, example for <domain_1>, organization for <domain_2>, and net for <domain_3>.

   In each command, <domain_1>, <domain_2>, and <domain_3> form the internal Microsoft Active Directory domain (if internal and external domain names are different). You can contact your Microsoft Active Directory administrator for information about distinguished names.