Adding exchange after the initial build

Hi alexander green 

If the service account you're using to connect to a managed domain doesn't not have domain admins, you need to ensure that you've granted all the permissions to that service account

Within the below KB, have a look at the permissions from "Access to Exchange Organizations" down

Active Roles service account minimum permissions (4323027)

When you change the permissions of the service account used to connect to that managed domain with Exchange, just restart the Administration service for it to pick up the differences, and read in the Exchange Org.

See that's what I thought, so I've put this account into Domain Admins and yet, even after the restart, it won't give me the edsaIsMsExchangePresent as true nor will it pull the exchange information into ARS

The Domain Admins Active Directory Role is not the only thing needed for Microsoft Exchange access. There is a separate section in the Quick Start Guide that outlines the necessary permissions.

https://support.oneidentity.com/technical-documents/active-roles/8.1.5/quick-start-guide/3#TOPIC-2170020

Check the section titled "Access to Exchange Organizations"

After adding this, restart the Active Roles Administration Service.

Yes, I've granted it access to Exchange Organization, recipient admins, account operators and it still isn't showing the information.  I do however have the reason, or the suspected reason, it's a GSMA account and they can't be used for exchange tasks.

I'm doing a proxy account now to see if that fixes it and I'll then leave gsma account doing the local services.

That would absolutely explain the issues. Active Roles exclusively leverages Remote Exchange PowerShell as the API used to connect to Microsoft Exchange, and Microsoft explicitly blocks gMSA accounts from running any PowerShell commands for security reasons. Unfortunately, this creates a Venn Diagram where the overlap leads to Active Roles not being able to connect to on-prem Microsoft Exchange. A proxy account being used to manage the domain is the best option.

That would absolutely explain the issues. Active Roles exclusively leverages Remote Exchange PowerShell as the API used to connect to Microsoft Exchange, and Microsoft explicitly blocks gMSA accounts from running any PowerShell commands for security reasons. Unfortunately, this creates a Venn Diagram where the overlap leads to Active Roles not being able to connect to on-prem Microsoft Exchange. A proxy account being used to manage the domain is the best option.

Yep, changed it to a proxy account and it worked, i'll remove the GMSA account and move over to a regular account. Thanks very much!