REST API — can't set displayName (and owners) on an Entra distribution group

Question

Environment: Adaxes REST API, called from ServiceNow. Auth via Adm-Authorization header with a service-account token (search + create work). Target: Entra distribution groups (adm-AzureGroupType = 2) in OU=Groups,DC=[domain],DC=onmicrosoft,DC=com.

What works: POST /api/directoryObjects creates the DL fine (resultType: 0) with cn, adm-AzureGroupType: 2, mailNickname, description.

Problem 1 — displayName at create fails: Adding a displayName property to that same create body returns: "resultType": 1, "message": "Illegal modify operation. Some aspect of the modification is not permitted." The object is created but the op reports failure. We've already granted the service account Write on Display Name via its Security Role, and it still fails.

Problem 2 — displayName via PATCH fails: PATCH /api/directoryObjects with: { "directoryObject": "CN=...,OU=Groups,DC=[domain],DC=onmicrosoft,DC=com", "properties": [{ "propertyName": "displayName", "propertyType": "String", "values": ["Renamed"], "operation": "Update" }] } returns HTTP 500 (Method failed: (/restApi/api/directoryObjects) with code: 500).

Questions:

1. Correct way to set Display Name on a mail-enabled Entra distribution group via REST — at create or via PATCH? Is it Exchange-managed and not settable through the directory-modify path?
2. Valid operationType values for the PATCH operation field, and is operation/mask required? A working PATCH example that sets displayName would be ideal.
3. Same for setting owners (adm-ManagedByList) on a distribution group.
4. What Adaxes Security Role permissions does the service account need to create a distribution group and set its Display Name, owners (adm-ManagedByList), and members specifically which permitted operations / property-write grants (and on which object types/scope)? We want to confirm this isn't a role permission gap before pursuing it as an API issue.

Answer 1

Hello,

The behavior is expected. In case of Microsoft Entra groups, you should only set the cn attribute in your requests. There is no possibility to set the displayName one.

As for owners and group members, it should work just fine. Please, provide the full script you are suing in TXT format. Should you face any errors/warnings, please, provide screenshots. Also , please, provide a screenshot of the Multi-server environment dialog. The dialog displays how many Adaxes services you have and what their versions are. For information on how to view it, see https://www.adaxes.com/help/MultiServerEnvironment. You can post the details and screenshots here or send them to support@adaxes.com.

Comments

Yep dropping display name fixed it, thank you!

Do you know the required property for 'Allow External Senders' ?

---

Hello,

There is no such property as far we can see. That is something dedicated to Exchange Online and thus must be managed using the dedicated functionality. For example, you can use the Modify Exchange properties action in a business rule. The following tutorial will be helpful: https://www.adaxes.com/help/AutomateExchangeMailboxConfiguration. However, the action will only work once the group is recognized by Adaxes as Exchange recipient.

---

The group creation box on the Adaxes Console lets you do it, it shows a tickbox for 'Let people outside the organization email this group' so do you know what that maps to?

---

Hello,

Sorry for the confusion, that is exactly the property you mentioned in the previous post. The schema name of the property is allowExternalSenders.