Need to run the powershell script from Servicenow on the Midserver for the shared mailbox removal

[Atiruveedula]

Hi all,

I've built an employee offboarding flow in Flow Designer (Zurich) that handles the AD side end to end - disable user, remove from groups, update attributes, move to an Archived OU - all working using the OOTB Microsoft AD (ADv2) spoke actions.

I now need to add two Exchange Online mailbox steps on offboarding:
1. Convert the leaver's own mailbox to a shared mailbox (Set-Mailbox -Type Shared).
2. Remove the leaver's access (Full Access / Send-As) to any shared mailboxes they had (Remove-MailboxPermission / Remove-RecipientPermission).

**What I've found so far:**
- There are no OOTB actions in the Exchange Online spoke for either of these (no convert-to-shared, no remove-mailbox-permission).
- My understanding is this is because Microsoft Graph has no API for mailbox permissions or mailbox-type conversion - they can only be done via Exchange Online PowerShell. So these have to run as custom PowerShell on the MID Server.

**The blocking problem:**
Custom (inline) PowerShell will not execute on our MID Server at all. To prove it wasn't my script, I created a trivial custom action with a single line - Write-Output "test successful" - set to run inline on the MID Server via our AD connection alias. It fails with:

- Failed while executing commandScript<number>.PS1 (Access denied)
- PowerShell script execution failed. Script returned status 1 using account user <domain>\<service account>

So even a one-line inline script fails with Access denied. OOTB spoke actions (which use pre-existing scripts on the MID Server) work fine - it's specifically custom/inline PowerShell that fails. From investigation, it looks like the inline script gets copied into a hidden AppData folder under one account's profile but is executed under a different PowerShell service account that can't access that folder. We tried setting the MID Server property mid.powershell.target_base_dir to a neutral folder both accounts can access, confirmed it applied, but scripts still execute from the profile path and still fail.

**My questions:**
1. Has anyone gotten custom/inline PowerShell to run reliably on a Windows MID Server, and how did you resolve the 'commandScript.PS1 (Access denied)' execution-context issue?
2. Is mid.powershell.target_base_dir the correct property to relocate inline script execution, and why might it not take effect (Zurich)?
3. For Exchange Online mailbox permissions / convert-to-shared specifically - has anyone automated these from ServiceNow? Did you use custom PowerShell on the MID Server, or an external approach (Azure Automation, Power Automate) triggered by ServiceNow?
4. Is there any OOTB or supported route for these two operations I might have missed?

**Environment:** ServiceNow Zurich, Windows MID Server, Exchange Online (M365 cloud-only), ADv2 + Exchange Online + Entra ID spokes installed.

Any guidance appreciated - happy to share more detail.

Thanks!

[Atiruveedula]

Hi @J Siva 

The service account is having full access but still i get the same issue.. 

So when ur saying ur not using the same service account wat do u mean. Did u use a seperate SA for mailbox thing?

Now we have this account used for performing all the actions like removing the groups & moving the account from one OU to another. So do we need to create again a seperate account for mailbox but wat diff does it makes?

My test credential is always failing not sure wat the problem is. Since the AD teams says the SA has full rights. So wat could the fix be?

[J Siva]

Hi @Atiruveedula 
1. I'm not using the same account as the MID Server logon account and the integration service account
2. Please ignore the test credential error. I'm getting the same error as well. However, when I run the custom action manually, it works fine.

I just installed AD in my server. Will setup the custom action and let you know how it goes.

[Atiruveedula]

wat do u mean by run manually means just hitting the test button of the action 

i dont understand works fine for u means ur able to remove the shared mailbox or mailbox of the user. how does ur script look like . Can u please give me in bit detailed. i am stuck and cant move further. ur help is really appriciated. Thq so much.

[Atiruveedula]

Hello @J Siva , Did u have any luck with ur share mailbox converting & removal. if yes please can u suggest me wat are the steps to follow.

Thanks.

[J Siva]

Hi @Atiruveedula 
Apologies for the delay.

Yes, I was able to set up and run AD on my private server. I was also able to execute the PowerShell script on my MID Server host without any errors.

What I have done so far:

1. Created a MID Server service account and granted it the "Log on as a service" permission.
2. Created a separate service account for AD integration without granting any additional permissions.
3. Created a new PowerShell script file in ServiceNow and selected "PowerShell" as the parent type.
   
4. Created a new Connection & Credential Alias:
   • Host: IP address of the MID Server host. (I've installed both Active Directory and the MID Server on the same Windows server. If your MID Server and AD are hosted on different servers, use the IP address or FQDN of the AD server)
5. Created a custom Action with a PowerShell step and selected my custom PowerShell script in the Action.
   Output: