Skip to main content
Troubleshooting & Support

Resolving the "Exchange management role entries are missing or empty" error during INKY install

Written By Nathan McCurley

Last updated 2 days ago

What You Need to Know

During INKY installation or permission verification in Microsoft 365, you may see an error saying that one or more Exchange management role entries are missing or empty. This is a problem inside the Microsoft 365 tenant's Exchange Online permissions, not an INKY problem.

Only Microsoft can fix it. Open a support case with Microsoft, ask them to restore the missing role entries, then retry the INKY install.

The Error

The error appears in red in the install or permission verification log and reads like this:

One or more Exchange management role entries are missing or empty. These entries define what roles are needed to run the corresponding commands, so a command with a missing entry cannot be run because there is no role that allows it. Contact Microsoft support to resolve this issue. The required commands with missing entries are: Get-ArcConfig, Get-DynamicDistributionGroupMember, Get-ExoPhishSimOverrideRule, ...

The list of commands at the end varies by tenant. For example, one affected tenant listed:

  • Get-MessageTraceV2 and Get-MessageTraceDetailV2

  • Get-ServicePrincipal and New-ServicePrincipal

  • Get-ArcConfig and Set-ArcConfig

  • Get-, New-, Set- and Remove-PhishSimOverridePolicy

  • Get-, New-, Set- and Remove-ExoPhishSimOverrideRule

  • Get-, New- and Remove-TenantAllowBlockListSpoofItems

  • Get-DynamicDistributionGroupMember

Why This Happens

Exchange Online controls who can run which PowerShell commands through Role Based Access Control (RBAC). Each command must be linked to a management role by a role entry. A role assignment then grants that role, and its commands, to a user or app.

When a command has no role entry in the tenant, no role contains it. That means no account can be granted permission to run it: not INKY's app, not a Global Administrator, not anyone. INKY's install checks that it can run the commands it needs, finds these entries missing, and stops with this error.

The commands in the error are part of Exchange Online, not INKY. INKY only calls them.

Why INKY or Your Admin Can't Fix This

  • Built-in roles are managed by Microsoft. Microsoft's documentation states that role entries can't be added to built-in roles.

  • Custom roles don't help. A custom role can only include commands that already exist on its parent role, so a command with no entry anywhere can't be added.

  • Granting more permissions doesn't help. Adding the INKY app or an admin to more role groups won't work, because no role contains these commands.

This is why the error itself says to contact Microsoft support.

Confirm the Issue (Optional)

You can confirm the problem outside of INKY in Exchange Online PowerShell.

  1. Connect as a Global Administrator:

Connect-ExchangeOnline

  1. Check whether any management role contains one of the commands from your error. For example, for Get-MessageTraceV2:

Get-ManagementRoleEntry "*\Get-MessageTraceV2" | Where-Object Name -eq "Get-MessageTraceV2" | Format-Table Role, Name

In an affected tenant this returns nothing. In a healthy tenant it lists each role that contains the command.

  1. Try running the command directly:

Get-MessageTraceV2

If the command fails or isn't recognized, the tenant is affected regardless of INKY. Save this output for your Microsoft support case.

Resolve the Issue

  1. In the Microsoft 365 admin center, select Help & support and open a new service request. You need an admin role that can create support requests.

  2. Paste the full error text, including the complete list of commands with missing entries.

  3. Ask Microsoft to restore the missing Exchange Online management role entries for those commands in your tenant.

  4. Include the output from the steps in Confirm the Issue, if you ran them.

  5. After Microsoft confirms the fix, allow time for the change to replicate across Exchange Online, then retry the INKY install.

No changes are needed in INKY. Once the role entries exist, the permission check passes.

Common Issues

Microsoft support says to check INKY's permissions

Cause: Support may treat this as a missing role assignment, which is a more common RBAC problem that admins can fix themselves.

Solution: Point out that the error is about missing role entries, not missing role assignments. Show the empty Get-ManagementRoleEntry result. Role entries on built-in roles can only be restored by Microsoft.

The error still appears after Microsoft's fix

Cause: The change hasn't replicated yet, or only some of the listed commands were restored.

Solution: Repeat the check in Confirm the Issue for each command in the error. Any command that still returns nothing needs to go back to Microsoft on the same case.

Can we skip the check and finish the install?

Solution: No. INKY needs these commands to run. Installing without them would leave parts of INKY unable to work in the tenant.

Sources

Was this helpful?

Still need help? Ask the team