Need help keeping certain emails in Distribution Group while add or removing other emails with Azure Automation

Hello Tyler Johnson

Your Azure Automation runbook updates Distribution Group (DG) membership based on a CSV list. After the runbook runs, some administrator email addresses that were previously in the DG are removed.

This is happening because your script is enforcing CSV-based desired state. In the REMOVE section, it removes any current DG member that is not present in the CSV. Since your admin addresses are not in the CSV, they are treated as “not desired” and removed by Remove-DistributionGroupMember. The cmdlet removes exactly the member you specify—there is no built-in “protected/permanent member” flag in Exchange Online.

As a workaround maintain a protected/static list of email addresses inside the script and ensure your REMOVE logic skips those addresses. This keeps admins in the DG while the runbook continues to add/remove other members based on the CSV.

Add this PowerShell command just before your REMOVE loop, then update the REMOVE logic as shown:

# List of members that must always stay in the DG
$protectedMembers = @(
    "******@contoso.com",
    "******@contoso.com"
)

# REMOVE: members that are in the group but not in the CSV (except protected)
foreach ($email in $existingMembers) {
    if (($desiredMembers -notcontains $email) -and ($protectedMembers -notcontains $email)) {
        try {
            Remove-DistributionGroupMember -Identity $targetGroup -Member $email -Confirm:$false -ErrorAction Stop
            Write-Output "Removed $email from $targetGroup because it is no longer in the class list."
        } catch {
            Write-Warning "Failed to remove $email: $($_.Exception.Message)"
        }
    } else {
        if ($protectedMembers -contains $email) {
            Write-Output "Skipping protected member: $email"
        }
    }
}

Updated script (with protected members)

# 1. Connect to Exchange Online (Managed Identity)
Connect-ExchangeOnline -ManagedIdentity -Organization "<domain>"

# 2. Define target Distribution Group identity
$targetGroup = "JohnsonTest2"

# 3. Import members from CSV (current class list)
$memberList = Import-Csv "C:\Test\JohnsonTest.csv"

# 4. Build desired members from CSV (normalize)
$desiredMembers = $memberList.UserEmail |
    Where-Object { $_ } |
    ForEach-Object { $_.Trim().ToLowerInvariant() } |
    Select-Object -Unique

# 4a. Define protected/static members that must NEVER be removed (normalize)
$protectedMembers = @(
    "******@contoso.com",
    "******@contoso.com",
    "******@contoso.com"
) | ForEach-Object { $_.Trim().ToLowerInvariant() } | Select-Object -Unique

# 4b. Optional: ensure protected members are always included in the "desired" universe
# (This prevents them from ever being treated as removable and also ensures they're added if missing)
$effectiveDesired = ($desiredMembers + $protectedMembers) | Select-Object -Unique

# 5. Fetch current DG members (normalize)
$existingMembers = Get-DistributionGroupMember -Identity $targetGroup |
    Select-Object -ExpandProperty PrimarySmtpAddress |
    ForEach-Object { $_.ToString().Trim().ToLowerInvariant() } |
    Select-Object -Unique

# 6. ADD: members in effective list but not yet in the group
foreach ($email in $effectiveDesired) {
    if ($existingMembers -contains $email) {
        Write-Output "$email is already a member of $targetGroup, skipping add."
    } else {
        try {
            Add-DistributionGroupMember -Identity $targetGroup -Member $email -ErrorAction Stop
            Write-Output "Successfully added $email to $targetGroup"
        } catch {
            Write-Warning "Failed to add $email: $($_.Exception.Message)"
        }
    }
}

# 7. REMOVE: members in the group but not in effective list
# Protected members are safe because they're included in $effectiveDesired
foreach ($email in $existingMembers) {
    if ($effectiveDesired -notcontains $email) {
        try {
            Remove-DistributionGroupMember -Identity $targetGroup -Member $email -Confirm:$false -ErrorAction Stop
            Write-Output "Removed $email from $targetGroup because it is no longer in the class list."
        } catch {
            Write-Warning "Failed to remove $email: $($_.Exception.Message)"
        }
    } else {
        # Optional logging: show why something was not removed
        if ($protectedMembers -contains $email) {
            Write-Output "$email is protected, skipping removal."
        }
    }
}

This is the supported approach because Exchange Online membership changes are driven by the logic in your automation; the Remove-DistributionGroupMember cmdlet is the supported cmdlet to remove a member.

Reference: https://learn.microsoft.com/en-us/azure/automation/shared-resources/schedules

Thanks,

Suchitra.