Exchange 2019 cross-forest permission issue, msExchVersion strange behaviour.

Question

Hi there!

We have 2 forests (2-way trust), one forest has Exchange 2019 (CU11) and the other Exchange 2019 (CU10).

FIM GALSync is syncing Address Books between organization. So we have cross-forest contacts created with the attribute set required for cross-forest sharing ability.

FIM has been setup a while ago when both Exchange orgs were on 2013 version, and all the cross-forest contacts have msExchVersion attribute value set to '88218628259840', which refers to Exchange 2013.

When I try to add cross-forest permissions with msExchVersion=88218628259840 I got an exception:

Add-MailboxPermission domain1\john.smith -user domain2\michael.brown -AccessRights fullaccess -AutoMapping:$False -InheritanceType all

WARNING: An unexpected error has occurred and a Watson dump is being generated: Unable to cast object of type 'Microsoft.Exchange.Data.Directory.Recipient.ADContact' to type
 'Microsoft.Exchange.Data.Directory.Recipient.IADSecurityPrincipal'.
Unable to cast object of type 'Microsoft.Exchange.Data.Directory.Recipient.ADContact' to type 'Microsoft.Exchange.Data.Directory.Recipient.IADSecurityPrincipal'.
    + CategoryInfo          : NotSpecified: (:) [Add-MailboxPermission], InvalidCastException
    + FullyQualifiedErrorId : System.InvalidCastException,Microsoft.Exchange.Management.RecipientTasks.AddMailboxPermission

Although, I can add cross-forest permissions to the calendar:

Add-MailboxfolderPermission "john.smith@domain1.com:\Calendar" -user michael.brown@domain2.com -AccessRights PublishingEditor
FolderName           User                 AccessRights
----------           ----                 ------------

Calendar michael.brown {PublishingEditor}

Then I set msExchVersion=1125899906842624 to the cross-forest contact, which is actually 2016, but I'm not able to find any reference to 2019.

Now I'm able to successfully add cross-forest permissions:

Add-MailboxPermission domain1\john.smith -user domain2\michael.brown -AccessRights fullaccess -AutoMapping:$False -InheritanceType all

Identity             User                 AccessRights      IsInherited Deny
--------             ----                 ------------                                                                                                      ----------- ----
domain1.local\jo...  domain2\michael.b... {FullAccess}      False       False

At the same time I got 'Add-MailboxfolderPermission' broken:

Add-MailboxfolderPermission "john.smith@domain1.com:\Calendar" -user michael.brown@domain2.com -AccessRights PublishingEditor

The user "michael.brown@domain2.com" is either not valid SMTP address, or there is no matching information.
    + CategoryInfo          : NotSpecified: (:) [Add-MailboxFolderPermission], InvalidExternalUserIdException
    + FullyQualifiedErrorId : [Server=ServerName,RequestId=29d1bcf9-52f8-4bf9-90a7-570a392490c7,TimeStamp=22.11.2021 10:16:00] [FailureCategory=Cmdlet-InvalidExternalUse
   rIdException] 78747CAA,Microsoft.Exchange.Management.StoreTasks.AddMailboxFolderPermission

I have never managed to get these things work together. We have not had any issues with sharing on Exchange 2013.

We have no option to open a case in MS Support, so any input would be appreciated.