Exchange 2013 Grant Create/Delete permissions for all OU's user's Calendars WITHOUT continually maintaining a list

Question

I wrote an external application that needs permissions to Create/Delete items on all user's Calendars (that belong to a specific OU).

The application connects to Exchange 2013 by invoking EWS web service methods such CreateItem/DeleteItem/etc.

Furthermore, it authenticates against EWS 2013 with a single user. I need to grant this user the above mentioned permissions to all those calendars.

HOWEVER, this OU is constantly changing, adding/removing members, etc. I am trying to avoid doing this through a Security Group which I have to constantly maintain to make sure it's up to date.

Answer 1

One option would be to use EWS Impersonation https://msdn.microsoft.com/en-us/library/office/dn722377(v=exchg.150).aspx if you grant that at the Org level it will automatically apply to new users. However the downside of this is that this gives your service account full access to all mailboxes.