Skip to content

Update app-only-auth-powershell-v2.md #10746

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 20, 2023
Merged

Update app-only-auth-powershell-v2.md #10746

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f1ecaad
Update app-only-auth-powershell-v2.md
hnguyen1218 Apr 20, 2023
3dd33b0
Update app-only-auth-powershell-v2.md
chrisda Apr 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions exchange/docs-conceptual/app-only-auth-powershell-v2.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: App-only authentication in Exchange Online PowerShell and Security & Comp
ms.author: chrisda
author: chrisda
manager: dansimp
ms.date: 01/31/2023
ms.date: 4/20/2023
ms.audience: Admin
audience: Admin
ms.topic: article
Expand Down Expand Up @@ -408,11 +408,13 @@ For general instructions about assigning roles in Azure AD, see [View and assign
#### Assign custom Exchange Online role groups to the application using service principals

> [!NOTE]
> Remember, this method is supported only in Exchange Online PowerShell, and only when you connect in [REST API mode](exchange-online-powershell-v2.md#updates-for-the-exo-v3-module) (don't use the _UseRPSSession_ switch in the **Connect-ExchangeOnline** command).
> You need to connect to Exchange Online PowerShell or Security & Compliance PowerShell _before_ completing steps to create a new service principal. Creating a new service principal without connecting to PowerShell won't work (your Azure App ID and Object ID is needed to create the new service principal).
>
> This method is supported only in Exchange Online PowerShell, and only when you connect in [REST API mode](exchange-online-powershell-v2.md#updates-for-the-exo-v3-module) (don't use the _UseRPSSession_ switch in the **Connect-ExchangeOnline** command).
For information about creating custom role groups, see [Create role groups](/exchange/permissions-exo/role-groups#create-role-groups). The custom role group that you assign to the application can contain any combination of built-in and custom roles.

To assign custom Exchange Online role groups to the application using service principals, do the following steps:
To assign custom role groups to the application using service principals, do the following steps:

1. In [Azure Active Directory PowerShell for Graph](/powershell/azure/active-directory/install-adv2), run the following command to store the details of the Azure application that you registered in [Step 1](#step-1-register-the-application-in-azure-ad) in a variable:

Expand All @@ -428,8 +430,8 @@ To assign custom Exchange Online role groups to the application using service pr

For detailed syntax and parameter information, see [Get-AzureADServicePrincipal](/powershell/module/azuread/get-azureadserviceprincipal).

2. In the same PowerShell window, connect to [Exchange Online PowerShell](connect-to-exchange-online-powershell.md) and run the following commands to:
- Create an Exchange Online service principal object for the Azure application.
2. In the same PowerShell window, connect to [Exchange Online PowerShell](connect-to-exchange-online-powershell.md) or [Security & Compliance PowerShell](connect-to-scc-powershell.md) and run the following commands to:
- Create a service principal object for the Azure application.
- Store the details of the service principal in a variable.

```powershell
Expand All @@ -448,7 +450,7 @@ To assign custom Exchange Online role groups to the application using service pr

For detailed syntax and parameter information, see [New-ServicePrincipal](/powershell/module/exchange/new-serviceprincipal).

3. In Exchange Online PowerShell, run the following command to add the service principal as a member of the custom role group:
3. In Exchange Online PowerShell or Security & Compliance PowerShell, run the following command to add the service principal as a member of the custom role group:

```powershell
Add-RoleGroupMember -Identity "<CustomRoleGroupName>" -Member <$<VariableName2>.Identity | $<VariableName2>.ServiceId | $<VariableName2>.Id>
Expand Down