Skip to content

Update app-only-auth-powershell-v2.md #5340

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Apr 20, 2020
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -31,13 +31,14 @@ The following examples show how to use the Exchange Online PowerShell V2 module
- Connect using a local certificate:

```powershell
Connect-ExchangeOnline -CertificateFilePath "C:\Users\johndoe\Desktop\automation-cert.pfx" -AppID "alpha-beta-gamma-123456" -TenantID "contosoelectronics.onmicrosoft.com"
Connect-ExchangeOnline -CertificateFilePath "C:\Users\johndoe\Desktop\automation-cert.pfx" -AppID "alpha-beta-gamma-123456" -TenantID "contosoelectronics.onmicrosoft.com" -RoutingHintUPN "admin_exo@contosoelectronics.com"
```
The _RoutingHintUPN_ value is an admin email address in the tenant, and is used for efficient routing of requests. The email address of any admin in the organization works for app-only authentication scenarios.

- Connect using a certificate thumbprint:

```powershell
Connect-ExchangeOnline -CertificateThumbPrint "012THISISADEMOTHUMBPRINT" -AppID "alpha-beta-gamma-123456" -TenantID "contosoelectronics.onmicrosoft.com"
Connect-ExchangeOnline -CertificateThumbPrint "012THISISADEMOTHUMBPRINT" -AppID "alpha-beta-gamma-123456" -TenantID "contosoelectronics.onmicrosoft.com" -RoutingHintUPN "admin_exo@contosoelectronics.com"
```

- Connect using an existing service principal and client-secret:
Expand Down Expand Up @@ -100,11 +101,11 @@ The following list describes other items that we're working on:
- Support for more built-in RBAC roles (Exchange Service Admin, Global Reader, Recipient Admin)
- Custom RBAC and mailbox scoping using Azure AD administrative units.
- Delegation support in app-only scenarios
- Support for Security & Compliance Center PowerShell cmdlets.


## Appendix

### Step 1: Application registration in Azure AD
## Step 1: Application registration in Azure AD

If you encounter problems, check the [required permssions](https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal#required-permissions) to verify that your account can create the identity.

Expand Down Expand Up @@ -154,7 +155,7 @@ You need to assign the API permission `Exchange.ManageAsApp` so the application

7. Close the flyout when you're finished.

### Step 3: Generate a self-signed certificate
## Step 3: Generate a self-signed certificate

Create a self-signed x.509 certificate using one of the following methods:

Expand All @@ -166,7 +167,7 @@ Create a self-signed x.509 certificate using one of the following methods:

- Use the **makecert.exe** tool from the Windows SDK.

### Step 4: Attach the certificate to the Azure AD application
## Step 4: Attach the certificate to the Azure AD application

After you register the certificate with your application, you can use the public key (.pfx file) or the thumbprint for authentication.

Expand All @@ -184,7 +185,7 @@ After you register the certificate with your application, you can use the public

6. In the dialog that appears, browse to the self-signed certificate you created in the previous Step, and then click **Add**.

### Step 5: Assign a role to the application
## Step 5: Assign a role to the application

Azure AD has more than 50 admin roles available. For app-only authentication in Exchange Online, we currently support the previously mentioned roles:

Expand Down