Cannot connect to customer tenant Exchange Online via Secure application model

[Shadoxity]

Hey Everyone,
We are trying to move to use the secure application model for our partner scripts, working fine however we are completely struggling to get the Exchange Online powershell working.
Like the other modules, we need to be able to use our refresh token to sign into it, but I cannot find a way. The instructions here seem to have a prompt for details and the script seems to be incorrect.
https://docs.microsoft.com/en-au/powershell/partnercenter/multi-factor-auth?view=partnercenterps-2.0

I.e. the second part has a use of $credentials when that variable has not been set yet.

We need to know how to connect to this application ID by using a refresh token, but just cannot seem to get there.
If we use the app we added to Azure (which is used for MSOnline etc) with it but with the exchange online application id it says
New-PartnerAccessToken : AADSTS700007: The grant was issued for a different client id.

Hoping someone can help us get this working.

@Shadoxity thank you for opening this issue. An update to the documentation has just been published the example for exchanging the refresh token should have been

$customerId = '<CustomerId>'
$refreshToken = '<RefreshTokenValue>'
$upn = '<UPN-used-to-generate-the-refresh-token>'

$token = New-PartnerAccessToken -ApplicationId 'a0c73c16-a7e3-4564-9a95-2bdf47383716' -RefreshToken $refreshToken -Scopes 'https://outlook.office365.com/.default' -Tenant 'xxxx-xxxx-xxxx-xxxx'

$tokenValue = ConvertTo-SecureString "Bearer $($token.AccessToken)" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($upn, $tokenValue)

$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://ps.outlook.com/powershell-liveid?DelegatedOrg=$($customerId)&BasicAuthToOAuthConversion=true" -Credential $credential -Authentication Basic -AllowRedirection

Import-PSSession $session

The Credential and ServicePrincipal parameters should not have been included in that example. If you are still having issue please feel free to re-open this issue and we can investigate.

[Shadoxity]

There is still a problem with this. This is making it impossible to be compliant with the new partner security requirements. We need to be able to run exchange online powershell based off stored refresh token for the partner center access.

If I use an existing refresh token i get:
New-PartnerAccessToken : AADSTS700007: The grant was issued for a different client id.
Which is fine, cause its trying to use a different application id.

But if I run the command from your documentation (and I am really trying to find a way that does not manually require a password entered each time)

$token = New-PartnerAccessToken -ApplicationId 'a0c73c16-a7e3-4564-9a95-2bdf47383716' -Scopes 'https://outlook.office365.com/.default' -Tenant 'tenantname; -UseDeviceAuthentication

It gives this error

New-PartnerAccessToken : Object reference not set to an instance of an object.
At line:1 char:10

• $token = New-PartnerAccessToken -ApplicationId 'a0c73c16-a7e3-4564-9a ...

•      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [New-PartnerAccessToken], NullReferenceException
  • FullyQualifiedErrorId : System.NullReferenceException,Microsoft.Store.PartnerCenter.PowerShell.Commands.NewPartnerAccessToken

If i remove -usedeviceauthentication it then opens a web browser and you log in and it gives you this error.

Sign in
Sorry, but we’re having trouble signing you in.

AADSTS50011: The reply url specified in the request does not match the reply urls configured for the application: 'a0c73c16-a7e3-4564-9a95-2bdf47383716'.

So still cannot get anywhere.

@Shadoxity you will need to generate a new refresh token explicitly for Exchange Online PowerShell using the following

$token = New-PartnerAccessToken -ApplicationId 'a0c73c16-a7e3-4564-9a95-2bdf47383716' -Scopes 'https://outlook.office365.com/.default' -Tenant 'xxxx-xxxx-xxxx-xxxx' -UseDeviceAuthentication

Note this is required because the access token used to access Exchange Online needs to have specific claims that are only available when you generate an access token using the a0c73c16-a7e3-4564-9a95-2bdf47383716 application identifier. Once you have the newly created refresh token you can exchange it for an access token using the following

$customerId = '<CustomerId>'
$refreshToken = '<RefreshTokenValue>'
$upn = '<UPN-used-to-generate-the-refresh-token>'

$token = New-PartnerAccessToken -ApplicationId 'a0c73c16-a7e3-4564-9a95-2bdf47383716' -RefreshToken $refreshToken -Scopes 'https://outlook.office365.com/.default' -Tenant 'xxxx-xxxx-xxxx-xxxx'

$tokenValue = ConvertTo-SecureString "Bearer $($token.AccessToken)" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($upn, $tokenValue)

$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://ps.outlook.com/powershell-liveid?DelegatedOrg=$($customerId)&BasicAuthToOAuthConversion=true" -Credential $credential -Authentication Basic -AllowRedirection

Import-PSSession $session

Note the tenant parameter is expecting the tenant identifier (or onmicrosoft.com) for your partner tenant. Finally, I wanted to mention you will need to use the UseDeviceAuthentication parameter when generating the initial refresh token because the application you need to use is a native application that is correctly configured for use with Exchange Online PowerShell. Since it is a native application a public a flow like the device code flow must be used.

[Shadoxity]

That is the error I posted above, when trying to generate that, it just gives an error.

$token = New-PartnerAccessToken -ApplicationId 'a0c73c16-a7e3-4564-9a95-2bdf47383716' -Scopes 'https://outlook.office365.com/.default' -Tenant '' -UseDeviceAuthentication

New-PartnerAccessToken : Object reference not set to an instance of an object.
At line:1 char:10

• $token = New-PartnerAccessToken -ApplicationId 'a0c73c16-a7e3-4564-9a ...

•      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [New-PartnerAccessToken], NullReferenceException
  • FullyQualifiedErrorId : System.NullReferenceException,Microsoft.Store.PartnerCenter.PowerShell.Commands.NewPartnerAccessToken

@Shadoxity you might be encountering an error that was corrected a while back. Can you run the following, close PowerShell, and then try again?

Update-Module PartnerCenter

[Shadoxity]

Of course! Sorry I was on 2.0.1911.2 still.

The command is running now, however it has been running for 3 mins now and has not completed and has not popped up with anything?

@Shadoxity when you run the command it writes some instructions to the console. You will need to browse to https://microsoft.com/devicelogin and then enter the code shared on the console. Once you successfully authenticate everything will return.

[Shadoxity]

It does not output anything in the console.

@Shadoxity can you share the output from the following?

$PSVersionTable

[Shadoxity]

PS C:\Users\leon> $PSVersionTable

Name Value

---

PSVersion 5.1.18362.145
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.18362.145
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1