Can't connect to ExchangeOnline using system-assigned managed identity (move from Run As account)

Question

Hello,

We are trying to move from previously working Run As account runbooks to system-assigned identity but we are facing an issue to connect to ExchangeOnline, as describe in the documentation.

Let's keep our runbook super simple :

Connect-ExchangeOnline -ManagedIdentity -Organization "MyCompany.onmicrosoft.com"

Where "My company" has been changed.
The result of run is as follow :

The role assigned to application xxxxxxx-56c4-4866-921d-0916b98b8976 isn't supported in this scenario. Please check online documentation for assigning correct Directory Roles to Azure AD Application for EXO App-Only Authentication.

We have been setting the right permission on the App registration using powershell command :

We added Microsoft Graph API permission for an other runbook in the same automation account. This works fine, we are able to retrieve Application from our runbooks, so we are sure that our runbooks are using the right system account.

On top of these permission we also assigned the Exchange Administrator Role in the Azure AD Role, we even tried to add the global admin role to this application, but still the same issue.

Run as Account will stop working in September but the managed identity way of doing this is definetly not fully developed yet...

Any help would be appreciated here.

Answer 1

Hi @thomas masquelier ,

Thanks for posting your ask on Microsoft Q&A!!

am not able to reproduce this issue when connecting to Exchange Online using Azure Automation account. I have followed the steps mentioned in the documentation over here for using Managed Identity. However, I have given one additional permission of "Global Reader" (other than an Exchange Administrator) to the Managed Identity of the Automation account.

I have not given any more Graph permissions than the required one - Exchange.ManageAsApp.

Here is the code which I have tested through the Automation account -

Connect-ExchangeOnline -ManagedIdentity -Organization <organization>.onmicrosoft.com
Get-AcceptedDomain | Format-Table Name

Here is the output for your reference-

Can you please try providing the Global Reader permission to the application?

Additionally, if this doesn't work, then please try to remove any additional permissions like Microsoft Graph permissions.

Please let me know how it goes. Thanks.

Answer 2

This is indeed solved, I don't know what was happening exactly.

Also I had to follow these steps to be able to connect to exchange online :
https://technut.se/update-modulemanifest-is-not-recognized-as-the-name-of-a-cmdlet-error-in-azure-automation/

By searching for the cmdlet in the module gallery within Azure Automation I found that the cmdlet is a part of the module PowerShellGet that I did not have installed. This module has a dependency to the module PackageManagement.

I can safely remove the Global reader as this is not necessary