UnifiedGroup New, Set, Remove does not work with EXO V2 App-Only App-only certificate authentication

Question

I am unable to use EXO V2 (2.0.3) in "app-only" certificate connection to perform any kind of New, Set, or Remove on Unified Groups (I am only dealing with groups, so I don't know if there are any other issues). There is already a related question https://learn.microsoft.com/en-us/answers/questions/203561/powershell-connect-apponly-to-exo-anyone-able-to-u.html but I have poked around more and have some additional info, and I also desperately need this to work for a project, so I decided to post my own question.

In short, I have a Powershell script that is designed to first collect some data, then it updates various groups, creating, deleting, updating the groups, or adding members or owners to groups. It's completely automated, running hourly, and having a user run it manually and authenticate every time is not acceptable (all users have MFA, so we have to use certificate based). However, running the script manually (with user credentials and completing the MFA interrogation) does work. Running using certificate authentication also works to a point. Certificate Authentication itself works fine, and once authenticated, the script can Get anything, including groups and users. The script is registered in Azure App Registrations and has the "Exchange Service Administrator" role applied (I've also tried the Global/company admin), and access is admin approved. So there is nothing wrong with permissions that I can see. Again, I want to emphasize that I know the script works, as it works manually with normal user credentials.

Anyway, when running "app-only" certificate connection it fails with strange errors on any New-UnifiedGroup, Set-UnifiedGroup, or Remove-UnifiedGroup command.

A typical New-UnifiedGroup command looks like this:

New-UnifiedGroup `  
    -DisplayName $name `  
    -Notes $description `  
    -EmailAddresses $email `  
    -Members $owner `  
    -Owner $owner `  
    -AccessType Private `  
    -RequireSenderAuthenticationEnabled $False -Verbose  

But I get this error:
The group can't be created

• CategoryInfo : NotSpecified: (:) [New-UnifiedGroup], TaskException
• FullyQualifiedErrorId : [Server=BN8PR19MB2657,RequestId=99903585-3899-41b0-a601-6d10d1841324,TimeStamp=12/22/2020 1:25:07 PM] [FailureCategory=Cmdlet-TaskException] A79E6D74,Microsoft.Exchange.Management.RecipientTask
  s.NewUnifiedGroup
• PSComputerName : outlook.office365.com

For Set-UnifiedGroup I get this error:
We failed to update the unified group. Please try again later.

• CategoryInfo : NotSpecified: (:) [Set-UnifiedGroup], TaskException
• FullyQualifiedErrorId : [Server=BN8PR19MB2657,RequestId=1d2f7517-7bb7-43af-b454-2f5bfe41d657,TimeStamp=12/22/2020 1:35:30 PM] [FailureCategory=Cmdlet-TaskException] 760960A4,Microsoft.Exchange.Management.RecipientTask
  s.SetUnifiedGroup
• PSComputerName : outlook.office365.com

For Remove-UnifiedGroup I get this error (strangest error of all):
Unable to remove group GROUP_1.
At C:\Users[my profile]\AppData\Local\Temp\tmp_c4pvjn40.0n1\tmp_c4pvjn40.0n1.psm1:59286 char:9

• $steppablePipeline.End()
• ~~~~~~~~~~~~~~~~~~~~~~~~
• CategoryInfo : NotSpecified: (:) [Remove-UnifiedGroup], TaskException
• FullyQualifiedErrorId : [Server=BN8PR19MB2657,RequestId=1220d0e8-3c5a-4e6e-8c6b-2f41022a63e9,TimeStamp=12/22/2020 1:06:32 PM] [FailureCategory=Cmdlet-TaskException] EF93E9F8,Microsoft.Exchange.Management.RecipientTask
  s.RemoveUnifiedGroup
• PSComputerName : outlook.office365.com

The Remove-UnifiedGroup actually gave me a line in some temp file script, although the others did not. It also halted execution, while the others did not. That temp script is called "Implicit remoting module by Import-PSSession cmdlet". And line 59286 appears to be in a section of code that looks like this:

Begin {  
    try {  
        $positionalArguments = & $script:NewObject collections.arraylist  
        foreach ($parameterName in $PSBoundParameters.BoundPositionally)  
        {  
            $null = $positionalArguments.Add( $PSBoundParameters[$parameterName] )  
            $null = $PSBoundParameters.Remove($parameterName)  
        }  
        $positionalArguments.AddRange($args)  

        $clientSideParameters = Get-PSImplicitRemotingClientSideParameters $PSBoundParameters $True  

        $scriptCmd = { & $script:InvokeCommand `  
                        @clientSideParameters `  
                        -HideComputerName `  
                        -Session (Get-PSImplicitRemotingSession -CommandName 'Remove-UnifiedGroup') `  
                        -Arg ('Remove-UnifiedGroup', $PSBoundParameters, $positionalArguments) `  
                        -Script { param($name, $boundParams, $unboundParams) & $name @boundParams @unboundParams } `  
                     }  

        $steppablePipeline = $scriptCmd.GetSteppablePipeline($myInvocation.CommandOrigin)  
        $steppablePipeline.Begin($myInvocation.ExpectingInput, $ExecutionContext)  
    } catch {  
        throw  
    }  
}  
Process {   
try {  
    $steppablePipeline.Process($_)  
} catch {  
    throw  
}  
}  
End {   
try {  
    $steppablePipeline.End()  
} catch {  
    throw  
}  
}  

(That's not my code, but the code from the temp script). The error is thrown from the last try-catch-throw (that's line 59286), on $steppablePipeline.End().

Finally, I should note that the on other question I have referenced (https://learn.microsoft.com/en-us/answers/questions/203561/powershell-connect-apponly-to-exo-anyone-able-to-u.html ) two different people mentioned that there is an internal incident or ticket that might be open about this issue. However, no further details were provided. It is urgent that I get New-UnifiedGroup, Set-UnifiedGroup, and Remove-UnifiedGroup working for this script via app-only certificate based authentication, as it is our client's only avenue to do so, since all users in their Azure/Office365 are required to be MFA.

If this is a Microsoft problem, I need to show our client some evidence of this, and I also need to provide them with information about when the problem might get fixed. If I am, in fact, just doing something wrong, any assistance would be appreciated.

Answer 1

It's a known issue, the PG Is working on resolving it. Nothing you can do about it apart from waiting. Or stick to using the old connectivity method for the time being. Alternatively you can use the Graph API endpoints for some of the Group operations.

Answer 2

Any update on this? The last status is 10 months ago.

Answer 3

I think you would need to open a ticket if you want to have some sort of paper trail for your client.

Answer 4

As far as I can tell, this is still not working with the latest/current version of the module. Silence from Microsoft is concerning. This is the only function left which is keeping us from switching our Exchange automation processes entirely to certificate authentication.

Answer 5

any update on this? anyone able to find a workaround if the solution still doesn't exist?