HTTP 401 on Exchange Online cmdlets when running in app-only mode

Nancy Admin 26

Receiving a 401 error on some EXO cmdlets when running in app-only mode.
The app that was authorized into the tenant consented to the Exchange.ManageAsApp scope. Are there additional scopes that are required?

Install-Module -Name ExchangeOnlineManagement -RequiredVersion 2.0.4 -Force
Connect-ExchangeOnline -CertificateFilePath '<path_to_cert>' -CertificatePassword (ConvertTo-SecureString -String '<password>' -AsPlainText -Force) -AppID <app_id> -Organization 'tenant.onmicrosoft.com'

Get-EXOMailbox -ResultSize unlimited
Get-EXOMailbox: Error while querying REST service. HttpStatusCode=401 ErrorMessage={"error":{"code":"Unauthorized","message":"User is not allowed to call Get-Mailbox","innererror":{"message":"User is not allowed to call Get-Mailbox","type":"Microsoft.Exchange.Admin.OData.Core.ODataServiceException"}}}

Get-Mailbox -ResultSize Unlimited
Get-Mailbox: The term 'Get-Mailbox' is not recognized as a name of a cmdlet, function, script file, or executable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

2 answers

Andy David - MVP 140.8K Reputation points MVP

2021-06-21T20:27:07.063+00:00

Hi there,
You need to add the service principal you created to an Azure Role.
In this case, Exchange Administrator

The application needs to have the appropriate RBAC roles assigned. Because the apps are provisioned in Azure AD, you can use any of the built-in roles. The following roles are supported:

Global administrator
Compliance administrator
Security reader
Security administrator
Helpdesk administrator
Exchange administrator
Global Reader

https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#set-up-app-only-authentication
Please sign in to rate this answer.
Nancy Admin 26 Reputation points

2021-06-21T20:37:58.657+00:00

I've followed all of the steps from the documentation, including assigning the service principal to the Exchange Admin role. What's weird is that it works with some tenants but errors on some others.
Sign in to comment
Vasil Michev 94,521 Reputation points MVP

2021-06-21T20:30:21.107+00:00

You need to add the service principal to an admin role in Azure AD, such as the Global admin one. The Exchange.ManageAsApp permissions on their own don't give you admin permissions. Here's a short guide: https://office365itpros.com/2020/08/13/exo-certificate-based-authentication-powershell/
Please sign in to rate this answer.
Nancy Admin 26 Reputation points

2021-06-21T20:38:05.15+00:00

I've followed all of the steps from the documentation, including assigning the service principal to the Exchange Admin role. What's weird is that it works with some tenants but errors on some others.

Vasil Michev 94,521 Reputation points MVP

2021-06-22T06:00:18.98+00:00

Um, each tenant will need to add your SP to the corresponding admin role, in case you are using a multi-tenant app. That's in addition to consenting. Here's short article I wrote on the topic a while back: https://www.michev.info/Blog/Post/3047/multi-tenant-scenarios-for-exo-powershell-certificate-based-authentication

Nancy Admin 26 Reputation points

2021-06-22T20:45:12.093+00:00

Thanks for your response @Vasil Michev ! I should have clarified that earlier - the tenant in question has added the SP to the Exchange Admin role on their tenant. But we're only seeing the 401 on certain EXO cmdlets for this tenant.

Vasil Michev 94,521 Reputation points MVP

2021-06-23T08:01:41.803+00:00

If it's only for certain cmdlets, you probably need to update the admin role. Also note that when running in app context, some cmdlets are known to fail - such as the Unified Group cmdlets or anything that changes data directly in Azure AD.

Nancy Admin 26 Reputation points

2021-06-23T17:28:22.607+00:00

This appears to have been because the role that was assigned to the Service Principal was Security Administrator, which is a supported role per the official documentation https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-5-assign-azure-ad-roles-to-the-application but errors with the following cmdlets:
Get-RemoteDomain, Get-Mailbox, Get-OrganizationConfig, Get-OwaMailboxPolicy, Get-AdminAuditLogConfig, Get-SharingPolicy

.

Andy David - MVP 140.8K Reputation points MVP

2021-06-23T17:30:48.85+00:00

Yea, that wont work with those commands :)

Nancy Admin 26 Reputation points

2021-06-23T17:47:05.64+00:00

Ahh :( @Andy David - MVP is there a way to map commands to roles so I can figure out the appropriate role to require that covers the cmdlets I need to run?

Andy David - MVP 140.8K Reputation points MVP

2021-06-23T18:02:58.02+00:00

You can view the role details and perms it has in the official documentation:

https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

But there really isnt a single place to map the commands to the role
If you need to run Exchange type commands, then you would need to add the Exch Admin role of course :)

Kael Yao-MSFT 37,491 Reputation points Microsoft Vendor

2021-06-29T03:50:25.543+00:00

Hi @Nancy Admin

Glad to hear the question was answered!

Please feel free to mark the helpful replies as the answer to the question.
It may highlight the answer and be helpful to other community members.
Thanks for your understanding!

About how to accept an answer, please refer to this link: Accepted answers
Sign in to comment