Assigning Permissions to application using App Registration

Question

Hi,

We're in the process of moving all accounts to use modern auth, but sometimes face challenges by Vendor. One of the vendor is suggesting to use Exchange Administrator role for assigning permissions in app registration which is excessive permission.

The actions/commands that they actually use are:
• Get-User
• Get-DistributionGroup
• Get-DistributionGroupMember
• New-DistributionGroup
• Add-DistributionGroupMember

Currently they are using basic authentication in Exchange Online using RBAC roles. You can define granular level of permission in RBAC but not sure how to achieve same in Azure app registration method.

Goal is to give minimum required permissions to their application instead of giving exchange admin rights.

Answer 1

Hi @Hasan Siddiqui · Thank you for reaching out.

I agree that exchange admin rights are too excessive to run only the below mentioned cmdlets as these actions can be performed by Groups Administrator as well.

• Get-User
• Get-DistributionGroup
• Get-DistributionGroupMember
• New-DistributionGroup
• Add-DistributionGroupMember

From your question, I understood that you want to run below commands under application context. For this purpose, you can navigate to:

Azure Active Directory > Roles and Administrators > Groups Administrator > +Add Assignments > Click on Select Members link and add the application you want to grant groups administrator rights to.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.