Connect-ExchangeOnline Certificate Based Authentication with Exchange.ManageAsAppv2

Question

The error from -verbose output

VERBOSE: Returning precomputed version info: 3.9.2

VERBOSE: ModuleVersion: 3.9.2

VERBOSE: [ThreadID: #] Trying to get a new token from AAD

VERBOSE: [ThreadID: #] Trying to acquire token based on UI flow

VERBOSE: [ThreadID: #] Successfully acquired new token for Cert based flow.

VERBOSE: [ThreadID: #] Successfully got a token from AAD

VERBOSE: Failed to fetch banner content from server. Reason: Object reference not set to an instance of an object.

VERBOSE: ConnectionContext Removed

ParentContainsErrorRecordException: Module could not be correctly formed. Please run Connect-ExchangeOnline again.

This works with the non v2 API permission Exchange.ManageAsApp the error above is with v2. My understanding is v2 is supposed to be more secure and that we should not use the older version. I am using Certificate Based Authentication.

Am I doing something wrong? Am I misunderstanding the purpose of v2?

Answer 1

Hi Varga, Joseph

Based on my research and understanding that you are not doing anything wrong with your script or your certificate setup. The issue simply comes down to a very common misunderstanding around Microsoft's "v2" terminology.

When Microsoft advises using "V2" or newer versions for better security, I am referring to the ExchangeOnlineManagement PowerShell Module itself (which you are correctly using, version 3.9.2). Modern versions of the module are highly secure and operate entirely on modern REST APIs.

However, the specific API Application Permission required in Microsoft Entra ID (formerly Azure AD) to authorize this

If you look closely at your verbose logs, you will see this line: VERBOSE: [ThreadID: #] Successfully got a token from AAD - it means your Certificate-Based Authentication worked flawlessly. Entra ID validated your certificate and handed your script an access token.

However, the next step does not work: ParentContainsErrorRecordException: Module could not be correctly formed. When the Exchange Online server receives your token, it checks your permissions. Because your token contains Exchange.ManageAsAppv2 instead of the exact Exchange.ManageAsApp string it requires, the server refused the connection. Consequently, the PowerShell module was unable to build the cmdlets locally and terminated unexpectedly.

Please update your Entra ID App Registration permissions:

• Navigate to your App Registration in the Microsoft Entra admin center.
• Go to Permission classifications and remove Exchange.ManageAsAppv2.
• Click Add a permission > APIs my organization uses > search for Office 365 Exchange Online > Select Application permissions and check the box for Exchange.ManageAsApp.
• Click Grant admin consent for [Your Organization] and wait 5-10 minutes for the new token claims to replicate across Microsoft's backend and run your script again.

Security Reassurance & Documentation

Please be assured that you are not sacrificing any security by using Exchange.ManageAsApp. By utilizing Certificate-Based Authentication alongside a modern version of the ExchangeOnlineManagement module, you are strictly following Microsoft's current security best practices for unattended App-Only authentication.

For your reference, here is the official Microsoft documentation detailing the exact API permissions required for this setup:

App-only authentication in Exchange Online PowerShell and Security & Compliance PowerShell | Microsoft Learn

I hope this information helps.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The error output shows that certificate-based authentication to Microsoft Entra ID succeeds and a token is acquired, but the Exchange Online module fails when establishing the session and loading the banner, then tears down the ConnectionContext:

• Token acquisition for cert-based flow is successful.
• The failure occurs afterward: Failed to fetch banner content from server. Reason: Object reference not set to an instance of an object.
• The module then reports: Module could not be correctly formed. Please run Connect-ExchangeOnline again.

From the provided context, the only supported and documented guidance for app-only (certificate-based) authentication with Exchange Online is:

• Use the Exchange Online PowerShell module v2.0.3 or later.
• Configure app-only authentication with the Exchange.ManageAsApp application permission.
• Assign the necessary Microsoft Entra roles or Exchange role groups to the application.
• Connect using Connect-ExchangeOnline with certificate parameters (for example, -CertificateFilePath/-CertificatePassword/-AppId/-Organization).

The context does not document a separate “Exchange.ManageAsApp v2” permission or any behavioral difference or additional configuration steps for such a v2 permission. It only describes Exchange.ManageAsApp as the required application permission for app-only authentication and shows that the module uses that permission to request an app-only token and then configure RBAC based on the directory role information in the token.

Given that:

• The token is successfully acquired for the cert-based flow.
• The failure happens later when the module is forming the session and fetching banner content.
• The documentation only recognizes Exchange.ManageAsApp (no v2 variant) as the supported permission for this scenario.

The issue indicated by the verbose output is not explained or addressed in the provided documentation, and there is no documented distinction or migration guidance between an “Exchange.ManageAsApp” and “Exchange.ManageAsApp v2” permission in this context. The context therefore does not support a definitive explanation of the error or a documented remediation specific to “v2,” nor does it describe any requirement to move to a different permission for security reasons beyond using Exchange.ManageAsApp with app-only authentication.

---

References:

• App-only authentication (Exchange Online PowerShell) - Microsoft Engage Center (Services Hub)
• App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell
• About the Exchange Online PowerShell module