Assign Exchange Online Retention Policies via Azure Automation Runbook

Question

Hi Team,

We are developing an automation solution to assign Exchange Online Retention Policies to users automatically based on their Department.

Environment

• Microsoft 365 / Exchange Online
• Microsoft Purview
• Azure Automation Runbook
• Managed Identity Authentication
• Azure Storage Account (JSON configuration file)

Specifically, the Connect-IPPSSession command is working from a local machine but is not working from Azure Automation.

Issue

The solution works successfully when executed from a local PowerShell environment using Exchange Online PowerShell. However, we are facing issues when running the same process from Azure Automation Runbooks.

Specifically, the connection to Security & Compliance PowerShell using:

PowerShell :- Connect-IPPSSession is not working in Azure Automation.

Troubleshooting Performed

• Verified the Azure Automation Account Managed Identity configuration.
• Tested using PowerShell Runtime:
  • PowerShell 5.1
    • PowerShell 7.2
      • PowerShell 7.4
      • Updated Exchange Online Management module to the latest available version.
      • Tested the same commands from a local PowerShell session, where the connection works successfully.
      • The issue occurs only within Azure Automation Runbooks.

Questions

1. Is Connect-IPPSSession supported in Azure Automation Runbooks?
2. Does Connect-IPPSSession support Managed Identity authentication?
3. Are there any additional permissions or roles required for Security & Compliance PowerShell?
4. Is there a Microsoft-recommended alternative for assigning Exchange Online Retention Policies through automation?
5. Are there any known limitations when using Azure Automation Runbooks with Compliance Center PowerShell?

Any guidance on the supported configuration or alternative approach would be greatly appreciated.

Answer 1

Hi @Krunal E. More , Hope you are doing well.

Thank you for your question.

Based on current supportability, the behavior you are seeing is expected.

• Connect-IPPSSession does not currently support Managed Identity authentication.
• Azure Automation Runbooks using a Managed Identity cannot establish a connection to the Security & Compliance (Purview) PowerShell endpoint through Connect-IPPSSession.
• For non-interactive automation scenarios, Microsoft recommends using Certificate-Based Authentication (App-Only Authentication) instead of Managed Identity.

However, there is an important limitation:

• While Certificate-Based Authentication can be used for many Exchange Online PowerShell operations, Purview retention policy management is currently not fully supported through app-only/non-interactive authentication and typically requires an interactive administrative session.

For your specific questions:

Is Connect-IPPSSession supported in Azure Automation Runbooks?
Yes, but not with Managed Identity authentication.

Does Connect-IPPSSession support Managed Identity authentication?
No. Managed Identity is not currently supported for the Compliance PowerShell endpoint.

Are there additional permissions or roles required?
Appropriate Purview/Compliance roles are required, but permissions alone will not enable Managed Identity support.

Is there a Microsoft-recommended alternative?
For unattended Exchange Online PowerShell operations, use Certificate-Based Authentication (CBA). If you are managing classic Exchange Online MRM retention policies, you may be able to perform the assignment through Exchange Online PowerShell without using the Compliance endpoint.

Are there known limitations with Azure Automation and Compliance PowerShell?
Yes. The primary limitation is the lack of Managed Identity support and the requirement for interactive authentication for certain Purview retention policy operations.

Reference: Microsoft App-Only Authentication for Exchange Online PowerShell: https://learn.microsoft.com/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps

The key design consideration is whether you are assigning classic Exchange Online (MRM) retention policies or Microsoft Purview retention policies. That distinction determines whether the Compliance endpoint is required and whether automation is currently feasible in a fully unattended manner.

Best Regards,
Microsoft Support Team.

Answer 2

No, the compliance endpoint does not yet support managed identities, you have to use CBA for non-interactive scenarios instead: https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps

That won't help either for working with Purview retention policies though, as they are currently only supported via interactive flow.

That said, the compliance endpoint is only needed if you are working with Purview retention policies, not the Exchange Online ("classic") ones.