Azure Automation Connect-ExchangeOnline using Managed Identity

Question

Azure Automation Connect-ExchangeOnline using Managed Identity

Jesus Chao 161

I have been trying to get Connect-ExchangeOnline cmdlet to work in Azure Automation using the System Managed Identity. Does anyone have any idea if this works? I would rather use the Managed ID to connect to Exchange Online instead of using certificates or a saved credential. I do have this bit of code working but I am afraid it is using Basic Auth which is going away soon. Using this code does not give me access to ExchangeOnline specific cmdlets like Get-EXOMailbox.
Connect-ExchangeOnline Reference
https://o365reports.com/2020/07/04/modern-auth-and-unattended-scripts-in-exchange-online-powershell-v2/

"Connect Exchange"
function makeMSIOAuthCred () {
    $accessToken = Get-AzAccessToken -ResourceUrl "https://outlook.office365.com/"
    $authorization = "Bearer {0}" -f $accessToken.Token
    $Password = ConvertTo-SecureString -AsPlainText $authorization -Force
    $username = "OAuthUser@" + ((Get-AzTenant).Id)
    $MSIcred = New-Object System.Management.Automation.PSCredential -ArgumentList ($username,$Password)
    return $MSICred
}
$cred = makeMSIOAuthCred

#This works using PSSESSION
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/PowerShell-LiveId?BasicAuthToOAuthConversion=true -Credential $cred -Authentication Basic -AllowRedirection -Verbose
Import-PSSession $Session

#using Connect-ExchangeOnline
Connect-ExchangeOnline -Credential $cred

The error returned when using Connect-ExchangeOnline is:
Authentication Failure. The password entered exceeds the maximum length. Please reach out to your admin to reset the password.

Answer accepted by question author

4 additional answers

Your answer

Answer 1

Andy David - MVP 159.9K MVP Volunteer Moderator

Ok, heard back from the product group. At this time, Exo V2 Module does not support managed identities. So, this won't work for you, sorry.

Anonymous

2022-02-03T14:51:45.477+00:00

I just upvoted this because you took the time to follow up, but I want to also downvote somebody because I just wasted I dont know how many hours trying to get this to work!!! Can they at least update the docs?
Emily Pettitt 1 Reputation point

2022-07-20T15:24:30.83+00:00

Hi, does anyone know if there is any update on Exchange Online V2 PowerShell to support Managed Identities for Azure Automation? I'd really like to set up Azure Automation to automate some of my mailbox processes but have run into this blocker considering Microsoft is strongly recommending Managed Identities over Run As accounts in Azure Automation.
PatrickMangold-2508 6 Reputation points

2022-07-28T07:52:29.143+00:00
I know it's highly unsupported, but we managed to get it working:

Create an Azure Logic App (any other service capable of using managed identity and performing a REST call works)

Enable Managed Identity

Perform an admin consent for the scope "Exchange.ManageAsApp" exposed by "Office 365 Exchange Online" appId "00000002-0000-0ff1-ce00-000000000000"

Assign the Azure AD directory role "Exchange Administrator" to the managed identity - not ideal but there seems to be no option to use a lesser privileged role

Execute step 6 or 7

Not fully migrated commands: In the logic app perform a http POST call to "https://outlook.office365.com/adminapi/beta/<tenantid>/InvokeCommand" -replace <tenantid> with your actual tenant id
under Authentication, select "AuthenticationType=ManagedIdentity, ManagedIdentity=SystemAssigned, Audience=https://outlook.office365.com"
body:
{
"CmdletInput": {
"CmdletName": "Get-ApplicationAccessPolicy"
}
}

Migrated commands: In the logic app perform a http GET call to "https://outlook.office.com/adminApi/beta/<tenantid>/Mailbox('user@xyz .com')"
same authentication settings, empty body

Credits to Vasil for the inspiration:
https://www.michev.info/Blog/Post/2869/abusing-the-rest-api-endpoints-behind-the-new-exo-cmdlets

Hope it is useful for others
Jesus Chao 161 Reputation points

2022-07-28T15:20:53.127+00:00

Thanks but what are the parameter values that you are using in Azure Automation to get connect-exchangeonline to work with the managed ID?
PatrickMangold-2508 6 Reputation points

2022-07-29T05:41:34.98+00:00

None. The commands above completely bypass connect-exchangeonline.
The managed identity just gets a token for the Exchange REST endpoint from Azure AD behind the actual commands that you normally use use AFTER connecting and calls the REST endpoint with the token. It is able to get a token because of the consent grant Exchange.ManageAsApp that we did for the managed identity and gets the permissions from the Exchange admin role membership.
It's similar to how you would use the MS Graph API.

How did I find the Exchange REST endpoint behind the cmdlets?
Enable "verbose and debug" mode in a PowerShell session after connecting with "connect-exchangeonline" and execute your desired command.
Then study the output carefully and also have a look at the psm modules that get downloaded in the background (those include the commands that become available after connecting).
There you find that the commands are actually just a sort of wrapper that calls the REST endpoint mentioned above.
PatrickMangold-2508 6 Reputation points

2022-07-29T05:43:03.457+00:00

Check out this screenshot for clarification.
PatrickMangold-2508 6 Reputation points

2022-07-29T05:45:07.28+00:00

Or for already migrated commands (step 7 in original reply)
]1

Answer 2

It appears that EXO V2 Module 2.0.6 preview 7 has support for managed identities now. To connect, make sure you are running the latest preview module and that the session is running in the context of the managed identity (Azure Automation Runbook)

connect-exchangeonline -managedidentity -Organization "<Name of your org>"

Our organization formation was <domainname>.onmicrosoft.com

Andy can you confirm that this has been added.

ALSO note that it appears that the connect-ippssession cmdlet does NOT support managed identities which I find rather odd. The cmdlet has not been updated to pass the parameters to the connect-exchangonline cmdlet within the module. It would be nice to know how to use connect-ippssession for connecting to the Security and Compliance console with two different auth types? I can only assume that if you use connect-ippssesion after connecting to EXO with a managed identity, it will override that connection with whatever auth type you use for connect-ippssession?

Thanks

halbot 1 Reputation point

2022-09-09T11:20:09.173+00:00

Yes it in the release notes:

v2.0.6-Preview7 :
1. Support for system-assigned and user-assigned Managed Identity from Azure VMs and Virtual Machine Scale Sets.
- The -ManagedIdentity switch parameter, and the -Organization parameters need to be provided to indicate that a managed identity should be used. This will by default attempt to use a system-assigned managed identity.
- For specifying a user-assigned managed identity, in addition to the parameters specified above, the AppID of the service principal corresponding to the user-assigned identity needs to be passed to the -ManagedIdentityAccountId.

Answer 3

Dmitry B 1

It is now officially supported in v3.0
https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps

Answer 4

Jesus Chao 161

Great - Thanks Andy. I am sure this will help the community. Any chance you know if they are working on adding this in the future and if there is a time table? I believe Basic Auth will be gone later this year and Microsoft is heavily recommending the use of managed identities in Azure Automation.

Thanks again.

Andy David - MVP 159.9K Reputation points MVP Volunteer Moderator

2022-01-11T13:37:16.803+00:00

I believe they are working on it, yes. I was told its not supported yet :)

Answer 5

Andy David - MVP 159.9K MVP Volunteer Moderator

Have you seen this?
https://github.com/mardahl/ExchangeOnlineScripts/blob/main/AzureAutomation/ConnectEXOwithMSIRunbookExample.ps1

Full Disclosure: I have not tested this myself.

Jesus Chao 161 Reputation points

2022-01-10T21:48:12.737+00:00

Thanks David - yes I have. In fact I am using a bit of the code within this PS1 (the function in my post) to make the token and then connect using PSSession. That seems to work great but if you notice - and I could be wrong about this - it is using Basic Auth and it does not allow you to use the Exchange Online powershell commands like Get-EXOMailbox.
Andy David - MVP 159.9K Reputation points MVP Volunteer Moderator

2022-01-10T21:50:13.917+00:00

yea, it might be worth pinging the author of that. Perhaps he has something that uses Modern Auth
Jesus Chao 161 Reputation points

2022-01-10T21:53:54.64+00:00

Perhaps. I was hopeful that I could get an official answer through this forum as to whether or not Connect-ExchangeOnline will ever support Managed Identities for authentication. Connect-AzureAD is working.
Andy David - MVP 159.9K Reputation points MVP Volunteer Moderator

2022-01-10T22:23:48.497+00:00

I honestly do not know. Let me see if I can find out.

Share via

Azure Automation Connect-ExchangeOnline using Managed Identity

4 additional answers

Your answer