The usage of Set-Mailbox cmdlet for Exchange Online via new preview module and certificate

Nikita Krivets 491

Hello,

I have some troubles with getting Set-Mailbox cmdlet to work via new certificate workflow (application + app permissions + roles + certificate + new exchange online preview module).
https://www.powershellgallery.com/packages/ExchangeOnlineManagement/2.0.3-Preview

Is it even possible in this version? If so, what the requirements are?

Thanks in advance!

Accepted answer

Andy David 701 Reputation points

2020-07-21T14:06:18.407+00:00

and you can see that switch if you logon interactively with PS as an Exchange Admin ?
Please sign in to rate this answer.

1 person found this answer helpful.
Nikita Krivets 491 Reputation points

2020-07-22T08:28:43.62+00:00

@AndyDavidMVP Well, thanks to you I was able to get the difference between my tenants. The difference lies in Role Groups. My "old tenant" Organization Management role group had fewer management roles assigned than its twin in the other tenant. Corrected that, and voila!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

5 additional answers

Andy David 701 Reputation points

2020-07-20T12:43:35.867+00:00

The only only API Permissions you should see are:

The "Roles and Adminstrators" menu you have in that last image arent the roles assigned to the app, its the roles that can manage it, so the Exchange Admin wouldnt be listed there by default.
Please sign in to rate this answer.

1 person found this answer helpful.
Nikita Krivets 491 Reputation points

2020-07-21T08:03:21.173+00:00

@AndyDavidMVP Wow! I repeated the needed steps on my clean tenant and somehow it really worked out. Then, I repeated the steps again for the previous one and, unfortunately, there was no success. Perhaps you have any ideas? Anyway, thank you very much for your help!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Manu Philip 18,681 Reputation points MVP

2020-07-16T09:22:13.513+00:00
Hello,
The high level steps involved are as follows

Fresh install of the ExO PowerShell module v2 using the prerelease

Update

generate a self signed certificate using the script available at Create-SelfSignedCertificate.ps1 and record the thumbprint

Connect to your Azure portal and and register a new application

Assign permissions to the newly created application

Capture the Application (client) ID of the registered application

Grant the admin consent to the application

Upload the self-signed certificate you have generate in portal

Grant one of the administration roles needed to run set-mailbox permission from the Azure AD\Roles and administrators

You are now ready to include the new modern authentication in your script. Install the self-signed certificate in the Computer\Personal certificate store.

Connect via: Connect-ExchangeOnline -CertificateThumbPrint “<certificate thumbprint>” -AppID “<Azure AD application ID>” -Organization “<your Office 365 tenant – mytenant.onmicrosoft.com”

Try your commands

Let me know if you are facing any challenges in any of the above steps

Please mark as "Accept the answer" if the answer helps you. Your suggestion will help others also !

Regards,
Manu
Please sign in to rate this answer.
Nikita Krivets 491 Reputation points

2020-07-16T15:06:11.867+00:00

@Manu Philip I have already done that (all available app permissions and supported roles). The other cmdlets work just fine except for Set-mailbox cmdlet. Any thoughts?

Manu Philip 18,681 Reputation points MVP

2020-07-16T15:12:20.687+00:00

Please send the error message so that we will get an idea on what's wrong.

Manu Philip 18,681 Reputation points MVP

2020-07-16T15:42:58.283+00:00

Here are the short steps to try out EXO V2 PowerShell cmdlets. You may check these steps and see if you are able to run Set-Mailbox cmdlet
Install-Module -Name ExchangeOnlineManagement -Scope AllUsers -Verbose -Force
Import-Module -Name ExchangeOnlineManagement -Verbose
Get-Module ExchangeOnlineManagement
$creds = Get-Credential
Connect-ExchangeOnline -Credential $creds

Nikita Krivets 491 Reputation points

2020-07-17T16:09:08.04+00:00

@Manu Philip Thanks, now it works. There is another problem though. Set-Mailbox with AuditEnabled parameter doesn't work. I think that is a permission problem.
,
PS C:\Users\administrator> Set-Mailbox azuremailbox -MailTip "asdasd" (Just an example. Works fine.)
PS C:\Users\administrator> Set-Mailbox azuremailbox -AuditEnabled $true A parameter cannot be found that matches parameter name 'AuditEnabled'.

CategoryInfo : InvalidArgument: (:) [Set-Mailbox], ParameterBindingException

FullyQualifiedErrorId : NamedParameterNotFound,Set-Mailbox

PSComputerName : outlook.office365.com

If I use any user account with Audit Logs exchange management role, Set-mailbox myMailbox -AuditEnabled $true ($false) works fine.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Andy David 701 Reputation points

2020-07-16T19:20:32.78+00:00

I haven't seen that. I assume the app has been assigned the Exchange role.
What happens when you use set-mailbox? I just tested and it works fine for me.
Please sign in to rate this answer.
Nikita Krivets 491 Reputation points

2020-07-17T16:06:50.197+00:00

@AndyDavidMVP Thanks for your reply. Yeah, Set-Mailbox now works (I believe I had to wait a bit). But Set-Mailbox with AuditEnabled parameter doesn't work. I think that is a permission problem.

PS C:\Users\administrator> Set-Mailbox azuremailbox -MailTip "asdasd" (Just an example. Works fine.)
PS C:\Users\administrator> Set-Mailbox azuremailbox -AuditEnabled $true A parameter cannot be found that matches parameter name 'AuditEnabled'.

CategoryInfo : InvalidArgument: (:) [Set-Mailbox], ParameterBindingException

FullyQualifiedErrorId : NamedParameterNotFound,Set-Mailbox

PSComputerName : outlook.office365.com

If I use any user account with Audit Logs exchange management role, Set-mailbox myMailbox -AuditEnabled $true ($false) works fine
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Andy David 701 Reputation points

2020-07-18T15:31:19.197+00:00

@Nikita Krivets , What directory role did you give the app in Azure? The Exchange role should allow that. I just double-checked and I have access to that parameter connecting through the Azure app.
Please sign in to rate this answer.
Nikita Krivets 491 Reputation points

2020-07-20T10:27:57.797+00:00

@AndyDavidMVP The assigned role is Exchange Administrator. If you go to the Roles and administrators menu and select Exchange Administrator role, you can see your app in the list. However, if you go to the Roles and administrators menu through you app registration page, the role won't be listed there as an assigned one.
Here is the list of assigned Exchange permissions.

The role:

What I am talking about when I have said the role is not shown as assigned:
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.