ExchangeOnline App-Only Access
Review the API-permission and Entra-role assignments recorded for Exchange Online app-only PowerShell access. The app needs both kinds of assignment.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
For an Exchange App to connect to via powershell you need to set the correct API permissions and assign an Exchange role to the App.
Exchange Online requires the Application to
- Have access to the correct Exchange API's. Minimum of
- Exchange.ManageByApp.
You may also need
- MailboxSettings.Read
- User.ReadBasic.All
The above permissions will limit the permissions available to the App via the Exchange Entra Role in Step 2 below.
Screenshot retained for review
- Have an overarching Exchange Entra Role assigned to the App. Read more about it here: App-only authentication in Exchange Online PowerShell and Security & Compliance PowerShell | Microsoft Learn
Goto: All roles - Microsoft Azure (https://portal.azure.com/#view/Microsoft_AAD_IAM/AllRolesBlade)
Search For: "Exchange Recipient Administrator" Note: Depending on the requirement of your app you may need a different Exchange Role.
Assign your App to the Role
- Click Add assignment
- Search for and select your App. You can find it by name or Application Id.
Screenshot retained for review