You will need:<\/strong><\/p>\n\n\n\n You are free to use and modify this script as you wish as long as you respect the Disclaimer in the script synopsis. <\/p>\n\n\n\n <#<\/p>\n\n\n\n .SYNOPSIS<\/p>\n\n\n\n Creates an Azure Automation account as managed identity and grants permissions in Exchange Online<\/p>\n\n\n\n .DESCRIPTION<\/p>\n\n\n\n This script created an Azure Automation account.<\/p>\n\n\n\n Configures the account as a SystemManagedIdentity<\/p>\n\n\n\n Connects to Entra ID<\/p>\n\n\n\n Grants the automation account access to connect to Exchange Online as Exchange administrator.<\/p>\n\n\n\n .NOTES<\/p>\n\n\n\n Author: Per-Torben S\u00f8rensen<\/p>\n\n\n\n Date: 2024-10-09<\/p>\n\n\n\n Version: 2410.09<\/p>\n\n\n\n Requires: Microsoft.Graph.Beta and az module<\/p>\n\n\n\n Tested with: PowerShell 7.4.5<\/p>\n\n\n\n .DISCLAIMER<\/p>\n\n\n\n THIS CODE IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND. ALL USEAGE IS AT YOUR OWN RISK.<\/p>\n\n\n\n The entire risk arising out of the use or performance of this script remains with you.<\/p>\n\n\n\n In no event shall the author be held liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information,<\/p>\n\n\n\n or other pecuniary loss) arising out of the use of or inability to use this script, even if the author has been advised of the possibility of such damages.<\/p>\n\n\n\n The use of this script carries no support from the author, unless otherwise specified. By using this script, you agree to these terms.<\/p>\n\n\n\n #><\/p>\n\n\n\n # Install modules in CurrentUser scope<\/p>\n\n\n\n Install-Module az -scope CurrentUser<\/p>\n\n\n\n Install-Module Microsoft.Graph.Beta -Scope CurrentUser<\/p>\n\n\n\n $rgname<\/strong> = ‘ResourceGroupAutomation’ # Name of resource group to create<\/p>\n\n\n\n $location<\/strong> = ‘norwayeast’ # Location to store the RG and automation account. Use “Get-AzLocation | Select-Object DisplayName, Location” if you need a list of locations<\/p>\n\n\n\n $accountName<\/strong> = ‘EXOaccount’ # Name of your automation account<\/p>\n\n\n\n $ModuleName<\/strong> = ‘ExchangeOnlineManagement’<\/p>\n\n\n\n $ModuleVersion<\/strong> = ‘3.5.0’<\/p>\n\n\n\n $tenantid<\/strong> = ‘11111111-1aaa-1111-1a1a-aa11aaa11a1a’ # Tenant ID for your Exchange Online environment<\/p>\n\n\n\n # Connect to Azure<\/p>\n\n\n\n Connect-AzAccount -AuthScope MicrosoftGraphEndpointResourceId<\/p>\n\n\n\n # Create Resource Group<\/p>\n\n\n\n New-AzResourceGroup -Name $rgname<\/strong> -Location $location<\/strong><\/p>\n\n\n\n # Create Automation Account<\/p>\n\n\n\n New-AzAutomationAccount -Name $accountName<\/strong> -ResourceGroupName $rgname<\/strong> -Location $location<\/strong><\/p>\n\n\n\n # Import ExchangeOnlineManagement module<\/p>\n\n\n\n New-AzAutomationModule -AutomationAccountName $accountName<\/strong> -ResourceGroupName $rgname<\/strong> -Name $ModuleName<\/strong> -ContentLinkUri “https:\/\/www.powershellgallery.com\/api\/v2\/package\/$ModuleName<\/strong>\/$ModuleVersion<\/strong>“<\/p>\n\n\n\n # Set up managed identity<\/p>\n\n\n\n Set-AzAutomationAccount -Name $accountName<\/strong> -ResourceGroupName $rgname<\/strong> -AssignSystemIdentity<\/p>\n\n\n\n $accountSPN<\/strong> = Get-AzADServicePrincipal -DisplayName $accountName<\/strong><\/p>\n\n\n\n # Connect to Microsoft Graph<\/p>\n\n\n\n Connect-MgGraph -TenantId $tenantid<\/strong> -Scopes “Application.ReadWrite.All”,”Directory.ReadWrite.All”,”RoleManagementPolicy.ReadWrite.AzureADGroup”<\/p>\n\n\n\n # Assign ManageAsApp permission<\/p>\n\n\n\n $AppRoleId<\/strong> = “dc50a0fb-09a3-484d-be87-e023b12c6440”<\/p>\n\n\n\n $params<\/strong> = @{<\/p>\n\n\n\n ServicePrincipalId = $accountSPN<\/strong>.Id<\/p>\n\n\n\n PrincipalId = $accountSPN<\/strong>.Id<\/p>\n\n\n\n ResourceId = (Get-MgbetaServicePrincipal –Filter<\/strong> “AppId eq ‘00000002-0000-0ff1-ce00-000000000000′”).id<\/p>\n\n\n\n AppRoleId = $AppRoleId<\/strong><\/p>\n\n\n\n }<\/p>\n\n\n\n New-MgbetaServicePrincipalAppRoleAssignedTo @params<\/p>\n\n\n\n # Assign Exchange Online Administrator<\/p>\n\n\n\n New-MgbetaRoleManagementDirectoryRoleAssignment -PrincipalId $accountSPN<\/strong>.Id -RoleDefinitionId 29232cdf-9323-42fd-ade2-1d097af3e4de -DirectoryScopeId “\/”<\/p>\n\n\n\n I strongly recommend that you test the account before proceeding, so now I will use a runbook with a very simple script to verify that the automation account is able to log in to Exchange Online.<\/p>\n\n\n\n as of the time I\u2019m writing this post, the ExchangeOnlineManagement module only works in Azure Automation under PowerShell version 5.1 and is unavailable in PowerShell 7.x in Azure Automation. Runbooks must therefore be created with PowerShell version 5.1 to access Exchange Online.<\/p>\n\n\n\n You can either create a runbook through the azure portal directly, or you can use PowerShell script to create it for you. Simply add the following line to the script above if you want to add a Runbook.<\/p>\n\n\n\n New-AzAutomationRunbook -ResourceGroupName $rgname<\/strong> -AutomationAccountName $accountName<\/strong> -Type PowerShell -Name Test -Description “Testing Exchange Online access”<\/p>\n\n\n\n Now open the new runbook in the Azure Portal, select \u201cEdit<\/strong>\u201d and \u201cEdit in portal<\/strong>\u201d to open the editor.<\/p>\n\n\n\n Add the code below into the editor, remember to replace \u201cplaceholder.onmicrosoft.com<\/strong>\u201d with your real tenantname. Then click on \u201cTest pane<\/strong>\u201d (this will also save any changes).<\/p>\n\n\n\n $organization<\/strong> = “placeholder.onmicrosoft.com”<\/p>\n\n\n\n Connect-ExchangeOnline -ManagedIdentity -Organization $organization<\/strong><\/p>\n\n\n\n Get-AcceptedDomain | ft<\/p>\n\n\n\n Disconnect-ExchangeOnline -confirm:$false<\/strong><\/p>\n\n\n\n Click \u201cStart<\/strong>\u201d on the left side and you should see the script starts. The script should end with status \u201cCompleted<\/strong>\u201d and should then display all domain registered in your Exchange Online organization.<\/p>\n\n\n\n As you can see on the screenshot below, the script successfully authenticated to Exchange Online and listed all domain names registered in this organization. Access is confirmed.\u00a0<\/p>\n\n\n\n And there you have it! A step-by-step guide to setting up Azure Automation to work seamlessly with Exchange Online using a managed identity. By following the steps above you no longer need to worry about automating tasks failing due to MFA rules or expired secrets\/certificates.<\/p>\n","protected":false},"excerpt":{"rendered":" Azure Automation is a powerful and flexible tool to automate tasks, and one of my most frequent use-cases is to deploy address book policies in Exchange Online. Using an ordinary account to connect to Exchange Online should always require MFA, which doesn\u2019t work well in automation scripts. But we have a very nice alternative by […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[69,35],"tags":[],"class_list":["post-3726","post","type-post","status-publish","format-standard","hentry","category-azure","category-cloud-computing"],"_links":{"self":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/3726","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3726"}],"version-history":[{"count":1,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/3726\/revisions"}],"predecessor-version":[{"id":3727,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/3726\/revisions\/3727"}],"wp:attachment":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3726"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3726"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
\n
Verify the account and its access<\/h2>\n\n\n\n
Create a runbook<\/h3>\n\n\n\n
Testing the runbook<\/h3>\n\n\n\n
![\"\"](\"https:\/\/agderinthe.cloud\/wp-content\/uploads\/2024\/10\/image-1.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/agderinthe.cloud\/wp-content\/uploads\/2024\/10\/image-2-1024x332.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/agderinthe.cloud\/wp-content\/uploads\/2024\/10\/image-3-1024x318.png\")
<\/figure>\n\n\n\n