25.17.How to reconfigure your email archive to use modern authentication for PowerShell
In this section, you will learn how to configure contentACCESS to use modern authentication for PowerShell on Exchange Online:
- How to configure the Azure App registration
- How to grant access to Exchange objects for the Azure App registration
- How to configure contentACCESS Exchange connection
Background
Microsoft is retiring the RPS (Remote PowerShell) for Exchange Online from the beginning of June 2023. The clients won’t be able to use the RPS protocol to connect to Exchange Online after this date. This means, that the contentACCESS configuration needs to be changed to connect to Exchange Online PowerShell. Read this article for more information about the Deprecation of Remote PowerShell.
App registration changes
contentACCESS can use modern authentication to connect to Microsoft 365 Exchange Online. This requires an Azure App registration to be configured on the Microsoft 365 tenant. The procedure to create the App registration is described in this chapter.
After you have created the App registration, additional permissions are required to access PowerShell:
- Add the Exchange.ManageAsApp permission
Navigate to your registered application in Azure Active Directory and open the App registration.
Navigate to the “API permissions”, and click on “Add a permission”. On the “Request API permissions” search for “Microsoft 365 Exchange Online” and select it.
Then select the “Application permissions” box which then displays the available permissions in this category.
Locate the Exchange.ManageAsApp permission and select it. Finally, click on the “App permissions” button to add permission to the App registration.
The “full_access_as_app” permission is already (need to be) selected in the Application permissions window, and the “Exchange.ManageAs.App” will be added to this.
Click on the Add permissions button.
After the permissions have been assigned to the application, the administrator must grant consent for these permissions. Click on the Grant admin consent for the “TENANTNAME” button.
Exchange Server role changes
The Exchange.ManageAs.App permission allows the applicant to connect to PowerShell but does not grant access to any PowerShell commands or Exchange objects. The permission to access Exchange objects is granted through the Role Based Access Control (RBAC). This means, that the App registration needs to be granted the “Exchange Administrator” role or “Exchange Recipient Administrator” role.
Go to the Roles and administrators | All roles page, select Exchange Administrator from the list, and click on the role.
After you opened the role, click on the Add assignments button, then search for your App registration (contentACCESS Exchange in our example), and assign it to the role. Please note that the App registration is of type “Service Principal”.
The roles will be listed on the Exchange Administrator | Assignments page now.
contentACCESS Exchange connection configuration
The Exchange configuration can be found in multiple places in contentACCESS:
- Email archive – system settings
- Custom plugins – Exchange connections
To use modern authentication for PowerShell, you already need to use modern authentication for EWS. The App registration for EWS and PowerShell must be the same App registration (includes the permissions for both EWS and PowerShell).
To enable modern authentication for PowerShell, simply select the “PowerShell authentication” mode “Modern”:
Summary
In this article, we have changed the Azure App registration to allow connection to PowerShell and granted the App registration to read Exchange objects (groups and mailboxes). Finally, we have con-figured contentACCESS to use the modern authentication for PowerShell.