Partilhar via

Use the Exchange Online PowerShell v3 Module with GDAP and App Consent

  • Artigo

If you are not already familiar with how GDAP changes the Secure App Model, read the DAP to GDAP Secure Application Model document.

Prerequisites

  • A multi-tenant app created in your partner tenant
    • Since the sample script is using the Partner Center Consent API, ensure the app has user_impersonation permissions for the Partner Center API (fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd). For more information about Secure App Model permissions, see Create a secure partner application
  • ExchangeOnlineManagement 3.1.0 Powershell module
  • Partner Center Powershell module
  • A GDAP relationship approved by the customer that has one of the following roles:
    • Global admin
    • Privileged role admin
    • Cloud application admin
  • User account that is a member of the AdminAgents group as well as a member of the group with the aforementioned GDAP relationship.

Sample script

Below is a simplified sample PowerShell script that sets up a consented application in the customer’s tenant.

Warning

This script is for illustrative purposes. Secrets should be stored in a key vault as outlined in the Secure Application Model framework.

#variables
$AppId = '<AppID in Partner tenant>'
$AppSecret = '<App secret from AppID in partner tenant>'
$CustomerTenantId = '<Customer tenant ID>'
$consentscope = 'https://api.partnercenter.microsoft.com/user_impersonation'
$AppCredential = (New-Object System.Management.Automation.PSCredential ($AppId, (ConvertTo-SecureString $AppSecret -AsPlainText -Force)))
$PartnerTenantid = '<Partner tenant ID>'
$AppDisplayName = '<App name for AppID in Partner tenant>'
# Get PartnerAccessToken token
$PartnerAccessToken = New-PartnerAccessToken -serviceprincipal -ApplicationId $AppId -Credential $AppCredential -Scopes $consentscope -tenant $PartnerTenantid -UseAuthorizationCode
# Connect using PartnerAccessToken token
$PartnerCenter = Connect-PartnerCenter -AccessToken $PartnerAccessToken.AccessToken
#Grants needed
$MSGraphgrant = New-Object -TypeName Microsoft.Store.PartnerCenter.Models.ApplicationConsents.ApplicationGrant
$MSgraphgrant.EnterpriseApplicationId = "00000003-0000-0000-c000-000000000000"
$MSGraphgrant.Scope = "Directory.Read.All,Directory.AccessAsUser.All"
$ExOgrant = New-Object -TypeName Microsoft.Store.PartnerCenter.Models.ApplicationConsents.ApplicationGrant
$ExOgrant.EnterpriseApplicationID = "00000002-0000-0ff1-ce00-000000000000"
$ExOgrant.Scope = "Exchange.Manage"
New-PartnerCustomerApplicationConsent -ApplicationGrants @($MSGraphgrant, $ExOgrant) -CustomerId $CustomerTenantId -ApplicationId $AppId -DisplayName $appdisplayname
#Connect to customer Exchange via App+User
$token = New-PartnerAccessToken -ApplicationId $AppId -Scopes 'https://outlook.office365.com/.default' -ServicePrincipal -Credential $appcredential -Tenant $CustomerTenantId -RefreshToken $PartnerAccesstoken.refreshToken
Connect-ExchangeOnline -DelegatedOrganization $CustomerTenantId -AccessToken $token.AccessToken