Fix Connect-ExchangeOnline Unauthorized Error with App-Only Auth
Question details
The user needs to resolve an unauthorized error when attempting to connect to Exchange Online via PowerShell using app-only authentication to query mailbox sizes.
- Product
- Exchange Online
- Device & OS
- not provided
- Scenario
- Running an Exchange Online PowerShell script with Azure app registration and certificate authentication to automate querying mailbox sizes without Basic authentication.
- Observed behavior
- The Connect-ExchangeOnline command fails, returning an 'OperationStopped: Unauthorized' error, and subsequently returns a role assignment error when incomplete permissions are applied.
Ensure you have Global Administrator or Privileged Role Administrator permissions in Azure Active Directory to modify app registration permissions and assign directory roles.
Configure Required Permissions and Directory Roles
Assign the correct Exchange API permissions and Azure AD directory roles to your app registration to authorize the connection.
Exchange Online app-only authentication requires a specific application permission as well as a supported directory role assigned directly to the application. Mixing unnecessary Microsoft Graph permissions can sometimes cause connection context issues.
Navigate to the Azure Portal, go to Azure Active Directory > App registrations, and select your app. Click on API permissions > Add a permission > APIs my organization uses. Search for Office 365 Exchange Online, select Application permissions, and check 'Exchange.ManageAsApp'.
After adding the permission, click the 'Grant admin consent for [Your Organization]' button on the API permissions page to apply the changes.
Go to Azure Active Directory > Roles and administrators. Search for 'Exchange Administrator' (or another supported role), click Add assignments, and select your app registration.
If you previously added Microsoft Graph permissions during troubleshooting, remove them from the API permissions blade to prevent token conflicts.
Wait a few minutes for role replication, then run your script using Connect-ExchangeOnline -AppId <AppID> -CertificateThumbprint <Thumbprint> -Organization <Domain>.
Verify Certificate Thumbprint and Organization Info
Ensure that the PowerShell script uses the exact certificate and organization details configured in the Azure App Registration.
Boost Your Productivity with WPS Office
While managing Exchange Server and PowerShell scripts requires specific IT administration tools, you can streamline your everyday document, spreadsheet, and reporting tasks using WPS Office. It provides a lightweight, easy-to-use platform that perfectly alternatives Microsoft's desktop suite.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button to get the latest version.
- 2. Install WPS Office: Run the downloaded installer file and follow the quick on-screen instructions to set up the software.
- 3. Open and Edit: Launch WPS Office to immediately open and edit your existing Word, Excel, or PowerPoint files without losing any formatting.
Frequently Asked Questions
Why do I get a 'role assigned to application is not supported in this scenario' error?
This error occurs if your Azure app registration lacks a supported Exchange directory role. Even if you have the Exchange.ManageAsApp API permission, you must also assign an administrative role, such as 'Exchange Administrator', to the application under Azure AD Roles and Administrators.
Can I use Microsoft Graph permissions instead of Exchange.ManageAsApp for Exchange Online?
No. When using the Connect-ExchangeOnline V2/V3 PowerShell module, you specifically need the Exchange.ManageAsApp permission from the Office 365 Exchange Online API. Microsoft Graph permissions are meant for Graph API REST endpoints and do not authorize the Exchange Online PowerShell module.
Is Basic authentication still supported for querying mailbox sizes in Exchange Online?
No, Microsoft has officially deprecated and disabled Basic authentication for Exchange Online to improve security. You must use Modern Authentication, such as app-only authentication with a certificate, for automated background scripts.
Where can I find my Azure App Registration's Application ID for the PowerShell script?
In the Azure Portal, navigate to Azure Active Directory > App registrations, and select your application. On the Overview page, you will find the 'Application (client) ID' which should be used as the -AppId parameter in your script.
