Skip to content

Commit f6009f7

Browse files
chrisdachrisda
authored
Merge pull request #10405 from MicrosoftDocs/TestSPA-chrisda
TestSPA-chrisda to Main
2 parents c73e489 + 9792aa3 commit f6009f7

File tree

3 files changed

+168
-0
lines changed

3 files changed

+168
-0
lines changed

‎exchange/exchange-ps/exchange/Test-ServicePrincipalAuthorization.md

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
---
2+
external help file: Microsoft.Exchange.RolesAndAccess-Help.xml
3+
online version: https://learn.microsoft.com/powershell/module/exchange/test-serviceprincipalauthorization
4+
applicable: Exchange Online
5+
title: Test-ServicePrincipalAuthorization
6+
schema: 2.0.0
7+
author: chrisda
8+
ms.author: chrisda
9+
ms.reviewer:
10+
---
11+
12+
# Test-ServicePrincipalAuthorization
13+
14+
## SYNOPSIS
15+
This cmdlet is available only in the cloud-based service.
16+
17+
Use the Test-ServicePrincipalAuthorization cmdlet to test the access granted by role-based access control (RBAC) for Applications. For more information, see [Role Based Access Control for Applications in Exchange Online](https://learn.microsoft.com/Exchange/permissions-exo/application-rbac).
18+
19+
For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
20+
21+
## SYNTAX
22+
23+
```
24+
Test-ServicePrincipalAuthorization [-Identity] <ServicePrincipalIdParameter>
25+
[-Confirm]
26+
[-Organization <OrganizationIdParameter>]
27+
[-Resource <UserIdParameter>]
28+
[-WhatIf]
29+
[<CommonParameters>]
30+
```
31+
32+
## DESCRIPTION
33+
You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see [Find the permissions required to run any Exchange cmdlet](https://learn.microsoft.com/powershell/exchange/find-exchange-cmdlet-permissions).
34+
35+
## EXAMPLES
36+
37+
### Example 1
38+
```powershell
39+
PS C:\> Test-ServicePrincipalAuthorization -Identity "DemoB" -Resource "Mailbox A" | Format-Table
40+
41+
RoleName GrantedPermissions AllowedResourceScope ScopeType InScope
42+
-------- ------------------ -------------------- --------- ------
43+
Application Mail.Read Mail.Read Canadian Employees CustomRecipientScope True
44+
Application Calendars.Read Calendars.Read 4d819ce9-9257-44.. AdministrativeUnit False
45+
Application Contacts.Read Contacts.Read Organization Organization True
46+
```
47+
48+
This example tests if this service principal (the app named "DemoB") can exercise each of its assigned permissions against the target mailbox named "Mailbox A." The membership in the scope is indicated by the InScope column.
49+
50+
### Example 2
51+
```powershell
52+
PS C:\> Test-ServicePrincipalAuthorization -Identity "DemoB" | Format-Table
53+
54+
RoleName GrantedPermissions AllowedResourceScope ScopeType InScope
55+
-------- ------------------ -------------------- --------- ------
56+
Application Mail.Read Mail.Read Canadian Employees CustomRecipientScope Not Run
57+
Application Calendars.Read Calendars.Read 4d819ce9-9257-44.. AdministrativeUnit Not Run
58+
Application Contacts.Read Contacts.Read Organization Organization Not Run
59+
```
60+
61+
This example tests the entitlement of the app named "DemoB", including which permissions it has at which scopes. Because the command doesn't use the Resource parameter, the scope membership check is not run.
62+
63+
## PARAMETERS
64+
65+
### -Identity
66+
The Identity parameter specifies the service principal that you want to test. You can use any value that uniquely identifies the service principal. For example:
67+
68+
- Name
69+
- Distinguished name (DN)
70+
- GUID
71+
- AppId
72+
- ServiceId
73+
74+
```yaml
75+
Type: ServicePrincipalIdParameter
76+
Parameter Sets: (All)
77+
Aliases:
78+
Applicable: Exchange Online
79+
80+
Required: True
81+
Position: 0
82+
Default value: None
83+
Accept pipeline input: True (ByPropertyName, ByValue)
84+
Accept wildcard characters: False
85+
```
86+
87+
### -Confirm
88+
This parameter is reserved for internal Microsoft use.
89+
90+
```yaml
91+
Type: SwitchParameter
92+
Parameter Sets: (All)
93+
Aliases: cf
94+
Applicable: Exchange Online
95+
96+
Required: False
97+
Position: Named
98+
Default value: None
99+
Accept pipeline input: False
100+
Accept wildcard characters: False
101+
```
102+
103+
### -Organization
104+
This parameter is reserved for internal Microsoft use.
105+
106+
```yaml
107+
Type: OrganizationIdParameter
108+
Parameter Sets: (All)
109+
Aliases:
110+
Applicable: Exchange Online
111+
112+
Required: False
113+
Position: Named
114+
Default value: None
115+
Accept pipeline input: True (ByPropertyName, ByValue)
116+
Accept wildcard characters: False
117+
```
118+
119+
### -Resource
120+
The Resource parameter specifies the target mailbox where the scoped permissions apply. You can use any value that uniquely identifies the mailbox. For example:
121+
122+
- Name
123+
- Distinguished name (DN)
124+
- Canonical DN
125+
- GUID
126+
127+
```yaml
128+
Type: UserIdParameter
129+
Parameter Sets: (All)
130+
Aliases:
131+
Applicable: Exchange Online
132+
133+
Required: False
134+
Position: Named
135+
Default value: None
136+
Accept pipeline input: True (ByPropertyName, ByValue)
137+
Accept wildcard characters: False
138+
```
139+
140+
### -WhatIf
141+
This parameter is reserved for internal Microsoft use.
142+
143+
```yaml
144+
Type: SwitchParameter
145+
Parameter Sets: (All)
146+
Aliases: wi
147+
Applicable: Exchange Online
148+
149+
Required: False
150+
Position: Named
151+
Default value: None
152+
Accept pipeline input: False
153+
Accept wildcard characters: False
154+
```
155+
156+
### CommonParameters
157+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/p/?LinkID=113216).
158+
159+
## INPUTS
160+
161+
## OUTPUTS
162+
163+
## NOTES
164+
165+
## RELATED LINKS

‎exchange/exchange-ps/exchange/exchange.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1674,6 +1674,8 @@ Exchange PowerShell is built on Windows PowerShell technology and provides a pow
16741674

16751675
### [Test-OAuthConnectivity](Test-OAuthConnectivity.md)
16761676

1677+
### [Test-ServicePrincipalAuthorization](Test-ServicePrincipalAuthorization.md)
1678+
16771679
### [Test-SystemHealth](Test-SystemHealth.md)
16781680

16791681
### [Update-ExchangeHelp](Update-ExchangeHelp.md)

‎exchange/mapping/serviceMapping.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -820,6 +820,7 @@
820820
"Set-SettingOverride": "organization",
821821
"Test-ApplicationAccessPolicy": "organization",
822822
"Test-OAuthConnectivity": "organization",
823+
"Test-ServicePrincipalAuthorization": "organization",
823824
"Test-SystemHealth": "organization",
824825
"Update-ExchangeHelp": "organization",
825826
"Disable-JournalArchiving": "policy-and-compliance",

0 commit comments

Comments
 (0)