Permissions to query additional Exchange Online items

[Sebastianrhenriksen]

Hi Maester community

I was trying to build some tests for EXO instead of doing manually assessment.

In my manual script, im using Get-EXOMailbox -RecipientTypeDetails SharedMailbox

So my question is, do you know how I can query same things with Maester? I am running the Maester automated through Github with automations.

I have given the App registration these permissions for Exchange Online:

Office 365 Exchange Online:

• Calendars.Read.All
• Exchange.ManageAsApp
• Mail.Read
• MailboxSettigs.Read
• Organization.Read.All
• PeopleSettings.Read.All
• Place.Read.All
• ReportingWebService.Read.All
• Tasks.Read
• User.Read.All

But when trying to query the exo command, it creates an error.

Any suggestions to what I can do better or remake script to make it work?

[soulemike]

What are you using to connect to Exchange Online through the module? Are you using Maester's connection command with the service parameter such as All or using Exchange Online modules connection method?

https://maester.dev/docs/connect-maester/connect-maester-advanced

[Sebastianrhenriksen]

What are you using to connect to Exchange Online through the module? Are you using Maester's connection command with the service parameter such as All or using Exchange Online modules connection method?

https://maester.dev/docs/connect-maester/connect-maester-advanced

I am using GitHub Action with Workload identity federation. I have used this: https://maester.dev/docs/monitoring/github/ as reference

[soulemike]

So you are adding a custom step to your action that is using the EXO PowerShell module?

@SamErde or others may know if that federated credential can work with custom steps.

[Sebastianrhenriksen]

What are you using to connect to Exchange Online through the module? Are you using Maester's connection command with the service parameter such as All or using Exchange Online modules connection method?
https://maester.dev/docs/connect-maester/connect-maester-advanced

I am using GitHub Action with Workload identity federation. I have used this: https://maester.dev/docs/monitoring/github/ as reference

I dont know if i understand what you mean by a custom step, I have just followed the instructions from the docs.

I have given the App Registration:

DeviceManagementConfiguration.Read.All
DeviceManagementManagedDevices.Read.All
Directory.Read.All
DirectoryRecommendations.Read.All
IdentityRiskEvent.Read.All
Policy.Read.All
Policy.Read.ConditionalAccess
PrivilegedAccess.Read.AzureAD
Reports.Read.All
ReportSettings.Read.All
RoleEligibilitySchedule.Read.Directory
RoleManagement.Read.All
SecurityIdentitiesSensors.Read.All
SecurityIdentitiesHealth.Read.All
SharePointTenantSettings.Read.All
ThreatHunting.Read.All
UserAuthenticationMethod.Read.All
OnPremDirectorySynchronization.Read.All

Furthermore the Exchange Online and Teams permissions has been assigned accordingly to the docs.

So to my understanding, the App Registration should have all necessary permissions, but somehow my tests fails when trying to use the commands from the Exchange Online v3 powershell module

[l-gosling]

@Sebastianrhenriksen
did you create the service principal in exchange online too?

New-ServicePrincipal -AppId <Application ID> -ObjectId <Object ID> -DisplayName <Name>
New-ManagementRoleAssignment -Role "View-Only Configuration" -App <DisplayName from previous command>

Can you provide the error message?