Certificate-Based Authentication (CBA) is required to keep Exchange Online management actions running through the Exchange Online PowerShell module.
Microsoft is retiring the Credential parameter in Exchange Online PowerShell in favor of modern authentication. For more information, see Microsoft’s announcement about the Exchange Online PowerShell deprecation.
Prerequisites
- A Tenant Admin role is required.
- App management must already be configured.
- A certificate must be associated with App management. If this has not been completed yet, follow How to configure CBA in App management.
If a certificate has already been associated with App management, this step does not need to be repeated. The same certificate can also be used for How to enable PnP SharePoint actions with CBA.
Configure Exchange Online API permissions
Steps in this section are performed in the Microsoft Entra admin center.
Step 1: find the app registration
Copy the Client ID from the App management page.
Go to “App registrations” and paste the copied Client ID in the “All applications” search bar. Select the existing Microsoft Entra app registration used by App management.
Step 2: add the Exchange Online permission
In the app registration, select “API permissions” > “Add a permission”.
Search for “Office 365 Exchange Online” in the “APIs my organization uses” list.
Select “Application permissions”, add Exchange.ManageAsApp, and click “Add permissions”.
Step 3: grant admin consent
Click “Grant admin consent for [your organization]”.
Assign the Exchange Administrator role
The App management service principal must be assigned the Exchange Administrator role in Microsoft Entra.
- In the Microsoft Entra admin center, select “Roles & admins”.
- Search for “Exchange Administrator”.
- Open the role and select “Add assignment”.
- Click “No members selected”. The “Select member” panel opens.
- Enter the Client ID to find the service principal. The object type is “Enterprise application”.
- Click “Select”, then click “Next”.
- Complete the assignment process and ensure the role is permanently assigned.
Confirm the certificate in App management
The certificate used for Exchange Online CBA must be associated with App management. If the certificate is not already uploaded, follow How to configure CBA in App management.
Certificate expiration
Certificates expire periodically and must be renewed before expiry. Certificate status can be verified in “App management”. A banner is displayed if the certificate is expired or misconfigured.
To renew the certificate, follow the renewal steps in How to configure CBA in App management.