|
2 | 2 | title: App-only authentication in Exchange Online PowerShell and Security & Compliance PowerShell
|
3 | 3 | ms.author: chrisda
|
4 | 4 | author: chrisda
|
5 |
| -manager: dansimp |
| 5 | +manager: deniseb |
6 | 6 | ms.date: 12/12/2023
|
7 | 7 | ms.audience: Admin
|
8 | 8 | audience: Admin
|
@@ -33,7 +33,7 @@ Certificate based authentication (CBA) or app-only authentication as described i
|
33 | 33 | >
|
34 | 34 | > For instructions on how to install or update the module, see [Install and maintain the Exchange Online PowerShell module](exchange-online-powershell-v2.md#install-and-maintain-the-exchange-online-powershell-module). For instructions on how to use the module in Azure automation, see [Manage modules in Azure Automation](/azure/automation/shared-resources/modules).
|
35 | 35 | >
|
36 |
| -> - REST API connections in the Exchange Online PowerShell V3 module require the PowerShellGet and PackageManagement modules. For more information, see [PowerShellGet for REST-based connections in Windows](exchange-online-powershell-v2.md#powershellget-for-rest-based-connections-in-windows). |
| 36 | +> - REST API connections in the Exchange Online PowerShell V3 module require the PowerShellGet and PackageManagement modules. For more information, see [PowerShellGet for REST-based connections in Windows](exchange-online-powershell-v2.md#powershellget-for-rest-api-connections-in-windows). |
37 | 37 | >
|
38 | 38 | > If the procedures in this article don't work for you, verify that you don't have Beta versions of the PackageManagement or PowerShellGet modules installed by running the following command: `Get-InstalledModule PackageManagement -AllVersions; Get-InstalledModule PowerShellGet -AllVersions`.
|
39 | 39 | >
|
@@ -412,20 +412,22 @@ The supported Microsoft Entra roles are described in the following table:
|
412 | 412 | |Role|Exchange Online<br>PowerShell|Security & Compliance<br>PowerShell|
|
413 | 413 | |---|:---:|:---:|
|
414 | 414 | |[Compliance Administrator](/entra/identity/role-based-access-control/permissions-reference#compliance-administrator)|✔|✔|
|
415 |
| -|[Exchange Administrator](/entra/identity/role-based-access-control/permissions-reference#exchange-administrator)<sup>\*</sup>|✔|| |
| 415 | +|[Exchange Administrator](/entra/identity/role-based-access-control/permissions-reference#exchange-administrator)¹|✔|| |
416 | 416 | |[Exchange Recipient Administrator](/entra/identity/role-based-access-control/permissions-reference#exchange-recipient-administrator)|✔||
|
417 |
| -|[Global Administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator)<sup>\*</sup>|✔|✔| |
| 417 | +|[Global Administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator)¹ ²|✔|✔| |
418 | 418 | |[Global Reader](/entra/identity/role-based-access-control/permissions-reference#global-reader)|✔|✔|
|
419 | 419 | |[Helpdesk Administrator](/entra/identity/role-based-access-control/permissions-reference#helpdesk-administrator)|✔||
|
420 |
| -|[Security Administrator](/entra/identity/role-based-access-control/permissions-reference#security-administrator)<sup>\*</sup>|✔|✔| |
| 420 | +|[Security Administrator](/entra/identity/role-based-access-control/permissions-reference#security-administrator)¹|✔|✔| |
421 | 421 | |[Security Reader](/entra/identity/role-based-access-control/permissions-reference#security-reader)|✔|✔|
|
422 | 422 |
|
423 |
| -> <sup>\*</sup> The Global Administrator and Exchange Administrator roles provide the required permissions for any task in Exchange Online PowerShell. For example: |
424 |
| -> |
425 |
| -> - Recipient management. |
426 |
| -> - Security and protection features. For example, anti-spam, anti-malware, anti-phishing, and the associated reports. |
427 |
| -> |
428 |
| -> The Security Administrator role does not have the necessary permissions for those same tasks. |
| 423 | +¹ The Global Administrator and Exchange Administrator roles provide the required permissions for any task in Exchange Online PowerShell. For example: |
| 424 | + |
| 425 | +- Recipient management. |
| 426 | +- Security and protection features. For example, anti-spam, anti-malware, anti-phishing, and the associated reports. |
| 427 | + |
| 428 | +The Security Administrator role does not have the necessary permissions for those same tasks. |
| 429 | + |
| 430 | +² Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role. |
429 | 431 |
|
430 | 432 | For general instructions about assigning roles in Microsoft Entra ID, see [Assign Microsoft Entra roles to users](/entra/identity/role-based-access-control/manage-roles-portal).
|
431 | 433 |
|
@@ -481,7 +483,7 @@ For general instructions about assigning roles in Microsoft Entra ID, see [Assig
|
481 | 483 | >
|
482 | 484 | > This method is supported only when you connect to Exchange Online PowerShell or Security & Compliance PowerShell in [REST API mode](exchange-online-powershell-v2.md#rest-api-connections-in-the-exo-v3-module). Security & Compliance PowerShell supports REST API mode in v3.2.0 or later.
|
483 | 485 |
|
484 |
| -For information about creating custom role groups, see [Create role groups in Exchange Online](/exchange/permissions-exo/role-groups#create-role-groups) and [Create Email & collaboration role groups in the Microsoft Defender portal](/microsoft-365/security/office-365-security/mdo-portal-permissions#create-email--collaboration-role-groups-in-the-microsoft-defender-portal). The custom role group that you assign to the application can contain any combination of built-in and custom roles. |
| 486 | +For information about creating custom role groups, see [Create role groups in Exchange Online](/exchange/permissions-exo/role-groups#create-role-groups) and [Create Email & collaboration role groups in the Microsoft Defender portal](/defender-office-365/mdo-portal-permissions#create-email--collaboration-role-groups-in-the-microsoft-defender-portal). The custom role group that you assign to the application can contain any combination of built-in and custom roles. |
485 | 487 |
|
486 | 488 | To assign custom role groups to the application using service principals, do the following steps:
|
487 | 489 |
|
|
0 commit comments