|
| 1 | +--- |
| 2 | +title: "Exchange Online - Certificate Based Authentication - Step by Step" |
| 3 | +excerpt: "Microsoft is deprecating basic authentication when establishing a connection to Exchange Online in favor of more secure Certificate Based Authentication (CBA). In this step by step article we will explore how to configure all the components from scratch" |
| 4 | +categories: |
| 5 | + - PowerShell |
| 6 | + - Office365 |
| 7 | + - Exchange |
| 8 | +tags: |
| 9 | + - PowerShell |
| 10 | + - Office365 |
| 11 | + - Exchange Online |
| 12 | + - Exchange Online CBA |
| 13 | + - Exchange Online Certificate Based Authentication |
| 14 | + - EXO CBA |
| 15 | + - PowerShell Exchange Certificate |
| 16 | + |
| 17 | +toc: true |
| 18 | +header: |
| 19 | + teaser: "/assets/images/ExchangeLogo.png" |
| 20 | +--- |
| 21 | + |
| 22 | +Microsoft released to GA the new version of *Exchange Online Management* module, version *2.0.3* at the time this article, which introces **Certificate Based Authencation** for PowerShell sessions. *Basic Authentication* has been already deprecated and originally planned for removal in *Ocober 2020* but due CoVid-19 outbreak this has been post-poned to 2021 as you can [read here](https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-april-2020-update/ba-p/1275508). |
| 23 | + |
| 24 | +I have been using the module preview in production for quite some time but held back publishing this article so to have all places in place as GA. |
| 25 | + |
| 26 | +## Exchange Online Certificate Based authentication - Register Azure Application |
| 27 | + |
| 28 | +The first step to deploy Certificate Based authentication is to register a new *Azure Application*. Navigate *Azure Active Directory* in the Azure portal and select **App Registrations** (alternatively use the search function whcih is what I usually do) |
| 29 | + |
| 30 | + |
| 31 | + |
| 32 | +In the app registrations under *Owned applications* we can list all applications that we registered under our account, in my case this is still empty, and under *All applications* as the name implies all application registered tenant wide. |
| 33 | + |
| 34 | + |
| 35 | + |
| 36 | +Click on the **New Registration** and fill the various fields accordingly, unless you have specific needs all default values should suffice for most configurations/deployments. I am assuming a single tenant deployment in the following example |
| 37 | + |
| 38 | + |
| 39 | + |
| 40 | +Once done click on the **Register** button, provision will only take a couple of seconds. |
| 41 | + |
| 42 | + |
| 43 | + |
| 44 | +**Note:** The only field really needed in the *Name* one just be sure to chose a descriptive name that is easy for you to remember. |
| 45 | +{: .notice--danger} |
| 46 | + |
| 47 | +### Exchange Online Certificate Based authentication - Grant API Permissions |
| 48 | + |
| 49 | +Once the application has been registered we need to configre/grant API permissions that will define what our application can and cannot do. Either seelct *API Permissions* from the left blade or from the link directly below the API properties and select **Add permission** |
| 50 | + |
| 51 | + |
| 52 | + |
| 53 | +From the **Request API Permissions** scroll all the way down the *Supported Legacy APIs* and select **Exchange**, **Application Permissions** and finally tick **Exchange.ManageAsApp** under the *Exchange* section |
| 54 | + |
| 55 | +**Note:** I will not go into much detail as much has already been written about this but Exchange does not natively support new *Graph* API that's why Exchange is listed under *Legacy API*. |
| 56 | +{: .notice--primary} |
| 57 | + |
| 58 | + |
| 59 | + |
| 60 | + |
| 61 | +The last step invovles clicking the **Grant Admin Consent for <your tenant name>** so that permissions will be deployed for all mailboxes. |
| 62 | + |
| 63 | + |
| 64 | + |
| 65 | +## Exchange Online Certificate Based authentication - Configure Authentication |
| 66 | + |
| 67 | +With the application created configured in AzureAD we need to configure authentication against AzureAD. When using *[application permissions model](https://en.wikipedia.org/wiki/Application_permissions)* authenticaiton is performed via a **client secret**, a token, or a **certificate**. Token authentication is considered, rightly so, *less secure* for this reason only certificate one is supported by Exchange Online/Microsoft. |
| 68 | + |
| 69 | +In the scope of Exchange OnLine authentication it is unimportant if we're using a self signed or publicly trusted certificate as long as **we have the associated private key**. |
| 70 | + |
| 71 | +You can easily create a self-signed certificate via PowerShell with the following command: |
| 72 | + |
| 73 | +```powershell |
| 74 | +$paramNewSelfSignedCertificate = @{ |
| 75 | + Subject = 'Exchange Online Background Process' |
| 76 | + CertStoreLocation = 'cert:\CurrentUser\My' |
| 77 | + KeySpec = 'KeyExchange' |
| 78 | + FriendlyName = 'Exchange Online Authentication Certificate' |
| 79 | +} |
| 80 | +
|
| 81 | +New-SelfSignedCertificate @paramNewSelfSignedCertificate |
| 82 | +
|
| 83 | +# Output |
| 84 | +Thumbprint Subject |
| 85 | +---------- ------- |
| 86 | +1B1541D37888EFECD058B528524764G0EF8608D4 CN=Exchange Online Background Process |
| 87 | +``` |
| 88 | + |
| 89 | +**Note:** Certificate will be automatically installed in the local certificate store under *User / Personal Certificates* and have, by default, validity of 1 year. |
| 90 | +{: .notice--primary} |
| 91 | + |
| 92 | +Open *Certificate Manager* MMC console and under *Certificates Current User / Personal / Certificates* right-click on the certificate and select *All Tasks / Export*. Just follow the export wizard be sure to select *Do not export private key* and select **CER** as the export format. |
| 93 | + |
| 94 | +In the Azure Portal select *Certificates and Secretes* from the left blade and *Upload certificate* navigating to the path where the certificate has been expoted/stored |
| 95 | + |
| 96 | + |
| 97 | + |
| 98 | +**Note:** Write down the certificate thumbprint displayed in the Azure page as we will need this later on. |
| 99 | +{: .notice--primary} |
| 100 | + |
| 101 | +## Exchange Online Certificate Based authentication - Grant permissiosn |
| 102 | + |
| 103 | +As I mentioned in the **Grant API Permissions** paragraph Graph API does not support any Exchange management operations nor we can use Exchange **RBAC** model as that only applies to user objects not applications, like in our case, which are represented by a **Service Principal**. |
| 104 | +What we can do is granting a **[AzureAD Directory Role](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#exchange-service-administrator-permissions)** to our application Service Principal. |
| 105 | + |
| 106 | +With the *Azure AD* blade selected go to **Roles and administrators** and select **Exchange Administrator** confirming with the *Add Assignment* button |
| 107 | + |
| 108 | + |
| 109 | + |
| 110 | +In *Select Member* windows you will need to search application by GUID and select it |
| 111 | + |
| 112 | + |
| 113 | + |
| 114 | +In the *Add Assignment* page be sure to select **Active** under *Assignment Type* and tick the **Permanently Assign** checkbox |
| 115 | + |
| 116 | + |
| 117 | + |
| 118 | +Once configuration is complete you will see a page similar the following |
| 119 | + |
| 120 | + where you can review applied configuration and make any required change. |
| 121 | + |
| 122 | +## Exchange Online Certificate Based authentication - Testing connection |
| 123 | + |
| 124 | +After all the above components are in place it's time to test our configuration. Assuming the *Exchange Online Management* PowerShell module version 2.0.3 is installed we can issue the following command to establish a connection |
| 125 | + |
| 126 | +```powershell |
| 127 | +$paramConnectExchangeOnline = @{ |
| 128 | + CertificateThumbprint = $certThumbPrint |
| 129 | + AppId = $appId |
| 130 | + Organization = $exchangeOrgId |
| 131 | +} |
| 132 | +
|
| 133 | +Connect-ExchangeOnline @paramConnectExchangeOnline |
| 134 | +``` |
| 135 | + |
| 136 | +Where *certThumbPrint* is the certificate thumbprint we created and uploaded to Azure, *appId* is the ID of the application we created and *exchangeOrgId* is the name of the tenant in the form **tenantName.onmicrosoft.com** |
| 137 | + |
| 138 | +And here's the result |
| 139 | + |
| 140 | + |
| 141 | + |
| 142 | +## Closing notes |
| 143 | + |
| 144 | +This was quite a long post but steps to get up and running with Exchange Online Certificate based authentication are numerous even if not difficult to implemnt but well worth following. |
| 145 | + |
| 146 | +Certificate Based authentication resolves a number of challenges administrators had to face up to this point, chief among all [storing credentials](https://pscustomobject.github.io/powershell/howto/Store-Credentials-in-PowerShell-Script/) which is inherently insecure. |
0 commit comments