Skip to content

Commit a75f9dd

Browse files
author
Daniele Catanesi
committed
Reconfigured images for post
1 parent 2120277 commit a75f9dd

1 file changed

Lines changed: 55 additions & 17 deletions

File tree

‎_posts/2020-09-21-Exchange-Online-Certificate-Based-Authentication.md‎

Lines changed: 55 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -30,23 +30,30 @@ The first step to deploy Certificate Based authentication is to register a new *
3030
Testing clickable images:
3131

3232
<figure>
33-
<a href="https://pscustomobject.github.io/assets/images/Azure_Application_Registration_Blade.png">
34-
<img src="/assets/images/Azure_Application_Registration_Blade.png"></a>
33+
<a href="https://pscustomobject.github.io/assets/images/Azure_Application_Registration_Blade.png">
34+
<img src="/assets/images/Azure_Application_Registration_Blade.png"></a>
3535
</figure>
3636

37-
![Azure Application Registration](/assets/images/Azure_Application_Registration_Blade.png)
38-
3937
In the app registrations under *Owned applications* we can list all applications that we registered under our account, in my case this is still empty, and under *All applications* as the name implies all application registered tenant wide.
4038

41-
![Azure owned applications](/assets/images/Azure_Owned_Applications.png)
39+
<figure>
40+
<a href="https://pscustomobject.github.io/assets/images/Azure_Owned_Applications.png">
41+
<img src="/assets/images/Azure_Owned_Applications.png"></a>
42+
</figure>
4243

4344
Click on the **New Registration** and fill the various fields accordingly, unless you have specific needs all default values should suffice for most configurations/deployments. I am assuming a single tenant deployment in the following example
4445

45-
![EXO Certificate Authentication Application](/assets/images/ExoV2_Registration.png)
46+
<figure>
47+
<a href="https://pscustomobject.github.io/assets/images/ExoV2_Registration.png">
48+
<img src="/assets/images/ExoV2_Registration.png"></a>
49+
</figure>
4650

4751
Once done click on the **Register** button, provision will only take a couple of seconds.
4852

49-
![EXO Certificate Authentication Application](/assets/images/Azure_Application_Registration_Summary.png)
53+
<figure>
54+
<a href="https://pscustomobject.github.io/assets/images/Azure_Application_Registration_Summary.png">
55+
<img src="/assets/images/Azure_Application_Registration_Summary.png"></a>
56+
</figure>
5057

5158
**Note:** The only field really needed in the *Name* one just be sure to chose a descriptive name that is easy for you to remember.
5259
{: .notice--danger}
@@ -55,19 +62,30 @@ Once done click on the **Register** button, provision will only take a couple of
5562

5663
Once the application has been registered we need to configure/grant API permissions that will define what our application can and cannot do. Either select *API Permissions* from the left blade or from the link directly below the API properties and select **Add permission**
5764

58-
![ExOV2 Certificate Authentication Application](/assets/images/Configure_API_Permissions.png)
65+
<figure>
66+
<a href="https://pscustomobject.github.io//assets/images/Configure_API_Permissions.png">
67+
<img src="/assets/images/Configure_API_Permissions.png"></a>
68+
</figure>
5969

6070
From the **Request API Permissions** scroll all the way down the *Supported Legacy APIs* and select **Exchange**, **Application Permissions** and finally tick **Exchange.ManageAsApp** under the *Exchange* section
6171

6272
**Note:** I will not go into much detail as much has already been written about this but Exchange does not natively support new *Graph* API that's why Exchange is listed under *Legacy API*.
6373
{: .notice--primary}
6474

65-
![ExOV2 Certificate Authentication Application](/assets/images/Exchange_API_Permissions.png)
66-
![ExOV2 Certificate Authentication Application](/assets/images/Exchange_API_Permissions._2.png)
75+
<figure class="half">
76+
<a href="https://pscustomobject.github.io//assets/images/Exchange_API_Permissions.png">
77+
<img src="/assets/images/Exchange_API_Permissions.png"></a>
78+
<a href="https://pscustomobject.github.io//assets/images/Exchange_API_Permissions._2.png">
79+
<img src="/assets/images/Exchange_API_Permissions._2.png"></a>
80+
<figcaption>API Permissions</figcaption>
81+
</figure>
6782

6883
The last step involves clicking the **Grant Admin Consent for <your tenant name>** so that permissions will be deployed for all mailboxes.
6984

70-
![ExOV2 Certificate Authentication Application](/assets/images/EXO_Grant_Admin_Consent.png)
85+
<figure>
86+
<a href="https://pscustomobject.github.io//assets/images/EXO_Grant_Admin_Consent.png">
87+
<img src="/assets/images/EXO_Grant_Admin_Consent.png"></a>
88+
</figure>
7189

7290
## Exchange Online Certificate Based authentication - Configure Authentication
7391

@@ -100,7 +118,10 @@ Open *Certificate Manager* MMC console and under *Certificates Current User / Pe
100118

101119
In the Azure Portal select *Certificates and Secretes* from the left blade and *Upload certificate* navigating to the path where the certificate has been expoted/stored
102120

103-
![ExOV2 Certificate Authentication Certificate Upload](/assets/images/Azure_Certificate_Upload.png)
121+
<figure>
122+
<a href="https://pscustomobject.github.io//assets/images/Azure_Certificate_Upload.png">
123+
<img src="/assets/images/Azure_Certificate_Upload.png"></a>
124+
</figure>
104125

105126
**Note:** Write down the certificate thumbprint displayed in the Azure page as we will need this later on.
106127
{: .notice--primary}
@@ -112,19 +133,33 @@ What we can do is granting a **[AzureAD Directory Role](https://docs.microsoft.c
112133

113134
With the *Azure AD* blade selected go to **Roles and administrators** and select **Exchange Administrator** confirming with the *Add Assignment* button
114135

115-
![ExOV2 Certificate Authentication Role Assignment](/assets/images/Azure_Exchange_Admin_Role.png)
136+
<figure>
137+
<a href="https://pscustomobject.github.io//assets/images/Azure_Exchange_Admin_Role.png">
138+
<img src="/assets/images/Azure_Exchange_Admin_Role.png"></a>
139+
</figure>
116140

117141
In *Select Member* windows you will need to search application by GUID and select it
118142

119-
![Application Role Assignment](/assets/images/Azure_Exchange_Assignment.png)
143+
<figure>
144+
<a href="https://pscustomobject.github.io//assets/images/Azure_Exchange_Assignment.png">
145+
<img src="/assets/images/Azure_Exchange_Assignment.png"></a>
146+
</figure>
120147

121148
In the *Add Assignment* page be sure to select **Active** under *Assignment Type* and tick the **Permanently Assign** checkbox
122149

123-
![Assignment Page](/assets/images/Add_Assignment_Page.png)
150+
<figure>
151+
<a href="https://pscustomobject.github.io//assets/images/Add_Assignment_Page.png">
152+
<img src="/assets/images/Add_Assignment_Page.png"></a>
153+
</figure>
124154

125155
Once configuration is complete you will see a page similar the following
126156

127-
![Assignment Confirmation](/assets/images/Azure_Assignment_Confirmation.png) where you can review applied configuration and make any required change.
157+
<figure>
158+
<a href="https://pscustomobject.github.io//assets/images/Azure_Assignment_Confirmation.png">
159+
<img src="/assets/images/Azure_Assignment_Confirmation.png"></a>
160+
</figure>
161+
162+
where you can review applied configuration and make any required change.
128163

129164
## Exchange Online Certificate Based authentication - Testing connection
130165

@@ -144,7 +179,10 @@ Where *certThumbPrint* is the certificate thumbprint we created and uploaded to
144179

145180
And here's the result
146181

147-
![Get Mailbox result](/assets/images/Exchange_Get_Mailbox.png)
182+
<figure>
183+
<a href="https://pscustomobject.github.io//assets/images/Exchange_Get_Mailbox.png">
184+
<img src="/assets/images/Exchange_Get_Mailbox.png"></a>
185+
</figure>
148186

149187
## Closing notes
150188

0 commit comments

Comments
 (0)