Azure Active Directory / Entra ID: Managed Identity Authentication Failing with Exchange Online — Unauthorized Access

Question

Azure Active Directory / Entra ID: Managed Identity Authentication Failing with Exchange Online — Unauthorized Access

Scott Schulte 0

Problem description

I am experiencing an issue where a PowerShell runbook in Azure Automation, using a system-assigned managed identity, cannot authenticate to *** Online. Every attempt to connect with 'Connect-ExchangeOnline -ManagedIdentity' results in a '***' ('Unauthorized'). This prevents me from managing distribution group memberships via *** Online PowerShell.

Environment

Azure Automation account with system-assigned managed identity enabled, running PowerShell 7.x, with the ExchangeOnlineManagement module (latest version) installed. The affected service is *** Online in the tenant associated with the Azure AD / Entra ID tenant.

What I've already tried

I enabled the system-assigned managed identity on the Automation account, updated and reinstalled the ExchangeOnlineManagement module to the latest stable release, granted the '***.ManageAsApp' permission to the managed identity with tenant-wide admin consent, and added the managed identity's service principal to the necessary *** Online role group (e.g., 'Organization Management'). I also confirmed that the runbook uses PowerShell 7.x, configured the Azure context within the runbook, and executed the runbook multiple times over 24 hours, waiting for permission propagation each time. Despite these steps, the connection still fails with an 'Unauthorized' error.

Current status

The issue persists; the managed identity cannot authenticate to Exchange Online, resulting in an 'UnauthorizedAccessException'. I am seeking guidance on further troubleshooting steps, possible configuration issues, or known limitations related to managed identity authentication in this scenario.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello @Scott Schulte

Azure Automation supports system-assigned managed identity authentication to Exchange Online PowerShell, so this scenario isn't a known limitation.

One thing stands out in your description: make sure you're specifying the -Organization parameter. Microsoft documents it as required when connecting with managed identity, and the value should be the tenant's primary .onmicrosoft.com domain.

Try reducing the runbook to:

Connect-ExchangeOnline `
    -ManagedIdentity `
    -Organization "yourtenant.onmicrosoft.com" `
    -ShowBanner:$false
Get-AcceptedDomain

Microsoft specifically recommends Get-AcceptedDomain as a simple test after establishing the managed-identity connection.

If this still returns Unauthorized, I would verify the Exchange.ManageAsApp assignment against the managed identity's service principal Object ID, not the Automation Account resource itself. Microsoft's documented configuration uses the following Exchange Online resource and application role:

$AppRoleID = "dc50a0fb-09a3-484d-be87-e023b12c6440"
$ResourceID = (
    Get-MgServicePrincipal `
        -Filter "AppId eq '00000002-0000-0ff1-ce00-000000000000'"
).Id
New-MgServicePrincipalAppRoleAssignment `
    -ServicePrincipalId $MI_ID `
    -PrincipalId $MI_ID `
    -AppRoleId $AppRoleID `
    -ResourceId $ResourceID

Here, $MI_ID must be the Object/Principal ID of the system-assigned managed identity.

Also keep in mind that Exchange.ManageAsApp authorizes app-only access, but the managed identity still requires appropriate Exchange RBAC/Entra role permissions for the operations it needs to perform.

Since you've already waited more than 24 hours, I wouldn't attribute this to normal permission propagation.

I would first verify the -Organization value and the Object ID used for the Exchange.ManageAsApp assignment. If both are correct and Get-AcceptedDomain still returns Unauthorized, please post the exact Connect-ExchangeOnline command (with tenant details redacted) and the full exception message.

Reference: Use Azure managed identities to connect to Exchange Online PowerShell

Please "Accept the Answer" if this information helped you. This will help us and others in the community.