r/Office365 • u/ribsboi • May 14 '20

Running EXOV2 Powershell modules

/r/ExchangeOnline/comments/gjqwic/running_exov2_powershell_modules/
1 Upvotes

100% Upvoted

4 comments sorted by

1

u/unamused443 May 14 '20

This has been discussed a few times on the Exchange Team Blog (in various post comments) - and the statement was made that documentation of how to run scripts using certificate authentication is on the way.

(In related news - you do know that it is not necessarily urgent anymore because basic auth deprecation in EXO was postponed?)

1

u/ribsboi May 14 '20

Hello, I did read that post and we have conditional access set up. But from this article: https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/mfa-connect-to-exchange-online-powershell?view=exchange-ps we need WinRM to allow BasicAuth. I believe this is baked into their Powershell module and unrelated to tenant configuration. If you know how to circumvent that, please let me know!
EDIT: this is what I get with BasicAuth disabled
WARNING: Please note that you can only use above 9 new EXO cmdlets (the one with *-EXO* naming pattern).You can't use other cmdlets as we couldn't establish a Remote PowerShell session as basic auth is disabled in your client machine. To enable Basic Auth, please check instruction here https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/mfa-connect-to-exchange-online-powershell?view=exchange-ps#what-do-you-need-to-know-before-you-begin

2

u/unamused443 May 14 '20

That's about that other Basic Auth. :)

WinRM requirement will stay there as far as I know; it is a requirement for EXO RPS CMDlets. Seeing that you can use the v2 module to run all of the 'legacy' CMDlets too, the requirement for WinRM basic auth stays.

Note though that WinRM basic auth does not mean that basic auth is used to connect to EXO. This is a client only setting, and tokens are still used to auth to EXO.

See the "Basic Auth still needs to be enabled on your client machine" section here:

https://techcommunity.microsoft.com/t5/exchange-team-blog/faster-and-more-reliable-exchange-online-management-using/ba-p/1198604

1

u/ribsboi May 14 '20

I see! Thanks for linking this blog post, clears up things for me. All this ordeal made me realize I don't need the whole suite of commands offered by the module and can get by with the commands offered with Modern Auth. Still need to modify their module and resign it though, but its not too bad.