In this post, we wanted to share a practical walk-through of discovering which Azure AD app registrations are still using Exchange Web Services (EWS), plus what the Kiosk/Frontline license changes me...
Updated Jun 26, 2026
Version 4.0
Blog Post
7 MIN READ
Notes From the Field: Finding and Remediating EWS App Usage Before Retirement
Hi all,
I have problem when try to run the script. I registered the app and use client secrets instead of using certificate. When I run the script, I use the following command:
.\Find-EwsUsage.ps1 -OutputPath C:\Temp\Output -OAuthSecretKey <secret value> -OAuthClientId <clientid> -OAuthTenantId <tenantid> -PermissionType Application -Operation GetEwsActivity
and I got the error:
Find-EwsUsage.ps1 : Cannot process argument transformation on parameter
'OAuthClientSecret'. Cannot convert the <secret value> value of type "System.String" to type
"System.Security.SecureString".
At line:1 char:165
+ ... b00b7 -OAuthClientSecret <secret value> -Permis ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidData: (:) [Find-EwsUsage.ps1], ParameterBindingArgumentTransformationException
+ FullyQualifiedErrorId : ParameterArgumentTransformationError,Find-EwsUsage.ps1
Is there anything wrong on the command I run?
thejimmartinMicrosoft
it looks like you are passing the OAuthClientSecret as a string and not secure string. set your secret as a variable first:
$appSecret = ConvertTo-SecureSting "ThisIsMyAppSecret" -AsPlainText -Forcethen just use that variable for the value
I get the same error, so I changed the OAuthSecretKey variable in the script from false to true. Ran it without the -OAuthSecretKey part and it asked me for the key then.
But then I got "Getting a list of Entra App registrations...FAILED. Unable to get a list of Entra App registrations. Please review the error message below and re-run the script: Insufficient privileges to complete the operation." Even running as global admin and the four Graph API permissions added, it still doesn't work for me