Update: please see our updated blog post on this subject.
Today we are announcing that we will begin blocking the assignment of the ApplicationImpersonation role in Exchange Online to accounts star...
Updated Nov 22, 2024
Version 12.0
Blog Post
_cparker
Microsoft
MicrosoftShabbir Hasan you'll probably want to use the Unified Audit Logs to discover which impersonation accounts are being used by which applications in your org. For example, the process may look like the following:
- Get the list of "AppImpersonation users" via the Get-ManagementRoleAssignement cmdlet
- For each user, get their SID using Get-User cmdlet
- Do a UAL search (UI or PS), filtering on MailItemsAccessed
- For each SID, review UAL results for events with the SID as LogonUserSid and a different SID/UPN for the MailboxOwnerSid/MailboxOwnerUPN mailbox. Note the AppId
- Identify App Owner(s) and advise on migrating ASAP
Regarding your question around managing RBAC for Applications, you currently need to manage this via Exchange Online PowerShell.