MS Graph (or alternative) for M365/O365 Retention Policy management

[JeremyTBradshaw]

Wondering if anyone is aware of whether we can get API access to the Security and Compliance Center.  I'm not even sure what to call it, but I'm in need to manage retention policies that today are managed at https://compliance.microsoft.com, or via Connect-IPPSSession (from the EXO v2 PS module).

What I'm trying to avoid is basic authentication with Connect-IPPSSession.  I don't see anything for MS Graph from the v1.0/beta references, and I have already asked the Exchange Team in the comments for their blog post about the app-only/certificate authentication addition to Connect-ExchangeOnline (asked if they'll bring the same added functionality to Connect-IPPSSession).

My use case is to unattended'ly script the addition/removal of certain users to/from the excluded mailboxes list for a given retention policy.  This would be done interactively like this:

Connect-IPPSSession <parameters of choice>
Set-RetentionCompliancePolicy <policy> -AddExchangeLocationException <one,or,more,users>

The reason is that a customer is using a retention policy to ensure their terminating users' mailboxes become Inactive Mailboxes.  Since they rely so heavily on Inactive Mailboxes, auto-expanding archives are out of the question (as this takes away recoverability/restorability for Inactive Mailboxes).  As a result, many mailboxes are hitting the 100GB Recoverable Items quota.  So we have a manual process for now to exclude these mailboxes from the policy, then either wait or rush with Start-ManagedFolderAssistant to see the Recoverable Items consumption go down.

We can easily use Connect-ExchangeOnline, Get-EXOMailbox, and Get-EXOMailboxStatistics with an Azure AD app and a certificate to figure out which mailboxes are approaching the 100GB.  But we can't do the same with Connect-IPPSSession.  I am eagerly awaiting either MS Graph support for this, or for Connect-IPPSSession to be updated.  Neither of these things are even announced that I can see.

[#2]

Hello @JeremyTBradshaw ,

did you see this:
https://docs.microsoft.com/en-us/microsoft-365/enterprise/connect-to-all-microsoft-365-services-in-a...

?

[#3]

Hi, I have seen that page and appreciate it. But, I'm specifically looking for unattended approach and ideally not using username/password, rather certificate and registered app in Azure AD. This is doable today for several of the services in the link you referred, but not for the Security and Compliance Center yet.

[#4]

Question: are you prompted for user/pass/mfa for each of the services you connect to when using the method in that article?

[#5]

I think each module needs its own token to cache initially, so it makes sense they'd each need the user / pass / MFA, but then the frequency would depend on a bunch of things.

But in any case, I truly am only after non-user/pass authentication. Since either MS Graph or Connect-ExchangeOnline can each do client credential OAuth flow (certificate credential), I just have this one part left which still only supports interactive user/pass. Hoping somebody has found a way...

[#6]

Hi Jeremy!

Did you found any solution for this? I have the same problem to solve as yours.

[#7]

Nope nothing yet. I've asked via the EXO PS module feedback address if Connect-IPPSSession will be brought up to par with Connect-ExchangeOnline, which is where I think this might become possible first. Just a guess though, really not sure what to expect.

[#8]

Hi Jeremy
Any link to an issue raised or a ticket number?
I want to raise a support ticket with MS directly because this is something we need too

[#9]

I haven't opened a support ticket since it's mainly a feature request for either Graph or the EXO module. So the farthest I made it was the EXO module's feedback email address.

[#10]

I asked via the EXO module feedback email if I can open a call for this or does it fall outside of support and they informed me that I can. I have opened a call and MS is reproducing what I am experiencing. Will let thread know of outcome

[#11]

I will do the same and open one tomorrow. Will be great to get this into either, maybe even both Graph and Connect-IPPSSession. Thanks for sharing that.

[#12]

@svermaak_MGL unfortunately my MS Support case spiraled, went nowhere and was closed with this guidance:

"As I have got the answer from my resources and we request you please use the following command ‘Connect-ExchangeOnline’ for future as both are global commands and nothing can we change. I am apologize for this.. 

We have a new preview version of the ExchangeOnlineManagement module that support the legacy Get-Mailbox without need for Basic Authentication through ‘Connect-ExchangeOnline’.

Please follow the link for more information.

Exchange Online PowerShell v2 Module Preview – Now More Secure - Microsoft Tech Community

Please let me know if you have further questions/any update on this."

I did respond and said that Connect-ExchangeOnline is not an alternative to nor a replacement for Connect-IPPSSession and mentioned that it was the EXO Cmdlets preview feedback email team who advised for MS Support cases to be opened to request the feature, and that clearly this case did not get received well.

For now, giving up, moving, using Basic Authentication against Connect-IPPSSession until whenever it's possible to not do this.

[#13]

@JeremyTBradshaw, yeah, mine went back am forth too but I managed to get a workaround without the ticket. Just before you get your hopes up, my issue was a bit different to yours and I managed to get it working with in Azure Function App

Connect-IPPSSession -Credential $RunAs -ConnectionUri "https://ps.compliance.protection.outlook.com/powershell-liveid/";
$sessions = Get-PSSession;
Import-Module (Import-PSSession $sessions[$sessions.Count - 1] -AllowClobber) -Global
$retentionPolicy = Get-RetentionCompliancePolicy -Identity $retensionPolicyName -DistributionDetail;

What also helped me was I added this to the ExchangeOnlineManagement.psm1 file, around line 611

process {
        try {
            $EOPConnectionInProgress = $true
            if ($isCloudShell -eq $false) {
                Write-Host "Connect-ExchangeOnline -ConnectionUri $ConnectionUri -AzureADAuthorizationEndpointUri $AzureADAuthorizationEndpointUri -UserPrincipalName $UserPrincipalName.Value -PSSessionOption $PSSessionOption -Credential $Credential.Value -BypassMailboxAnchoring:$BypassMailboxAnchoring -ShowBanner:$false -DelegatedOrganization $DelegatedOrganization -Prefix $Prefix -CommandName $CommandName -FormatTypeName $FormatTypeName -UseRPSSession:$true"
                Connect-ExchangeOnline -ConnectionUri $ConnectionUri -AzureADAuthorizationEndpointUri $AzureADAuthorizationEndpointUri -UserPrincipalName $UserPrincipalName.Value -PSSessionOption $PSSessionOption -Credential $Credential.Value -BypassMailboxAnchoring:$BypassMailboxAnchoring -ShowBanner:$false -DelegatedOrganization $DelegatedOrganization -Prefix $Prefix -CommandName $CommandName -FormatTypeName $FormatTypeName -UseRPSSession:$true
            } else {
                Write-Host "Connect-ExchangeOnline -ConnectionUri $ConnectionUri -AzureADAuthorizationEndpointUri $AzureADAuthorizationEndpointUri -PSSessionOption $PSSessionOption -BypassMailboxAnchoring:$BypassMailboxAnchoring -Device:$Device.Value -ShowBanner:$false -DelegatedOrganization $DelegatedOrganization -Prefix $Prefix -CommandName $CommandName -FormatTypeName $FormatTypeName -UseRPSSession:$true;"
                Connect-ExchangeOnline -ConnectionUri $ConnectionUri -AzureADAuthorizationEndpointUri $AzureADAuthorizationEndpointUri -PSSessionOption $PSSessionOption -BypassMailboxAnchoring:$BypassMailboxAnchoring -Device:$Device.Value -ShowBanner:$false -DelegatedOrganization $DelegatedOrganization -Prefix $Prefix -CommandName $CommandName -FormatTypeName $FormatTypeName -UseRPSSession:$true
            }
        } finally {
            $EOPConnectionInProgress = $false
        }
    }

This outputs the underlying command Connect-IPPSSession actually executes

[#14 · Accepted solution]

Good news guys!

Our request just got updated!
Check it out: https://m365log.com/apps-365/certificate-based-authentication-for-security-and-compliance-center-pow...

[#15]

Awe yeah 👍!!!! The timing is spectacular as I have just worked on several scripts that are stuck doing Basic for unattended... So it'll still be nice and fresh, easy to update them.

Thank you for coming here with this news!

[#16]

@Jhosefer , @svermaak_MGL , @dgal73 , @Victor_Ivanidze Hi all,

I forgot to share something that was provided to me by Chris D on GitHub (I think, but sort of forget) MS Support.  Right now, the Connect-IPPSSession which supports certificate based app-only authentication is only within the preview modules 2.0.6***.  If we want to accomplish the same thing, but using the current GA 2.0.5, we can use Connect-ExchangeOnline and simply supply the -ConnectionUri parameter with the URL to the SCC:

Connect-ExchangeOnline -AppId e3de3805-2f5a-43c7-8541-b448b50936f4 -Organization MyTenant.onmicrosoft.com -Certificate (Get-ChildItem cert:\CurrentUser\My\98556EEAC704460287C809AEDA9CD3A33A9CAA9B) -ConnectionUri 'https://ps.compliance.protection.outlook.com'

... and it works flawlessly!  I can't find this documented as supported, however, I do feel better using this approach in production scripts for clients, vs using the prerelease module versions.  Hope you find it helpful!

[#17]

**bleep** it!

How is something like this not documented anywhere?

Anyway, thank you very much! I will update our scripts today.

[#18]

@Jhosefer I think the main reason it's not documented is that it's still up in the air as to what will be the path forward (i.e., this solution I've shared, vs keeping/updating Connect-IPPSSession alive as its own cmdlet vs demoting it to be just an alias of the Connect-ExchangeOnline cmdlet).  I'm definitely speculating here and do not have the internal answers but from my poking and prodding here and over on GitHub, it's my best guess.

In another GitHub issue, Chris also pointed out this same trick, while it works with the preview 2.0.6*** versions, since those versions default to non-RPS, we have to supply the -UseRPSSession switch.  So again, not quite ready to be documented while things are in between current GA and final target state.