Home

Connect Office365 PowerShell using Service Account

%3CLINGO-SUB%20id%3D%22lingo-sub-364539%22%20slang%3D%22en-US%22%3EConnect%20Office365%20PowerShell%20using%20Service%20Account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-364539%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20the%20first%20time%20I%20am%20starting%20a%20conversation%26nbsp%3Bin%20Office%20365%20forum%20and%20I%20hope%20someone%20could%20help%20me%20with%20below.%3C%2FP%3E%3CP%3EIn%20my%20organisation%2C%20there%20is%20a%20hybrid%26nbsp%3Bexchange%20environment%20with%20Exchange%202010%20and%20Office%20365.%20We%20have%20an%20automated%20user%20offboarding%20process%20using%20scheduled%20PowerShell%20scripts.%20We%20already%20have%20scripts%20scheduled%26nbsp%3Bto%20run%20on%20leaving%20the%20user's%20final%20working%20day%20to%20remove%20access%20and%20all%20other%20required%20tasks.%26nbsp%3B%20We%20also%20would%20like%20to%20block%20the%20user's%20Azure%20AD%20authentication%20on%20the%20user's%20final%20working%20day%20using%20the%20same%20scheduled%26nbsp%3BPowerShell%20Script.%26nbsp%3B%20The%20reasoning%20behind%20this%20is%2C%20we%20keep%20terminated%20user%20accounts%20as%20disabled%20users%20for%2030%20days%20before%20purging%20the%20account.%26nbsp%3B%20During%20this%20time%20period%2C%20the%20user%20can%20still%20access%20Yammer%20and%20Office%20365%20emails.%26nbsp%3B%20We%20reset%20the%20account%20password%20to%20prevent%20this%20at%20the%20moment.%20We%20would%20like%20this%20process%20to%20be%20cleaner%20by%20disabling%20online%20authentication.%20(Set-AzureADUser%20-ObjectID%20%3CSIGN-IN%20name%3D%22%22%20of%3D%22%22%20the%3D%22%22%20user%3D%22%22%20account%3D%22%22%3E%20-AccountEnabled%20%24false)%3C%2FSIGN-IN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%20In%20order%20to%20this%2C%20we%20need%20to%20connect%20Microsoft%20online%20PowerShell%20with%20provided%20credentials.(%20%24Session%20%3D%20New-PSSession%20-ConfigurationName%20Microsoft.Exchange%20-ConnectionUri%20%3CA%20href%3D%22https%3A%2F%2Fps.outlook.com%2Fpowershell%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fps.outlook.com%2Fpowershell%3C%2FA%3E%20-Credential%20%24O365Creds%20-Authentication%20Basic%20-AllowRedirection%20).%3C%2FP%3E%3CP%3E%26nbsp%3B%20The%20Scheduled%20task%20runs%20using%20a%20service%20account%20and%20we%20created%20this%20user%20in%20exchange%20online%20with%20below%20privileges.%26nbsp%3B%3C%2FP%3E%3CUL%3E%3CLI%3EHelpdesk%20(Password)%20administrator%3C%2FLI%3E%3CLI%3EService%20administrator%3C%2FLI%3E%3CLI%3EExchange%20administrator%3C%2FLI%3E%3CLI%3EUser%20management%20administrator%3C%2FLI%3E%3C%2FUL%3E%3CP%3EI%20can%20connect%20to%20exchange%20online%20PowerShell%20Module%20using%20this%20service%20account%20credentials.%26nbsp%3B%3C%2FP%3E%3CP%3EMY%20question%20is%3C%2FP%3E%3CUL%3E%3CLI%3EIs%20there%20a%20way%20for%20the%20scheduled%20task%20to%20connect%20exchange%20online%20PowerShell%20module%20using%20the%20scheduled%20task%20credentials%20without%20storing%20credentials%26nbsp%3Bin%20a%20text%20file%3F%20I%20know%20these%20text%20file%20can%20be%20encrypted%20and%20secure%3B%20however%2C%20my%20organisation%20still%20does%20not%20like%20the%20idea%20of%20saving%20admin%20credentials%20a%20text%20file.%26nbsp%3B%3C%2FLI%3E%3C%2FUL%3E%3CP%3EI%20hope%20my%20explanation%20is%20clear%20enough%20for%20someone%20to%20help%20me%20with%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20very%20much!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-364539%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAuthentication%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%20Groups%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-400627%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20Office365%20PowerShell%20using%20Service%20Account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-400627%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F298981%22%20target%3D%22_blank%22%3E%40donnuwan%3C%2FA%3EIf%20you%20need%20any%20help%2C%20contact%20me%20privately%20and%20I%20might%20help%20you%201%20on%201%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-400513%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20Office365%20PowerShell%20using%20Service%20Account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-400513%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F83730%22%20target%3D%22_blank%22%3E%40Arjan%20Cornelissen%3C%2FA%3E%26nbsp%3B%20Thanks%20for%20pointing%20me%20in%20the%20right%20direction.%26nbsp%3B%20I%20started%20reading%20on%20this%20avenue%20and%20will%20try%20to%20implement%20this.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-386371%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20Office365%20PowerShell%20using%20Service%20Account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-386371%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F298981%22%20target%3D%22_blank%22%3E%40donnuwan%3C%2FA%3Eto%20use%20the%20command%20%22%3CSPAN%3ESet-AzureADUser%20-ObjectID%20%3CSIGN-IN%20name%3D%22%22%20of%3D%22%22%20the%3D%22%22%20user%3D%22%22%20account%3D%22%22%3E%20-AccountEnabled%20%24false%3C%2FSIGN-IN%3E%3C%2FSPAN%3E%22%3CBR%20%2F%3EYou%20should%20first%20use%20the%20command%20%22Connect-AzureAD%26nbsp%3B-Credential%20%24%3CSPAN%3EO365Creds%3C%2FSPAN%3E%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20if%20you%20use%20Azure%20Automation%20you%20can%20create%20a%20new%20%22Automation%20Account%22.%20In%20there%20you%20can%20go%20to%20Credentials%20under%20Shared%20Resources.%3C%2FP%3E%3CP%3EThe%20name%20you%20give%20the%20credential%20you%20can%20use%20in%20a%20runbook%20by%20calling%3C%2FP%3E%3CP%3E%24O365Cred%20%3D%20Get-AutomationPSCredential%20-Name%20%22%3CYOUR%20credentials%3D%22%22%20name%3D%22%22%3E%22%3C%2FYOUR%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20the%20complete%20script%20can%20be%20something%20like%20this%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eparam(%3CBR%20%2F%3E%26nbsp%3B%20%5BParameter(Mandatory%3D%24true)%5D%3CBR%20%2F%3E%26nbsp%3B%20%5Bguid%5D%3CBR%20%2F%3E%26nbsp%3B%20%24UserObjectId%3CBR%20%2F%3E)%3C%2FP%3E%3CP%3E%24O365Cred%20%3D%20Get-AutomationPSCredential%20-Name%20%22AzureADAdminCred%22%3C%2FP%3E%3CP%3E%3CSPAN%3EConnect-AzureAD%26nbsp%3B-Credential%20%24%3C%2FSPAN%3E%3CSPAN%3EO365Creds%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3ESet-AzureADUser%20-ObjectID%20%24UserObjectId%20-AccountEnabled%20%24false%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThen%20you%20can%20run%20this%20runbook%20and%20then%20you%20are%20asked%20to%20give%20the%20ObjectId%20of%20the%20user%20to%20run%20it.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EHope%20this%20helps.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-386314%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20Office365%20PowerShell%20using%20Service%20Account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-386314%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F83730%22%20target%3D%22_blank%22%3E%40Arjan%20Cornelissen%3C%2FA%3E%26nbsp%3B%20Thank%20you%20for%20your%20response%20and%20sorry%20for%20the%20late%20reply.%20Thanks%20for%20pointing%20me%20in%20the%20right%20direction.%20I%20tried%20to%20find%20documentation%20to%20accomplish%20this%20task%20and%20could%20not%20find%20anything%20fulfil%20this%20task.%20If%20you%20can%20give%20a%20few%20simple%20steps%20to%20achieve%20this%20would%20be%20highly%20appreciated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3EDon%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-369576%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20Office365%20PowerShell%20using%20Service%20Account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-369576%22%20slang%3D%22en-US%22%3E%3CP%3E%3CBR%20%2F%3EIf%20you%20use%26nbsp%3B%3CSPAN%3ESet-AzureADUser%3C%2FSPAN%3E%2C%20then%20you%20need%20to%20connect%20to%20AzureAD%20not%20Exchange.%3CBR%20%2F%3EThen%20you%20can%20use%20Azure%20Automation%2C%20here%20you%20have%20a%20credential%20manager%20to%20store%20the%20account%20you%20use%20to%20connect.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-412413%22%20slang%3D%22en-US%22%3ERe%3A%20Connect%20Office365%20PowerShell%20using%20Service%20Account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-412413%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F83730%22%20target%3D%22_blank%22%3E%40Arjan%20Cornelissen%3C%2FA%3E%26nbsp%3B%20Thank%20you%20for%20your%20kind%20help.%20I%20will%20contact%20you%20privately%20to%20arrange%20some%20time%20to%20go%20through%20with%20this%20task.%3C%2FP%3E%3C%2FLINGO-BODY%3E
donnuwan
Occasional Contributor

Hi All,

 

This is the first time I am starting a conversation in Office 365 forum and I hope someone could help me with below.

In my organisation, there is a hybrid exchange environment with Exchange 2010 and Office 365. We have an automated user offboarding process using scheduled PowerShell scripts. We already have scripts scheduled to run on leaving the user's final working day to remove access and all other required tasks.  We also would like to block the user's Azure AD authentication on the user's final working day using the same scheduled PowerShell Script.  The reasoning behind this is, we keep terminated user accounts as disabled users for 30 days before purging the account.  During this time period, the user can still access Yammer and Office 365 emails.  We reset the account password to prevent this at the moment. We would like this process to be cleaner by disabling online authentication. (Set-AzureADUser -ObjectID <sign-in name of the user account> -AccountEnabled $false)

  In order to this, we need to connect Microsoft online PowerShell with provided credentials.( $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Creds -Authentication Basic -AllowRedirection ).

  The Scheduled task runs using a service account and we created this user in exchange online with below privileges. 

  • Helpdesk (Password) administrator
  • Service administrator
  • Exchange administrator
  • User management administrator

I can connect to exchange online PowerShell Module using this service account credentials. 

MY question is

  • Is there a way for the scheduled task to connect exchange online PowerShell module using the scheduled task credentials without storing credentials in a text file? I know these text file can be encrypted and secure; however, my organisation still does not like the idea of saving admin credentials a text file. 

I hope my explanation is clear enough for someone to help me with this.

 

Thank you very much!

 

6 Replies


If you use Set-AzureADUser, then you need to connect to AzureAD not Exchange.
Then you can use Azure Automation, here you have a credential manager to store the account you use to connect.

@Arjan Cornelissen  Thank you for your response and sorry for the late reply. Thanks for pointing me in the right direction. I tried to find documentation to accomplish this task and could not find anything fulfil this task. If you can give a few simple steps to achieve this would be highly appreciated.

 

Thanks

Don

@donnuwanto use the command "Set-AzureADUser -ObjectID <sign-in name of the user account> -AccountEnabled $false"
You should first use the command "Connect-AzureAD -Credential $O365Creds"

 

So if you use Azure Automation you can create a new "Automation Account". In there you can go to Credentials under Shared Resources.

The name you give the credential you can use in a runbook by calling

$O365Cred = Get-AutomationPSCredential -Name "<your credentials name>"

 

So the complete script can be something like this

 

param(
  [Parameter(Mandatory=$true)]
  [guid]
  $UserObjectId
)

$O365Cred = Get-AutomationPSCredential -Name "AzureADAdminCred"

Connect-AzureAD -Credential $O365Creds

Set-AzureADUser -ObjectID $UserObjectId -AccountEnabled $false

 

 

Then you can run this runbook and then you are asked to give the ObjectId of the user to run it.

Hope this helps.

@Arjan Cornelissen  Thanks for pointing me in the right direction.  I started reading on this avenue and will try to implement this. 

@donnuwanIf you need any help, contact me privately and I might help you 1 on 1

@Arjan Cornelissen  Thank you for your kind help. I will contact you privately to arrange some time to go through with this task.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
50 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
32 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
15 Replies
Dev channel update to 80.0.355.1 is live
josh_bodner in Discussions on
67 Replies