Forum Discussion
Connect to Office365 via Powershell as a Delegate Access Partner with MFA enabled
- Mar 01, 2018
We've brought this issue several times already, but afaik it's still not supported. On the other hand, the "sister" SCC MFA module does support delegate access via the corresponding parameter:
Connect-IPPSSession -DelegatedOrganization
It's just another example on how the different teams at Microsoft fail to talk to each other...
Hi Vasil,
thank you again... I´ve missed the -delegatedorganization switch for the connect-ippssession command.
So... unfortunately we can´t support (except Security & Compliance) our customers via PS with mfa in this constellation. That´s odd...
...back to the drawing board
So... please vote for: https://office365.uservoice.com/forums/264636-general/suggestions/33233917-powershell-mfa-for-csp-delegated-admin-privileges
:)
- VasilMichevMar 02, 2018MVP
Looking at the code, all the -DelegatedOrganization parameter does is to modify the ConnectionURI string:
if (![string]::IsNullOrWhiteSpace($DelegatedOrganization)) { [UriBuilder] $uriBuilder = New-Object -TypeName UriBuilder -ArgumentList $ConnectionUri; [string] $queryToAppend = "DelegatedOrg={0}" -f $DelegatedOrganization; if ($uriBuilder.Query -ne $null -and $uriBuilder.Query.Length -gt 0) { [string] $existingQuery = $uriBuilder.Query.Substring(1); $uriBuilder.Query = $existingQuery + "&" + $queryToAppend; } else { $uriBuilder.Query = $queryToAppend; } $newUri = $uriBuilder.ToString(); } else { $newUri = $ConnectionUri; }As it still uses the same cmdlet as the ExO part, you should be able to use the exact same method. Whether this is supported server-side however I cannot tell, as I don't have any delegate account to use currently :)
- AnonymousMar 05, 2018
Hi Vasil,
nice find - so:
connect-exopsession -connectionuri -DelegatedOrganization https://ps.outlook.com/powershell-liveid?DelegatedOrg=%3ccustomer tenant domain name>
is the same like:
connect-exopsession -connectionuri https://ps.outlook.com/powershell-liveid?DelegatedOrg=%3ccustomer tenant domain name>
Unfortunately it results in the same error....
- VasilMichevMar 06, 2018MVP
Yeah, the issue is probably the lack of support for this server-side. Hopefully the UserVoice item will get some traction and the team will address this...