@KelvinTegelaar Stellar work, thanks so much! I've been somewhat absent from all this MFA/CSP stuff since before Technical Enforcement on Nov 18th - busy with other stuff. But your blog post basically had everything I needed!
I was able to connect to Exchange Online of one of our Customers using Delegated Permissions without any user interaction! I now have to update all my scripts...
But I did have a problem with Azure AD, connecting to Azure AD of Customers we have delegated admin rights to. But I worked it out.
Connecting to our CUSTOMERS with Msol is fairly straight forward, use the Connect-MsolService commands as listed at the end of Kelvin's blog post to connect to YOUR (eg. CSP) Msol service, then Get-MsolPartnerContract will list all YOUR Customers you have DELEGATED permissions to. You can then use a foreach ($customer in $Customers) {} loop.
Inside the foreach you can then use any Msol command AND specify their TenantID, eg: Get-MsolUser -TenantId $Customer.TenantId will show the CUSTOMER'S users, not yours. You need to add -TenantId to all Msol commands since you are connected to your Msol service endpoint (but you have delegated permissions to your Customers)
For AzureAD it was slightly more complicated: I could get MY internal (eg. CSP) Users, but not my CUSTOMER's Users that I had Delegated permissions to, I would get an error like:
Get-AzureADUser : Error occurred while executing GetUsers
Code: Request_BadRequest
Message: Invalid domain name in the request url.
The solution for Azure AD is:
Connect to AzureAD as listed in Kelvin's blog post, this will connect to YOUR (eg. CSP) Azure AD
Get all your Customers that you have Delegated Admin rights to with: Get-AzureADContract
Then Disconnect-AzureAd (will disconnect from your AzureAD)
You will need (just like the Exch Online code): $upn = 'UPN-Used-To-Generate-Tokens'
Then in your foreach ($customer in $Customers) {} loop you must obtain NEW AAD and Graph Tokens for the Customer's TenantId, such as:
$CustAadGraphToken = New-PartnerAccessToken -ApplicationId $ApplicationId -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.windows.net/.default' -ServicePrincipal -Tenant $customer.CustomerContextId
# And
$CustGraphToken = New-PartnerAccessToken -ApplicationId $ApplicationId -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.microsoft.com/.default' -ServicePrincipal -Tenant $customer.CustomerContextId
Finally connect to the CUSTOMER'S AzureAD (to which you have Delegated rights):
Connect-AzureAD -AadAccessToken $CustAadGraphToken.AccessToken -AccountId $upn -MsAccessToken $CustGraphToken.AccessToken -TenantId $customer.CustomerContextId
[Note that $customer.CustomerContextId is the CUSTOMER's TenantID, which is obtained from Get-AzureAdContract (when connected to YOUR Azure AD, the first time)]
You can now run commands like Get-AzureAdUser or Get-AzureAdDomain and it will show the CUSTOMER's users/info.
Disconnect-AzureAd at the end of the loop (from the Customer's AzureAD)
More script updating for me! But at least I can now use the Secure App Model with MFA to connect to my CSP Azure AD, get all Customers, and then connect to each of my Customers' Azure AD + Exch Online to do unattended scripting.
Thanks for finally getting this all sorted out!
PS: This is using the most recent AzureAD, Msol, and PartnerCenter modules (2.0.2.76, 1.1.183.57, and 3.0.1 respectively). No need at this point for the new preview Exchange Online V2 PowerShell module. Maybe in the future it'll make things easier.
