So... in hindsight this feels very obvious. But with some hints (thanks @KelvinTegelaar!) I've put together the following,
To add to the list of grants in New-PartnerCustomerApplicationConsent:
$ExchangeGrant = New-Object -TypeName Microsoft.Store.PartnerCenter.Models.ApplicationConsents.ApplicationGrant
$ExchangeGrant.EnterpriseApplicationId = "00000002-0000-0ff1-ce00-000000000000"
$ExchangeGrant.Scope = "Exchange.Manage"
Also add the same "Exchange.Manage" grant to the app in your own CSP tenant. (Use "Add a Permission" > "APIs my organization uses" > search for "Office 365 Exchange Online" or "00000002-0000-0ff1-ce00-000000000000" and add "Exchange.Manage").
After that you can use the following method to authenticate to EXO:
# Define ExchangeTokenSplat parameters
$ExchangeTokenSplat = @{
ApplicationId = $CSPappId # AppID in CSP tenant
Scopes = 'https://outlook.office365.com/.default'
ServicePrincipal = $true
Credential = (New-Object System.Management.Automation.PSCredential ($CSPappId, (ConvertTo-SecureString $CSPappSecret -AsPlainText -Force)))
RefreshToken = $PartnerCenterRefreshToken
Tenant = $TenantID # Customer TenantID
}
# Get $ExchangeToken
$ExchangeToken = New-PartnerAccessToken @ExchangeTokenSplat
# Connect to MgGraph
Connect-ExchangeOnline -DelegatedOrganization $TenantID -AccessToken $ExchangeToken.AccessToken
From some quick testing I can both request data and make changes so it feels like everything works.
So I guess my conclusion is that the folks writing the learn articles for ExchangeOnlineManagement just haven't considered the Partner angle at all?
Edit: So far I haven't seen a way to update existing PartnerCustomerApplicationConsents so I guess removing the svc principal in customer tenants and running New-PartnerCustomerApplicationConsent again is the only option?
Edit2: I went the way of connecting to the customer tenants and using New-MgOauth2PermissionGrant to add the permission grant.
