title: Access O365 Exchange Online with an Azure Managed Identity or Service Principal
body: <p>I have a program in Powershell which runs in an Azure Function app which also has a managed identity called &quot;AuditO365&quot;. It uses the managed identity to connect to Azure Key Vault to retrieve user credentials. It uses these credentials to connect to O365 Exchange Online to get the required data. This works fine:</p>
  <pre><code>    $uSecret = $ENV:APPSETTING_SecretUsername
      $pSecret = $ENV:APPSETTING_SecretPassword 
      $sasSecret = $ENV:APPSETTING_SecretSAS
  
      $securePassword = ConvertTo-SecureString -String $pSecret -AsPlainText -Force
  
      $UserCredential = New-Object -TypeName &quot;System.Management.Automation.PSCredential&quot; -ArgumentList $uSecret, $securePassword
  
      $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
      Import-PSSession $session
  </code></pre>
  <p>The credential is a basic user account created in Azure Active Directory and the user is visible to the data source (O365 Exchange Online). In O365 under Exchange Admin Centre, I can see the username and I am able to assign the username to the correct custom role group (&quot;View Audit Readers&quot;) with the required permission (&quot;View-Only Audit Logs&quot;).</p>
  <p><a href="https://i.stack.imgur.com/VGZQx.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VGZQx.png" alt="enter image description here" /></a></p>
  <p>However I would now like to try using a managed identity instead so that the solution is more robust. Since the Function already has a managed identity (&quot;AuditO365&quot;), I'd like to replace the current user account with this identity in the custom role group in Exchange Online above, but it appears that O365 can't see the managed identity! All the Azure resources and O365 are running under the same account/subscription.</p>
  <p>I have also tried creating a service principal (with API permissions for O365) in Azure but this also cannot be seen by O365:</p>
  <p><a href="https://i.stack.imgur.com/XXYrb.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XXYrb.png" alt="enter image description here" /></a></p>
  <p><strong>1.</strong> How can I make the Azure Function's managed identity visible to O365 / Exchange Online?</p>
  <p><strong>2.</strong> Can I use this managed identity to authenticate the app against Exchange Online, connect and retrieve the data as it currently does with a normal user account?</p>