Connect-ExchangeOnline -AppId -CertificateThumbprint -Organization (app-only, unattended scripts)

For scripts that run without a person signing in (scheduled tasks, Azure Automation, CI), connect to Exchange Online with certificate-based app-only authentication:

Connect-ExchangeOnline -AppId "36ee4c6c-0812-40a2-b820-b22ebd02bce3" `
  -CertificateThumbprint "83213AEAC56D61C97AEE5C1528F4AC5EBA7321C1" `
  -Organization "contoso.onmicrosoft.com"

-AppId is the application (client) ID of the app registration, -CertificateThumbprint the thumbprint of a certificate in the local certificate store that holds the private key, and -Organization the tenant's primary .onmicrosoft.com domain (not a custom domain). Replace the three values with yours.

Parameters

The block below lists the authentication parameters of Connect-ExchangeOnline in module 3.10.1 with their types, read from the module itself:

Import-Module ExchangeOnlineManagement
$p = (Get-Command Connect-ExchangeOnline).Parameters
foreach ($n in 'AppId','CertificateThumbprint','Certificate','CertificateFilePath','CertificatePassword','Organization','ManagedIdentity','ManagedIdentityAccountId','AccessToken') {
  '{0,-25} {1}' -f $n, $p[$n].ParameterType.Name
}

One-time setup

1. Register an application in Microsoft Entra ID (App registrations > New registration).
2. API permissions: add the application permission Office 365 Exchange Online > Exchange.ManageAsApp and grant admin consent. For Security & Compliance PowerShell (Connect-IPPSSession) the resource is Microsoft Exchange Online Protection > Exchange.ManageAsApp.
3. Certificate: create one and upload its public part (.cer) under Certificates & secrets. A self-signed certificate is accepted:

$mycert = New-SelfSignedCertificate -DnsName "contoso.org" -CertStoreLocation "cert:\CurrentUser\My" -NotAfter (Get-Date).AddYears(1) -KeySpec KeyExchange
$mycert | Export-Certificate -FilePath mycert.cer
$mycert.Thumbprint

4. Role: assign the app's service principal a Microsoft Entra role such as Exchange Recipient Administrator, Exchange Administrator or Global Reader, or an Exchange role group through a service principal. Without a suitable role the cmdlets the script needs are not available.

Common failures

• AADSTS700016: the -AppId value does not exist in the tenant named by -Organization (details).
• The certificate is not found: the certificate with that thumbprint (and its private key) is not in a certificate store available to the account that runs the script.
• Get-Mailbox is not recognized after connecting: the app has no Exchange role (details).