The role assigned to application <guid> isn't supported in this scenario.
Error
The role assigned to application <app id> isn't supported in this scenario. Please check online documentation for assigning correct Directory Roles to Azure AD Application for EXO App-Only Authentication.: [Connect-ExchangeOnline -SkipLoadingFormatData 'True' -AppId '<app id>' -Organization 'tenant.onmicrosoft.com' -CertificateThumbPrint '<cert thumbprint>' ]
The role assigned to application <app id> isn't supported in this scenario. Please check online documentation for assigning correct Directory Roles to Azure AD Application for EXO App-Only Authentication.: [Connect-ExchangeOnline -SkipLoadingFormatData 'True' -AppId '<appid>' -Organization 'tenant.onmicrosoft.com' -CertificateThumbPrint '<certthumbprint>' ]
Microsoft.Exchange.Management.ExoPowershellSnapin.NewEXOModule.ProcessRecord() at System.Management.Automation.Cmdlet.DoProcessRecord() at System.Management.Automation.CommandProcessor.ProcessRecord() --- End of inner exception stack trace --- at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input) at System.Management.Automation.Runspaces.Pipeline.Invoke() at Innovation.Activate.Utilities.LocalPowerShell.Exec(Command cmd) in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs:line 190 --- End of inner exception stack trace --- at Innovation.Activate.Utilities.LocalPowerShell.Exec(Command cmd) in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs:line 194 at Innovation.Activate.Utilities.LocalPowerShell.Exec(String command, Dictionary`2 values) in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs:line 157 at Innovation.Activate.Utilities.ExchangeOnline.ConnectExchangeOnline(LocalPowerShell ps) in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs:line 1442 at Innovation.Activate.Utilities.ExchangeOnline.GetPowerShell() in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs:line 1343 at Innovation.Activate.Utilities.ExchangeOnline.Exec(Command cmd) in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs:line 1599 at Innovation.Activate.Resources.ExchangeResourceOnline.Exec(Command cmd) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResourceOnline.cs:line 389 at Innovation.Activate.Resources.ExchangeResource2010.Exec(String command, Object[] args) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResource2010.cs:line 502 at Innovation.Activate.Resources.ExchangeResource2010.ExecNoResults(String command, Object[] args) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResource2010.cs:line 486 at Innovation.Activate.Resources.ExchangeResourceOnline.AddMailboxPermissions(UserDirectoryEntry mailbox, ProvisioningDirectoryEntry user, String rights) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResourceOnline.cs:line 416 at Innovation.Activate.Resources.ExchangeResource2007.UpdateMailboxACL(UserDirectoryEntry mailbox, ProvisioningDirectoryEntry user, String rights) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResource2007.cs:line 730 at Innovation.Activate.Resources.ExchangeResource2007.SetPermissions(UserDirectoryEntry mailbox, ProvisioningDirectoryEntry user, MailboxRights rights) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResource2007.cs:line 606 at Innovation.Activate.MailboxPermissionCollection.Add(ProvisioningDirectoryEntry user, MailboxRights rights) in C:\Projects\ActivateV8\Activate.Library\MailboxResource.cs:line 397 at Script.main() in :line 16 at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor) at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr) --- End of inner exception stack trace --- Script Line 194: at Innovation.Activate.ProvisioningScript.ExecuteScript(Object context, ProvisioningObject parent, String script, Boolean bDebug) in C:\Projects\ActivateV8\Activate.Library\ProvisioningScript.cs:line 2267 at Innovation.Activate.Evaluator.ExecuteScript(Object context, ProvisioningObject current, String script, Boolean bDebug) in C:\Projects\ActivateV8\Activate.Library\Evaluator.cs:line 1599
Solution
When using App-Only authentication to perform Exchange Online PowerShell or Graph API operations, you must:
1. Assign the correct Azure AD Directory Role
For access to mailboxes, shared mailboxes, or EXO PowerShell, you must assign one of the following Azure AD roles to the application:
Scenario | Required Azure AD Role |
|---|---|
Read-only mailbox access (Graph) | Exchange Administrator OR Global Reader |
Full access to mailboxes (Graph or PowerShell) | Exchange Administrator |
EXO PowerShell App-Only | Exchange Administrator (with AppId granted ApplicationAccessPolicy if scoping is used) |
Assign this via:
- Azure Portal > Entra ID > Roles and administrators
- Find Exchange Administrator
- Click Add assignments
- Select your app’s service principal
2. Ensure Exchange Online Application Permissions Are Granted
Go to:
- Azure Portal > App Registrations > Your App > API permissions
- Ensure you have Exchange.ManageAsApp permission added under APIs my organization uses > Office 365 Exchange Online > Application Permissions
- Also, click Grant admin consent for <tenant> after adding this permission.