---
title: The role assigned to application <guid> isn't supported in this scenario.
slug: the-role-assigned-to-application-lessguidgreater-isnt-supported-in-this-scenario
docTags: 
createdAt: 2025-08-06T20:31:28.136Z
---

# Error

The role assigned to application \<app id> isn't supported in this scenario. Please check online documentation for assigning correct Directory Roles to Azure AD Application for EXO App-Only Authentication.: \[Connect-ExchangeOnline -SkipLoadingFormatData 'True' -AppId '\<app id>' -Organization 'tenant.onmicrosoft.com' -CertificateThumbPrint '\<cert thumbprint>' ]


The role assigned to application \<app id> isn't supported in this scenario. Please check online documentation for assigning correct Directory Roles to Azure AD Application for EXO App-Only Authentication.: \[Connect-ExchangeOnline -SkipLoadingFormatData 'True' -AppId '\<appid>' -Organization 'tenant.onmicrosoft.com' -CertificateThumbPrint '\<certthumbprint>' ]


Microsoft.Exchange.Management.ExoPowershellSnapin.NewEXOModule.ProcessRecord()
at System.Management.Automation.Cmdlet.DoProcessRecord()
at System.Management.Automation.CommandProcessor.ProcessRecord()
\--- End of inner exception stack trace ---
at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
at System.Management.Automation.Runspaces.Pipeline.Invoke()
at Innovation.Activate.Utilities.LocalPowerShell.Exec(Command cmd) in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs\:line 190
\--- End of inner exception stack trace ---
at Innovation.Activate.Utilities.LocalPowerShell.Exec(Command cmd) in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs\:line 194
at Innovation.Activate.Utilities.LocalPowerShell.Exec(String command, Dictionary\`2 values) in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs\:line 157
at Innovation.Activate.Utilities.ExchangeOnline.ConnectExchangeOnline(LocalPowerShell ps) in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs\:line 1442
at Innovation.Activate.Utilities.ExchangeOnline.GetPowerShell() in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs\:line 1343
at Innovation.Activate.Utilities.ExchangeOnline.Exec(Command cmd) in C:\Projects\ActivateV8\Activate.Library\Utilities\RemotePowerShell.cs\:line 1599
at Innovation.Activate.Resources.ExchangeResourceOnline.Exec(Command cmd) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResourceOnline.cs\:line 389
at Innovation.Activate.Resources.ExchangeResource2010.Exec(String command, Object\[] args) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResource2010.cs\:line 502
at Innovation.Activate.Resources.ExchangeResource2010.ExecNoResults(String command, Object\[] args) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResource2010.cs\:line 486
at Innovation.Activate.Resources.ExchangeResourceOnline.AddMailboxPermissions(UserDirectoryEntry mailbox, ProvisioningDirectoryEntry user, String rights) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResourceOnline.cs\:line 416
at Innovation.Activate.Resources.ExchangeResource2007.UpdateMailboxACL(UserDirectoryEntry mailbox, ProvisioningDirectoryEntry user, String rights) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResource2007.cs\:line 730
at Innovation.Activate.Resources.ExchangeResource2007.SetPermissions(UserDirectoryEntry mailbox, ProvisioningDirectoryEntry user, MailboxRights rights) in C:\Projects\ActivateV8\Activate.Resources\ExchangeResource2007.cs\:line 606
at Innovation.Activate.MailboxPermissionCollection.Add(ProvisioningDirectoryEntry user, MailboxRights rights) in C:\Projects\ActivateV8\Activate.Library\MailboxResource.cs\:line 397
at Script.main() in \:line 16
at System.RuntimeMethodHandle.InvokeMethod(Object target, Void\*\* arguments, Signature sig, Boolean isConstructor)
at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)
\--- End of inner exception stack trace ---
Script Line 194:
at Innovation.Activate.ProvisioningScript.ExecuteScript(Object context, ProvisioningObject parent, String script, Boolean bDebug) in C:\Projects\ActivateV8\Activate.Library\ProvisioningScript.cs\:line 2267
at Innovation.Activate.Evaluator.ExecuteScript(Object context, ProvisioningObject current, String script, Boolean bDebug) in C:\Projects\ActivateV8\Activate.Library\Evaluator.cs\:line 1599

# Solution

When using **App-Only authentication** to perform **Exchange Online PowerShell or Graph API operations**, you must:

### 1. Assign the correct Azure AD Directory Role

For access to **mailboxes**, **shared mailboxes**, or EXO PowerShell, you must assign one of the following **Azure AD roles** to the application:

| Scenario                                       | Required Azure AD Role                                                                             |
| ---------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| Read-only mailbox access (Graph)               | **Exchange Administrator** OR **Global Reader**                                                    |
| Full access to mailboxes (Graph or PowerShell) | **Exchange Administrator**                                                                         |
| EXO PowerShell App-Only                        | **Exchange Administrator** (with **AppId** granted **ApplicationAccessPolicy** if scoping is used) |

Assign this via:

- Azure Portal > Entra ID > Roles and administrators
- Find **Exchange Administrator**
- Click **Add assignments**
- Select **your app’s service principal**



### 2. Ensure Exchange Online Application Permissions Are Granted

Go to:

- **Azure Portal > App Registrations > Your App > API permissions**
- Ensure you have **Exchange.ManageAsApp** permission added under **APIs my organization uses > Office 365 Exchange Online > Application Permissions**
- Also, click **Grant admin consent** **for \<tenant>&#x20;**&#x61;fter adding this permission.