Search code examples
azureazure-active-directoryexchange-serverazure-powershell

Get-RemoteDomain in powershell exchange online error : The term 'Get-RemoteDomain' is not recognized as the name of a cmdlet

All required modules were installed, as for example I can run Get-mailbox command. I'm using certificate based authentication , the service principal is in Global administrators group and Azure Enterprise App has all needed permissions : permissions

I know that it can be due to authorisation issue (missing some permissions), but can't figure it out, what is the problem.

Please advise. Thanks and Best Regards.

Solution

  • The error usually occurs if the service principal does not have required permissions or roles to perform the operation.

    Initially, I too got same error when the service principal does not have active Administrator role assigned to it:

    Get-RemoteDomain

    Response:

    enter image description here

    To resolve this, make sure to assign proper admin role like Exchange Administrator or Global Administrator to the service principal.

    In my case, I registered one application and uploaded certificate to it as below:

    enter image description here

    Now, I assigned same API permissions as you with admin consent like this:

    enter image description here

    Confirm whether this service principal is under "Active assignments" of either Global Administrator or Exchange Administrator roles and make sure to wait for few minutes after assigning Admin roles:

    enter image description here

    Now, I ran below PowerShell script to connect Exchange Online with certificate-based authentication:

    #Install-Module -Name ExchangeOnlineManagement -Force
$clientId="appId"
$thumbPrint="15D9FExxxxxxxxxxxx"
$organization="M365xxxxxxxx.onmicrosoft.com"

Connect-ExchangeOnline -AppId $clientId -CertificateThumbprint $thumbPrint -Organization $organization

    Response:

    enter image description here

    When I ran Get-RemoteDomain now, I got the response successfully as below:

    enter image description here

    As @Joseph stated in comments, you can also make use of below commands to know what RBAC permissions Get-RemoteDomain command requires:

    $Perms = Get-ManagementRole -Cmdlet Get-RemoteDomain
$Perms | foreach {Get-ManagementRoleAssignment -Role $_.Name -Delegating $false | Format-Table -Auto Role,RoleAssigneeType,RoleAssigneeName}

    Response:

    enter image description here

    References:

    powershell - Connect-ExchangeOnline UnAuthorized - Stack Overflow by me

    App-only authentication in Exchange Online PowerShell | Microsoft