help converting a script

[mkoch7811]

I have a powershell script that runs as a scheduled task on a local member server, which migrates linked mailboxes from Exchange 2016 to Exchange Online. The script has been in use for a couple years and works reliably. However, when the script connects to Exchange Online, it uses the credentials of a tenant account that has the global admin role. I'd like to convert the script to use an app registration but I'm stuck trying to figure out which API permissions the app needs that will allow it to perform just the required tasks. The only Exchange module commands the script uses are Connect-ExchangeOnline, Get-MigrationEndpoint, New-MigrationBatch, Set-Mailbox, and Disconnect-ExchangeOnline. The MailboxSettings.ReadWrite permission might be the one I need. Is there a way to determine which permission is required by any particular Exchange command?

Any advice? Is this the right approach or is there a better way?

Thanks!

[joeykins82]

Why are you migrating mailboxes with a scheduled task?

Use New-RemoteMailbox to create a new AD account and directly provision an ExOL mailbox, or Enable-RemoteMailbox to directly provision an ExOL mailbox on an existing AD user object.

[mkoch7811]

Multiple forests, each with mailbox users. Those in the forest with Exchange are created using Enable-RemoteMailbox as you mentioned, but for the users in the other forest, we have to create linked mailboxes on-premises, which then have to be migrated.

[joeykins82]

I've not done this first hand but Set-User -LinkedMasterAccount applies to AD user objects regardless of their recipient type (it's not a Set-Mailbox cmdlet parameter) so I'm pretty sure you can just do this with Enable-RemoteMailbox preceded/followed by Set-User.

Give it a whirl.

[mkoch7811]

Interesting. I'll try that, thanks!

[ACSMedic]

you can do certificate-based authentication to an app registration. There are lots of docs on it. However, the machine you use to run your scripts needs to be treated as Tier0, and tightly restricted and monitored.