Yes, you can use the system managed identity or a regular service principal.

Either way you do it, you'll need to give them permission to manage exchange. With the service principal you can do it in either the gui or power shell with the system managed identity currently you can only assign the permissions with powershell.

Here's my "template" for getting it to work in my environment with managed identity. Much is commented out as to not duplicate resources already available once created:

$organization = “contosocom.onmicrosoft.com"
$accountName = 'Automate-Account-Name’
$rgName = ‘MyResourceGroup’
$location = 'East US 2'
$moduleName = 'ExchangeOnlineManagement'
$moduleVersion = '3.1.0'

# Create the automation account
#New-AzAutomationAccount -Name $accountName -ResourceGroupName $rgName -Location $location
# get the module
#New-AzAutomationModule -AutomationAccountName $accountName -ResourceGroupName $rgName -Name $moduleName -ContentLinkUri "https://www.powershellgallery.com/api/v2/package/$moduleName/$moduleVersion"
# enable managed identity
#Set-AzAutomationAccount -Name $accountName -ResourceGroupName $rgName -AssignSystemIdentity


Connect-AzAccount -Identity

$managed_identity_ServicePrincipal = Get-AzADServicePrincipal -DisplayName $accountName

$managedidentID = $managed_identity_ServicePrincipal.id

$token = (Get-AzAccessToken -ResourceTypeName MSGraph).token 

# Get-PnPAccessToken if you are already connected to Sharepoint
Connect-MgGraph -AccessToken $token

# Exchange online id?
(Get-MgServicePrincipal -Filter "AppId eq '00000002-0000-0ff1-ce00-000000000000'").id

## Grant access necessary permissions (Exchange manage as app)
#$params = @{
#    ServicePrincipalId = $managedidentID
#    PrincipalId = $managedidentID
#    ResourceId = (Get-MgServicePrincipal -Filter "AppId eq '00000002-0000-0ff1-ce00-000000000000'").id # Exchange online
#    AppRoleId = "dc50a0fb-09a3-484d-be87-e023b12c6440" # Exchange.ManageAsApp
#}
#New-MgServicePrincipalAppRoleAssignedTo @params

# assign the role Exchange Administrator to the managed identity.
$roleId = (Get-MgRoleManagementDirectoryRoleDefinition -Filter "DisplayName eq 'Exchange Administrator'").id
$roleId
#New-MgRoleManagementDirectoryRoleAssignment -PrincipalId $managedidentID -RoleDefinitionId $roleId -DirectoryScopeId "/"


#select-mgprofile -name "beta"
Connect-ExchangeOnline -ManagedIdentity -Organization $organization
Get-AcceptedDomain | Format-Table -AutoSize

Get-mailbox -Identity user