![\"\"](\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/04\/image-4-1024x533.png\")
<\/figure>\n\n\n\nAdd the Permissions for the Application.<\/p>\n\n\n\n
It\u2019s a little bit tricky. Instead of Microsoft Graph select the \u201cAPIs my organization uses\u201d and search for \u201cOffice 365 Exchange Online\u201d<\/p>\n\n\n\n Then select \u201cApplication permissions\u201d and search for \u201cPOP\u201d and \u201cIMAP\u201d and “SMTP” Office 365 Exchange Online<\/p>\n\n\n\n Once completed that is the Enterprise Application configured.<\/p>\n\n\n\n Now we need to create a “Client Secret” for the Enterprise Application, so click on “Certificates & Secrets”, then create “New Client Secret”, we’ll need this value later on when we come to generating the OAuth token. Note that when you create the secret, you need to take the value of the key, and this will then not be visible, also bear in mind this is effectively a password, so keep it safe!<\/p>\n\n\n\n Now you need to create the Service Principal in Exchange Online. The Service Principal in Exchange Online allows the Enterprise Application to interact with objects (e.g. Mailboxes) within Exchange Online.<\/p>\n\n\n\n To create the Service Principal you use the following command:<\/p>\n\n\n\n So what are all these variables? You can find these from the Application “Overview”.<\/p>\n\n\n\n Identified above as per their colours:<\/p>\n\n\n\n So substituting in the values for our particular example:<\/p>\n\n\n\n The\u00a0Organisation ID\u00a0is option from what we can tell.<\/p>\n\n\n\n You can also create via PowerShell, to do this you need to ensure you have the MS Graph and Exchange Online PowerShell Modules installed and active.<\/p>\n\n\n\n Note that: “Get-MgServicePrincipal” retrieves the list of Enterprise Applications, “Get-ServicePrincipal” retrieves the list of Exchange Online Service Principals.<\/p>\n\n\n\n Right, now we can check it has been created OK, that would be a yes.<\/p>\n\n\n\n You’ll notice that the “AppId” value matches the Enterprise Application “Application (Client) ID”; which shows that link between the two.<\/p>\n\n\n\n In our example we using the account zh1@blah.org.uk, so we’ll check it first with:<\/p>\n\n\n\n And then apply the relevant settings (if required), its recommended to just run these anyway! We want POP, IMAP to be set to “True” and SMTPClientAuthenticationDisabled to be set to “False”.<\/p>\n\n\n\n Now we need our Service Principal to have access to our mailbox, we apply this with the following:<\/p>\n\n\n\n We then should get the following:<\/p>\n\n\n\n We can then check the permissions with:<\/p>\n\n\n\n All being well we should then see this if all is well.<\/p>\n\n\n\n We are now ready to start our tests!<\/p>\n\n\n\n Note that permissions application does not appear to be instant within Exchange Online, it can take up to 60 minutes, well it did for us, before the configuration took effect, although it appeared to have taken straight away when reviewing PowerShell output.<\/p>\n\n\n\n Now we need to get the OAUTH token which we’ll then use in the two upcoming tests. A script has been prepared for this, all you need to do is enter the relevant values for:<\/p>\n\n\n\n You need to install the PowerShell modules (if not done so already):<\/p>\n\n\n\n Then create a script called get-token.ps1:<\/p>\n\n\n\n When you run the script you’re using the Client Secret, you created earlier to authenticate, and get an OAUTH token, the script outputs the AUTH requests as two separate outputs, which slightly different commands at the front to use in each of the tests IMAP and SMTP respectively. You’ll see these highlighted with green titles.<\/p>\n\n\n\n You can now use OpenSSL to perform the tests, note that on Microsoft Windows, we had problems with getting OpenSSL to work correctly with the commands, we were constantly seeing “BAD Command Error 12” when using the Microsoft Windows OpenSSL ports, but it worked fine on Ubuntu Linux.<\/p>\n\n\n\n So, firstly connect with:<\/p>\n\n\n\n Issue the first command:<\/p>\n\n\n\n Now enter the second command which includes the OAUTH authentication string, the key is omitted in the below for security\/brevity.<\/p>\n\n\n\n Ensure you are pasting in the above command on a single line, not multiple lines.<\/p>\n\n\n\n All being well you should see an output of:<\/p>\n\n\n\n If you now issue a list command:<\/p>\n\n\n\n We should see the mailbox folder structure, and if we can the test has been successful!<\/p>\n\n\n\n Testing SMTP is similar to testing IMAP but the connection command is different.<\/p>\n\n\n\n All being well you should then see,\u00a0235 2.7.0 Authentication Successful<\/strong>.<\/p>\n\n\n\n Now let’s send an email:<\/p>\n\n\n\n Use lower case: rcpt to, rather than upper case RCPT TO.<\/p>\n\n\n\n All being well you should have received the email in the destination mailbox, if so, the test has been successful!<\/p>\n\n\n\n So we have been to verify and test the use of an Enterprise Application to send email as a user via IMAP and SMTP.<\/p>\n\n\n\n As a test we are using OpenSSL to perform some credentials testing using an Enterprise Application configured in Microsoft 365 to connect using IMAP(S) and SMTP via OpenSSL to validate how OAuth modern authentication works. Create Enterprise Application Firstly we create an Enterprise Application, we are going to be using Win64 OpenSSL v3.3.3 Light on … Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":4439,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[54],"tags":[],"class_list":["post-4427","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-365"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4427","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4427"}],"version-history":[{"count":2,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4427\/revisions"}],"predecessor-version":[{"id":4438,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4427\/revisions\/4438"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/media\/4439"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4427"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4427"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4427"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"\"](\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/04\/image-5-1024x538.png\")
<\/figure>\n\n\n\n\n
Create Enterprise Application Secret<\/h1>\n\n\n\n
![\"\"](\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/04\/image-6-1024x513.png\")
<\/figure>\n\n\n\nCreate Exchange Online Service Principal<\/h1>\n\n\n\n
New-ServicePrincipal -AppId $AppID -ServiceId $objectID [-Organization $TenantID]<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/04\/image-7-1024x525.png\")
<\/figure>\n\n\n\n\n
New-ServicePrincipal -AppId 10e1f456-3921-1234-1234-105af0774c61 -ServiceId 3187e945-569d-1234-1234-48fbb71963d9 -Organization 9b62d4ed-1234-1234-b00d-341a1bd0b3f5 -DisplayName \"EXO Serviceprincipal Win64 OpenSSL v3.3.3 Light\"<\/code><\/pre>\n\n\n\nConnect-MgGraph -Scopes 'Application.Read.All'\n \n$ServicePrincipalDetails = Get-MgServicePrincipal -Filter \"DisplayName eq 'Win64 OpenSSL v3.3.3 Light'\"\n$ServicePrincipalDetails\n \nConnect-ExchangeOnline\nNew-ServicePrincipal -AppId $ServicePrincipalDetails.AppId -ServiceId $ServicePrincipalDetails.Id -DisplayName \"EXO Serviceprincipal $($ServicePrincipalDetails.Displayname)\"<\/code><\/pre>\n\n\n\nPS C:\\Users\\Administrator.BLAH> get-serviceprincipal\n \nDisplayName ObjectId AppId\n----------- -------- -----\nEXO Serviceprincipal Win64 OpenSSL v3... 7e9d0608-db24-1234-1234-c8d03424192d 10e1f456-1234-1234-971b-105af0774c61<\/code><\/pre>\n\n\n\nCheck (and Enable) IMAP, POP and SMTP on Account<\/h1>\n\n\n\n
Get-CASMailbox -Identity zh1@blah.org.uk<\/code><\/pre>\n\n\n\nSet-CASMailbox -Identity zh1@blah.org.uk -PopEnabled $true -ImapEnabled $true -SmtpClientAuthenticationDisabled $false<\/code><\/pre>\n\n\n\nSet Permissions on Account<\/h1>\n\n\n\n
$Mailbox = \"zh1@blah.org.uk\"\n$ServicePrincipal = \"EXO Serviceprincipal Win64 OpenSSL v3.3.3 Light\"\nAdd-MailboxPermission -Identity $Mailbox -User $ServicePrincipal -AccessRights FullAccess -AutoMapping $false<\/code><\/pre>\n\n\n\nPS C:\\Users\\Administrator.BLAH> Add-MailboxPermission -Identity $Mailbox -User $ServicePrincipal -AccessRights FullAccess -AutoMapping $false\n \nIdentity User AccessRights IsInherited Deny\n-------- ---- ------------ ----------- ----\n128c533d-2f09-406... S-1-5-21-20157833... {FullAccess} False False<\/code><\/pre>\n\n\n\n$Mailbox = \"zh1@blah.org.uk\"\nGet-MailboxPermission -Identity $Mailbox | Where-Object { ($_.AccessRights -eq \"FullAccess\") -and ($_.IsInherited -eq $false) -and -not ($_.User -like \"NT AUTHORITY\\SELF\") } | ft -AutoSize<\/code><\/pre>\n\n\n\nPS C:\\Users\\Administrator.BLAH> Get-MailboxPermission -Identity $Mailbox | Where-Object { ($_.AccessRights -eq \"FullAccess\") -and ($_.IsInherited -eq $false) -and -not ($_.User -like \"NT AUTHORITY\\SELF\") } | ft -AutoSize\n \nIdentity User AccessRights IsInherited Deny\n-------- ---- ------------ ----------- ----\n128c533d-2f09-4063-816e-e7cf765a26e4 EXO Serviceprincipal Win64 OpenSSL v3.3.3 Light {FullAccess} False False<\/code><\/pre>\n\n\n\nGet OAUTH Token<\/h1>\n\n\n\n
\n
Install-Module -Name MSAL.PS\nInstall-Module -Name JWTDetails<\/code><\/pre>\n\n\n\nImport-Module MSAL.PS\nImport-Module JWTDetails\n \n$targetmailbox = \"zh1@blah.org.uk\"\n$clientId = \"10e1f456-1234-1234-971b-105af0774c61\"\n$tenantId = \"blahorguk.onmicrosoft.com\"\n$ClientSecret = ConvertTo-SecureString \"<Secret Key in here>\" -AsPlainText -Force\n$Scope = \"https:\/\/outlook.office.com\/.default\"\n \nClear-MsalTokenCache\n \n$authresult = Get-MsalToken -Scope $Scope -ClientId $clientId -TenantId $tenantId -ClientSecret $ClientSecret\n \n$accessToken = $authresult.AccessToken\n \nwrite-host $accessToken\n \nGet-JWTDetails -token $accessToken\n \n$Text = \"user=\" + $targetmailbox + \"$([char]0x01)auth=Bearer \" + $accessToken + \"$([char]0x01)$([char]0x01)\"\n \nwrite-host $Text\n \n$Bytes = [System.Text.Encoding]::ASCII.GetBytes($Text)\n \n$EncodedText = [Convert]::ToBase64String($Bytes)\n \nwrite-host\nwrite-host $EncodedText\nwrite-host\nwrite-host \"IMAP XOAUTH2\" -ForegroundColor Green\nwrite-host \"C02 AUTHENTICATE XOAUTH2 $EncodedText\"\nWrite-Host\nwrite-host \"SMTP XOAUTH2\" -ForegroundColor Green\nwrite-host \"AUTH XOAUTH2 $EncodedText\"<\/code><\/pre>\n\n\n\n.\\get-token.ps1<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/04\/image-8-1024x294.png\")
<\/figure>\n\n\n\nTesting IMAP<\/h1>\n\n\n\n
openssl s_client -connect outlook.office365.com:993 -crlf -quiet<\/code><\/pre>\n\n\n\nC01 CAPABILITY<\/code><\/pre>\n\n\n\nC02 AUTHENTICATE XOAUTH2 <Big long key you copied out of the PowerShell script here><\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/04\/image-9.png\")
<\/figure>\n\n\n\nA01 LIST \"\" *<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/04\/image-10.png\")
<\/figure>\n\n\n\nTesting SMTP<\/h1>\n\n\n\n
openssl s_client -starttls smtp -connect outlook.office365.com:587 -crlf -quiet\n \nEHLO blah.org.uk\n \nAUTH XOAUTH2 <Big long key you copied out of the PowerShell script here><\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/04\/image-11.png\")
<\/figure>\n\n\n\nmail from:zh1@blah.org.uk\nrcpt to:ts01@blah.org.uk\ndata\nFrom:zh1@blah.org.uk\nTo:ts01@blah.org.uk\nSubject:Hello There! from SMTP CLI\nHi, this is a test from the SMTP CLI, typing the commands in one by one. Not tried Thunderbird yet, but that works differently anyway.\n.\nquit<\/code><\/pre>\n\n\n\nConclusion<\/h1>\n\n\n\n
Additional Information<\/h1>\n\n\n\n
\n