MS 365 Exchange Service Account

<#
    Create new M365 azure application credentials for exchange ews app impersonation
    @colinardo administrator.de
#>

# =============================================
# M365 Admin username
$username = 'admin@mydomain.onmicrosoft.com'  
$appname = 'MyExchangeOnlineAppImpersonation'  
# =============================================
$ErrorActionPreference = 'Stop'  

$modulename = 'AzureAD'  
if(!(Get-Module -ListAvailable -Name $modulename)){
    write-host "Module '$modulename' not found, trying to install module ... " -F Yellow -NoNewline  
    start powershell -Verb runas -ArgumentList "-EP Bypass -NoP -C Install-Module $modulename -Force" -wait  
    if(!(Get-Module -ListAvailable -Name $modulename)){
        write-host "install failed, please try to install manualy. Exit." -F Red  
        sleep 2
        return
    }else{
        write-host "Successfully installed $modulename." -F Green  
    }
}
# connect to azure
$connection = Connect-AzureAD -AccountId $username

# check if admin exists
$AzureAdmin = Get-AzureADUser -Filter "UserPrincipalName eq '$username'"  
if (!$AzureAdmin){
    write-error -Message "Could not find user '$username' in your tenant." -Category ObjectNotFound  
    return
}
# check if app with name exists
$app = Get-AzureADApplication -Filter "DisplayName eq '$appname'"  
if (!$app){
    # add allowed permissions (Exchange Online Application impersonation)
    $resource = [Microsoft.Open.AzureAD.Model.RequiredResourceAccess]::new('00000002-0000-0ff1-ce00-000000000000',[Microsoft.Open.AzureAD.Model.ResourceAccess]::new('dc890d15-9560-4a4c-9b7f-a736ec74ec40','Role'))  
    # add new company application
    $newapp = New-AzureADApplication -DisplayName $appname -RequiredResourceAccess $resource -ReplyUrls 'https://login.microsoftonline.com/common/oauth2/nativeclient'  
    # assign new password
    $pass = New-AzureADApplicationPasswordCredential -ObjectId $newapp.ObjectId -EndDate (get-date).AddYears(2)
    # create service principal for app
    $sPrincipal = New-AzureADServicePrincipal -AppId $newApp.AppId -Tags @("WindowsAzureActiveDirectoryIntegratedApp")  
    # get objectid of service principle
    $resApp = Get-AzureADServicePrincipal -All $true | ? appId -eq $newApp.RequiredResourceAccess.ResourceAppId
    # set admin consent approval for access
    New-AzureADServiceAppRoleAssignment -ObjectId $sPrincipal.ObjectId -PrincipalId $sPrincipal.ObjectId -ResourceId $resApp.ObjectId -Id $newApp.RequiredResourceAccess.ResourceAccess.id | out-null

    write-host "Your application '$appname' has been created, please take note of the following credentials:`n" -F Cyan  
    write-host "`tCLIENT_ID = $($newapp.AppId)" -F Green  
    write-host "`tCLIENT_SECRET = $($pass.Value)" -F Green  
    write-host "The password will expire on $($pass.EndDate.ToString('G'))" -F Gray  
}else{
    Write-Error -Message "Application already exists" -Category ResourceExists  
    return
}