Een Azure-app instellen voor Exchange Online

1. Log als beheerder in bij de Azure-portal.
2. Klik op Cloud Shell Powershell.
3. Maak een opslagaccount als hierom wordt gevraagd en accepteer de standaardinstellingen.
4. Voer de volgende opdracht in om de app te maken klik op Enter:

   Install-Module Microsoft.Graph -Scope CurrentUser

5. Als u wordt gevraagd te installeren vanuit een niet-vertrouwde repository, voert u Y in klikt u op Enter.
6. Kopieer het volgende codeblok, plak het in PowerShell en klik op Enter.

   <#
   .SYNOPSIS
   Automates the creation of a Single-Tenant Entra ID App for Workspace Migration.
   Strictly forces account selection and verifies specific Admin roles.
   #>
   
   # Check if the module is missing
   if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
       Write-Host "Microsoft Graph module is NOT installed." -ForegroundColor Yellow
       $UserResponse = Read-Host "Would you like to try installing Microsoft Graph? (Y/N)"
   
       if ($UserResponse -ieq "Y") {
           try {
               # Use only native cmdlets, no .NET property setting
               Install-Module -Name Microsoft.Graph -Scope CurrentUser -Force -AllowClobber
               Write-Host "Installation complete!" -ForegroundColor Green
           }
           catch {
               Write-Error "Policy is blocking installation. Please contact IT to install Microsoft.Graph module."
               Read-Host "Press Enter to exit"; exit
           }
       }
       else {
           exit
       }
   } else {
       Write-Host "Microsoft Graph modules detected. Proceeding..." -ForegroundColor Green
   }
   
   # --- STEP 0: THE "DEEP" LOGOUT ---
   Write-Host "Forcing session cleanup..." -ForegroundColor Gray
   Disconnect-MgGraph -ErrorAction SilentlyContinue
   
   # Force clear the local token cache folder if it exists
   $CachePath = "$env:USERPROFILE\.mg"
   if (Test-Path $CachePath) {
       try { Remove-Item $CachePath -Recurse -Force -ErrorAction SilentlyContinue } catch {}
   }
   
   Write-Host "Opening Microsoft Login... (Please select the correct account)" -ForegroundColor Cyan
   
   $RequiredScopes = @(
       "Application.ReadWrite.All",
       "AppRoleAssignment.ReadWrite.All",
       "Directory.Read.All",
       "RoleManagement.Read.Directory"
   )
   
   try {
       # In v2, -ContextScope Process is the most reliable way to force account selection
       # and prevent the session from saving to the machine permanently.
       Connect-MgGraph -Scopes $RequiredScopes -ContextScope Process
   
       $Context = Get-MgContext
       if ($null -eq $Context) { throw "Login was cancelled or failed." }
   
       $UserPrincipal = $Context.Account
       Write-Host "Logged in as: $UserPrincipal" -ForegroundColor Green
   
       # --- ROLE VALIDATION ---
       Write-Host "Verifying Directory Roles..." -ForegroundColor Gray
       $UserRoles = Get-MgUserMemberOf -UserId $Context.Account -All | Where-Object { $_.AdditionalProperties.displayName -ne $null }
       
       $Authorized = $false
       $RequiredRoles = @("Global Administrator", "Privileged Role Administrator")
   
       foreach ($role in $UserRoles) {
           $roleName = $role.AdditionalProperties.displayName
           if ($roleName -in $RequiredRoles) {
               $Authorized = $true
               Write-Host "Access Granted: $roleName" -ForegroundColor Green
               break
           }
       }
   
       if (-not $Authorized) {
           Write-Host "`nCRITICAL ERROR: Insufficient Privileges." -ForegroundColor Red
           Write-Host "Account must be 'Global Administrator' or 'Privileged Role Administrator'." -ForegroundColor Yellow
           Disconnect-MgGraph
           Read-Host "`nPress Enter to exit"; exit
       }
   
   } catch {
       Write-Error "Login failed: $_"
       Read-Host "Press Enter to exit"; exit
   }
   
   # --- USER INPUT ---
   Write-Host "`n--- APPLICATION SETUP ---" -ForegroundColor Cyan
   $InputName = Read-Host "Enter the name for your new Entra ID Application (Default: Workspace Migration App)"
   $AppName = if ([string]::IsNullOrWhiteSpace($InputName)) { "Workspace Migration App" } else { $InputName }
   
   # --- CONFIGURATION ---
   # Updated Map containing all the requested application permissions
   $PermissionMap = @{
       "calendars.read"              = "Calendars.Read"
       "contacts.read"               = "Contacts.Read"
       "directory.read.all"          = "Directory.Read.All"
       "group-conversation.read.all" = "Group-Conversation.Read.All"
       "mail.read"                   = "Mail.Read"
       "mailboxfolder.read.all"      = "MailboxFolder.Read.All"
       "mailboxitem.export.all"      = "MailboxItem.Export.All"
       "mailboxitem.read.all"        = "MailboxItem.Read.All"
       "mailboxsettings.read"        = "MailboxSettings.Read"
       "tasks.read.all"              = "Tasks.Read.All"
       "user.read.all"               = "User.Read.All"
   }
   
   $TenantId = $Context.TenantId
   $GraphAppId = "00000003-0000-0000-c000-000000000000"
   
   try {
       # --- STEP 1: REGISTER APPLICATION ---
       Write-Host "Creating Application: $AppName..." -ForegroundColor Cyan
       $Application = New-MgApplication -BodyParameter @{
           displayName = $AppName
           signInAudience = "AzureADMyOrg"
       }
   
       # --- STEP 2: PREPARE SERVICE PRINCIPAL ---
       $NewServicePrincipal = New-MgServicePrincipal -BodyParameter @{ appId = $Application.AppId }
   
       Write-Host "Waiting 10 seconds for replication..." -ForegroundColor DarkGray
       Start-Sleep -Seconds 10
   
       # --- STEP 3: CONFIGURE & GRANT PERMISSIONS ---
       Write-Host "Configuring API Permissions & Granting Admin Consent..." -ForegroundColor Cyan
       $GraphSP = Get-MgServicePrincipal -Filter "AppId eq '$GraphAppId'" | Select-Object -First 1
   
       $ResourceAccessList = @()
   
       foreach ($key in $PermissionMap.Keys) {
           $RealRoleName = $PermissionMap[$key]
           $Role = $GraphSP.AppRoles | Where-Object { $_.Value -eq $RealRoleName }
   
           if ($Role) {
               $ResourceAccessList += @{ id = $Role.Id; type = "Role" }
   
               New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $NewServicePrincipal.Id -BodyParameter @{
                   principalId = $NewServicePrincipal.Id
                   resourceId  = $GraphSP.Id
                   appRoleId   = $Role.Id
               } | Out-Null
               Write-Host " - Granted: $RealRoleName" -ForegroundColor Gray
           }
       }
   
       Update-MgApplication -ApplicationId $Application.Id -RequiredResourceAccess @(@{
           resourceAppId  = $GraphAppId
           resourceAccess = $ResourceAccessList
       })
   
       # --- STEP 4: CREATE CLIENT SECRET ---
       Write-Host "Generating Client Secret..." -ForegroundColor Cyan
       $ExpiryDate = (Get-Date).AddYears(2).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
       $PasswordCred = Add-MgApplicationPassword -ApplicationId $Application.Id -BodyParameter @{
           passwordCredential = @{
               displayName = "MigrationToolSecret"
               endDateTime = $ExpiryDate
           }
       }
   
       # --- OUTPUT ---
       Write-Host "`n-------------------------------------------------------" -ForegroundColor Yellow
       Write-Host "        SETUP COMPLETE - SAVE THESE DETAILS" -ForegroundColor Yellow
       Write-Host "-------------------------------------------------------" -ForegroundColor Yellow
       Write-Host "Application Name        : $AppName"
       Write-Host "Application (Client) ID : $($Application.AppId)"
       Write-Host "Client Secret Value     : $($PasswordCred.SecretText)"
       Write-Host "Directory (Tenant) ID   : $TenantId"
       Write-Warning "IMPORTANT: Copy the Client Secret Value immediately."
   
   }
   catch {
       Write-Error "Operation failed: $_"
   }
   
   # --- FINAL DISCONNECT ---
   Disconnect-MgGraph
   Read-Host "`nPress Enter to close this window"
       

7. Noteer de volgende inloggegevens en sla ze beveiligd op. Als de inloggegevens uitlekken, hebben hackers misschien toegang tot al uw Exchange Online-gegevens.
   • Client-geheim
   • App-ID (client-ID)
   • Directory-ID (tenant-ID)

1. Maak in Windows een nieuw bestand met platte tekst en noem het migration_app_creator.ps1.
2. Kopieer het volgende codeblok, plak het in het nieuwe bestand en klik op Uitvoeren met Powershell.

<#
.SYNOPSIS
Automates the creation of a Single-Tenant Entra ID App for Workspace Migration.
Strictly forces account selection and verifies specific Admin roles.
#>

# Check if the module is missing
if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
    Write-Host "Microsoft Graph module is NOT installed." -ForegroundColor Yellow
    $UserResponse = Read-Host "Would you like to try installing Microsoft Graph? (Y/N)"

    if ($UserResponse -ieq "Y") {
        try {
            # Use only native cmdlets, no .NET property setting
            Install-Module -Name Microsoft.Graph -Scope CurrentUser -Force -AllowClobber
            Write-Host "Installation complete!" -ForegroundColor Green
        }
        catch {
            Write-Error "Policy is blocking installation. Please contact IT to install Microsoft.Graph module."
            Read-Host "Press Enter to exit"; exit
        }
    }
    else {
        exit
    }
} else {
    Write-Host "Microsoft Graph modules detected. Proceeding..." -ForegroundColor Green
}

# --- STEP 0: THE "DEEP" LOGOUT ---
Write-Host "Forcing session cleanup..." -ForegroundColor Gray
Disconnect-MgGraph -ErrorAction SilentlyContinue

# Force clear the local token cache folder if it exists
$CachePath = "$env:USERPROFILE\.mg"
if (Test-Path $CachePath) {
    try { Remove-Item $CachePath -Recurse -Force -ErrorAction SilentlyContinue } catch {}
}

Write-Host "Opening Microsoft Login... (Please select the correct account)" -ForegroundColor Cyan

$RequiredScopes = @(
    "Application.ReadWrite.All",
    "AppRoleAssignment.ReadWrite.All",
    "Directory.Read.All",
    "RoleManagement.Read.Directory"
)

try {
    # In v2, -ContextScope Process is the most reliable way to force account selection
    # and prevent the session from saving to the machine permanently.
    Connect-MgGraph -Scopes $RequiredScopes -ContextScope Process

    $Context = Get-MgContext
    if ($null -eq $Context) { throw "Login was cancelled or failed." }

    $UserPrincipal = $Context.Account
    Write-Host "Logged in as: $UserPrincipal" -ForegroundColor Green

    # --- ROLE VALIDATION ---
    Write-Host "Verifying Directory Roles..." -ForegroundColor Gray
    $UserRoles = Get-MgUserMemberOf -UserId $Context.Account -All | Where-Object { $_.AdditionalProperties.displayName -ne $null }

    $Authorized = $false
    $RequiredRoles = @("Global Administrator", "Privileged Role Administrator")

    foreach ($role in $UserRoles) {
        $roleName = $role.AdditionalProperties.displayName
        if ($roleName -in $RequiredRoles) {
            $Authorized = $true
            Write-Host "Access Granted: $roleName" -ForegroundColor Green
            break
        }
    }

    if (-not $Authorized) {
        Write-Host "`nCRITICAL ERROR: Insufficient Privileges." -ForegroundColor Red
        Write-Host "Account must be 'Global Administrator' or 'Privileged Role Administrator'." -ForegroundColor Yellow
        Disconnect-MgGraph
        Read-Host "`nPress Enter to exit"; exit
    }

} catch {
    Write-Error "Login failed: $_"
    Read-Host "Press Enter to exit"; exit
}

# --- USER INPUT ---
Write-Host "`n--- APPLICATION SETUP ---" -ForegroundColor Cyan
$InputName = Read-Host "Enter the name for your new Entra ID Application (Default: Workspace Migration App)"
$AppName = if ([string]::IsNullOrWhiteSpace($InputName)) { "Workspace Migration App" } else { $InputName }

# --- CONFIGURATION ---
# Updated Map containing all the requested application permissions
$PermissionMap = @{
    "calendars.read"              = "Calendars.Read"
    "contacts.read"               = "Contacts.Read"
    "directory.read.all"          = "Directory.Read.All"
    "group-conversation.read.all" = "Group-Conversation.Read.All"
    "mail.read"                   = "Mail.Read"
    "mailboxfolder.read.all"      = "MailboxFolder.Read.All"
    "mailboxitem.export.all"      = "MailboxItem.Export.All"
    "mailboxitem.read.all"        = "MailboxItem.Read.All"
    "mailboxsettings.read"        = "MailboxSettings.Read"
    "tasks.read.all"              = "Tasks.Read.All"
    "user.read.all"               = "User.Read.All"
}

$TenantId = $Context.TenantId
$GraphAppId = "00000003-0000-0000-c000-000000000000"

try {
    # --- STEP 1: REGISTER APPLICATION ---
    Write-Host "Creating Application: $AppName..." -ForegroundColor Cyan
    $Application = New-MgApplication -BodyParameter @{
        displayName = $AppName
        signInAudience = "AzureADMyOrg"
    }

    # --- STEP 2: PREPARE SERVICE PRINCIPAL ---
    $NewServicePrincipal = New-MgServicePrincipal -BodyParameter @{ appId = $Application.AppId }

    Write-Host "Waiting 10 seconds for replication..." -ForegroundColor DarkGray
    Start-Sleep -Seconds 10

    # --- STEP 3: CONFIGURE & GRANT PERMISSIONS ---
    Write-Host "Configuring API Permissions & Granting Admin Consent..." -ForegroundColor Cyan
    $GraphSP = Get-MgServicePrincipal -Filter "AppId eq '$GraphAppId'" | Select-Object -First 1

    $ResourceAccessList = @()

    foreach ($key in $PermissionMap.Keys) {
        $RealRoleName = $PermissionMap[$key]
        $Role = $GraphSP.AppRoles | Where-Object { $_.Value -eq $RealRoleName }

        if ($Role) {
            $ResourceAccessList += @{ id = $Role.Id; type = "Role" }

            New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $NewServicePrincipal.Id -BodyParameter @{
                principalId = $NewServicePrincipal.Id
                resourceId  = $GraphSP.Id
                appRoleId   = $Role.Id
            } | Out-Null
            Write-Host " - Granted: $RealRoleName" -ForegroundColor Gray
        }
    }

    Update-MgApplication -ApplicationId $Application.Id -RequiredResourceAccess @(@{
        resourceAppId  = $GraphAppId
        resourceAccess = $ResourceAccessList
    })

    # --- STEP 4: CREATE CLIENT SECRET ---
    Write-Host "Generating Client Secret..." -ForegroundColor Cyan
    $ExpiryDate = (Get-Date).AddYears(2).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
    $PasswordCred = Add-MgApplicationPassword -ApplicationId $Application.Id -BodyParameter @{
        passwordCredential = @{
            displayName = "MigrationToolSecret"
            endDateTime = $ExpiryDate
        }
    }

    # --- OUTPUT ---
    Write-Host "`n-------------------------------------------------------" -ForegroundColor Yellow
    Write-Host "        SETUP COMPLETE - SAVE THESE DETAILS" -ForegroundColor Yellow
    Write-Host "-------------------------------------------------------" -ForegroundColor Yellow
    Write-Host "Application Name        : $AppName"
    Write-Host "Application (Client) ID : $($Application.AppId)"
    Write-Host "Client Secret Value     : $($PasswordCred.SecretText)"
    Write-Host "Directory (Tenant) ID   : $TenantId"
    Write-Warning "IMPORTANT: Copy the Client Secret Value immediately."

}
catch {
    Write-Error "Operation failed: $_"
}

# --- FINAL DISCONNECT ---
Disconnect-MgGraph
Read-Host "`nPress Enter to close this window"

    

3. Noteer de volgende inloggegevens en sla ze beveiligd op. Als de inloggegevens uitlekken, hebben hackers misschien toegang tot al uw Exchange Online-gegevens.
   • Client-geheim
   • App-ID (client-ID)
   • Directory-ID (tenant-ID)

Om veiligheidsredenen raden we u aan de nieuwe app als één tenant te registreren.

1. Log als beheerder in bij de Azure-portal.
2. Ga in Azure Services naar App registrations (App-registraties).
3. Klik op New Registration (Nieuwe registratie) en voer een naam in voor uw app (bijvoorbeeld Geavanceerde import-app).
4. Klik bij Ondersteunde accounttypen op Alleen accounts in deze organisatiedirectory om een single-tenant-app te maken.
5. Klik op Registreren.

Kies een van de volgende opties:

Optie 1: Handmatig rechten toevoegen

1. Klik aan de zijkant bij Beheren op API-rechten.
2. Klik op Een recht toevoegen Microsoft API's Microsoft Graph.
3. Selecteer voor app-rechten het volgende:
   • Calendars.Read
   • Contacts.Read
   • Directory.Read.All
   • Group-Conversation.Read.All
   • Mail.Read
   • MailboxFolder.Read.All
   • MailboxItem.Export.All
   • MailboxItem.Read.All
   • MailboxSettings.Read
   • Tasks.Read.All
   • User.Read.All
4. Klik op Beheerderstoestemming verlenen voor uw organisatie.

Optie 2: Het app-manifest bewerken

1. Open het app-manifest.
2. Ga naar "resourceAccess" : [ ] en kies een optie:
   • Als “resourceAccess” : [ ] al een waarde heeft, voeg je een komma toe en plak je het volgende codeblok.
   • Als “resourceAccess” : [ ] geen waarde heeft, kopieer en plak je het volgende codeblok.

   { "id": "798ee544-9d2d-430c-a058-570e29e34338", "type": "Role" },

   { "id": "089fe4d0-434a-44c5-8827-41ba8a0b17f5", "type": "Role" },

   { "id": "7ab1d382-f21e-4acd-a863-ba3e13f7da61", "type": "Role" },

   { "id": "4f0a8235-6f6f-4ec7-9500-34b452a4a0c3", "type": "Role" },

   { "id": "810c84a8-4a9e-49e6-bf7d-12d183f40d01", "type": "Role" },

   { "id": "99280d24-a782-4793-93cc-0888549957f6", "type": "Role" },

   { "id": "937550e9-33a3-494b-88ae-d9cd394b1fbb", "type": "Role" },

   { "id": "7d9f353d-a7bd-4fbb-822a-26d5dd39a3ce", "type": "Role" },

   { "id": "40f97065-369a-49f4-947c-6a255697ae91", "type": "Role" },

   { "id": "f10e1f91-74ed-437f-a6fd-d6ae88e26c1f", "type": "Role" },

   { "id": "df021288-bdef-4463-88db-98f22de89214", "type": "Role" }

3. Klik op Beheerderstoestemming verlenen voor uw organisatie.

1. Klik aan de zijkant bij Beheren op Certificaten en geheimen Nieuw clientgeheim.
2. Voer een beschrijving in, selecteer een vervaldatum en klik op Toevoegen.
3. Kopieer de waarde van het clientgeheim en sla deze beveiligd op. De waarde wordt maar één keer getoond.

Belangrijk: Sla de inloggegevens voor de app veilig op. Als de inloggegevens uitlekken, hebben hackers misschien toegang tot al uw Exchange-gegevens.

Klik op Overzicht en noteer de volgende inloggegevens op een veilige plaats:

• App-ID (client-ID)
• Directory-ID (tenant-ID)