Setup-SMTPGraphRelay.ps1 aktualisiert

Setup-SMTPGraphRelay.ps1

@@ -1,4 +1,4 @@
-#Requires -Version 5.1
+#Requires -Version 5.1
 #Requires -RunAsAdministrator
 <#
 .SYNOPSIS
@@ -901,14 +901,40 @@ function Install-New {
             }
 
             Write-Ok "Entra Service Principal erstellt: $($sp.Id)"
-            Test-NoGlobalMailSend -ServicePrincipalObjectId $sp.Id
             
+            $useRbac = Confirm-Yes "Soll der E-Mail-Versand auf das Postfach '$senderMailbox' per Exchange RBAC begrenzt werden (Nein = Tenant-weiter Versand erlaubt)?"
+
+            if ($useRbac) {
+                Test-NoGlobalMailSend -ServicePrincipalObjectId $sp.Id
                 Ensure-ExchangeRbac `
                     -TenantId $tenantId `
                     -ClientId $app.AppId `
                     -ServicePrincipalObjectId $sp.Id `
                     -AppName $appName `
                     -SenderMailbox $senderMailbox
+            } else {
+                Write-Warn "Überspringe Exchange RBAC. Erteile stattdessen globale Mail.Send Berechtigung in Entra ID."
+                
+                $graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'" -Property "id,appRoles"
+                $mailSendRole = $graphSp.AppRoles | Where-Object { $_.Value -eq "Mail.Send" -and $_.AllowedMemberTypes -contains "Application" } | Select-Object -First 1
+
+                if (-not $mailSendRole) {
+                    throw "Microsoft Graph AppRole 'Mail.Send' konnte nicht gefunden werden."
+                }
+
+                $existingAssig = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All -ErrorAction SilentlyContinue | Where-Object { $_.AppRoleId -eq $mailSendRole.Id }
+                
+                if (-not $existingAssig) {
+                    New-MgServicePrincipalAppRoleAssignment `
+                        -ServicePrincipalId $sp.Id `
+                        -PrincipalId $sp.Id `
+                        -ResourceId $graphSp.Id `
+                        -AppRoleId $mailSendRole.Id | Out-Null
+                    Write-Ok "Globale 'Mail.Send' Application Role (ohne Einschränkung) erfolgreich vergeben."
+                } else {
+                    Write-Ok "Globale 'Mail.Send' Berechtigung war bereits vergeben."
+                }
+            }
 
             $config = [ordered]@{
                 Smtp = [ordered]@{
@@ -1319,7 +1345,16 @@ function Verify-CloudRbac {
         }
 
         Write-Ok "Entra Service Principal gefunden: $($sp.Id)"
-        Test-NoGlobalMailSend -ServicePrincipalObjectId $sp.Id
+        
+        $graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'" -Property "id,appRoles"
+        $mailSendRole = $graphSp.AppRoles | Where-Object { $_.Value -eq "Mail.Send" -and $_.AllowedMemberTypes -contains "Application" } | Select-Object -First 1
+        $globalAssig = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All -ErrorAction SilentlyContinue | Where-Object { $_.AppRoleId -eq $mailSendRole.Id }
+
+        if ($globalAssig) {
+            Write-Warn "App besitzt GLOBALE (tenant-weite) Microsoft Graph Mail.Send Berechtigung in Entra ID."
+            Write-Info "Eine Exchange RBAC Prüfung wird übersprungen, da die App ohnehin im Namen aller Postfächer senden darf."
+        } else {
+            Write-Ok "Keine globale Entra ID Berechtigung. Prüfe Exchange Application RBAC Einschränkung..."
             
             Import-Module ExchangeOnlineManagement -Force -ErrorAction Stop
             Write-Info "Exchange Online Anmeldung erforderlich (Admin)."
@@ -1346,6 +1381,7 @@ function Verify-CloudRbac {
                 Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
             }
         }
+    }
     finally {
         Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
     }