Setup-SMTPGraphRelay.ps1 aktualisiert

Setup-SMTPGraphRelay.ps1

@@ -1,4 +1,4 @@
-#Requires -Version 5.1
+#Requires -Version 5.1
 #Requires -RunAsAdministrator
 <#
 .SYNOPSIS
@@ -901,14 +901,40 @@ function Install-New {
             }
 
             Write-Ok "Entra Service Principal erstellt: $($sp.Id)"
-            Test-NoGlobalMailSend -ServicePrincipalObjectId $sp.Id
             
-            Ensure-ExchangeRbac `
+            $useRbac = Confirm-Yes "Soll der E-Mail-Versand auf das Postfach '$senderMailbox' per Exchange RBAC begrenzt werden (Nein = Tenant-weiter Versand erlaubt)?"
-                -TenantId $tenantId `
+
-                -ClientId $app.AppId `
+            if ($useRbac) {
-                -ServicePrincipalObjectId $sp.Id `
+                Test-NoGlobalMailSend -ServicePrincipalObjectId $sp.Id
-                -AppName $appName `
+                Ensure-ExchangeRbac `
-                -SenderMailbox $senderMailbox
+                    -TenantId $tenantId `
+                    -ClientId $app.AppId `
+                    -ServicePrincipalObjectId $sp.Id `
+                    -AppName $appName `
+                    -SenderMailbox $senderMailbox
+            } else {
+                Write-Warn "Überspringe Exchange RBAC. Erteile stattdessen globale Mail.Send Berechtigung in Entra ID."
+                
+                $graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'" -Property "id,appRoles"
+                $mailSendRole = $graphSp.AppRoles | Where-Object { $_.Value -eq "Mail.Send" -and $_.AllowedMemberTypes -contains "Application" } | Select-Object -First 1
+
+                if (-not $mailSendRole) {
+                    throw "Microsoft Graph AppRole 'Mail.Send' konnte nicht gefunden werden."
+                }
+
+                $existingAssig = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All -ErrorAction SilentlyContinue | Where-Object { $_.AppRoleId -eq $mailSendRole.Id }
+                
+                if (-not $existingAssig) {
+                    New-MgServicePrincipalAppRoleAssignment `
+                        -ServicePrincipalId $sp.Id `
+                        -PrincipalId $sp.Id `
+                        -ResourceId $graphSp.Id `
+                        -AppRoleId $mailSendRole.Id | Out-Null
+                    Write-Ok "Globale 'Mail.Send' Application Role (ohne Einschränkung) erfolgreich vergeben."
+                } else {
+                    Write-Ok "Globale 'Mail.Send' Berechtigung war bereits vergeben."
+                }
+            }
 
             $config = [ordered]@{
                 Smtp = [ordered]@{
@@ -1319,32 +1345,42 @@ function Verify-CloudRbac {
         }
 
         Write-Ok "Entra Service Principal gefunden: $($sp.Id)"
-        Test-NoGlobalMailSend -ServicePrincipalObjectId $sp.Id
         
-        Import-Module ExchangeOnlineManagement -Force -ErrorAction Stop
+        $graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'" -Property "id,appRoles"
-        Write-Info "Exchange Online Anmeldung erforderlich (Admin)."
+        $mailSendRole = $graphSp.AppRoles | Where-Object { $_.Value -eq "Mail.Send" -and $_.AllowedMemberTypes -contains "Application" } | Select-Object -First 1
-        Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop
+        $globalAssig = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All -ErrorAction SilentlyContinue | Where-Object { $_.AppRoleId -eq $mailSendRole.Id }
 
-        try {
+        if ($globalAssig) {
-            $auth = Test-ServicePrincipalAuthorization `
+            Write-Warn "App besitzt GLOBALE (tenant-weite) Microsoft Graph Mail.Send Berechtigung in Entra ID."
-                -Identity $sp.Id `
+            Write-Info "Eine Exchange RBAC Prüfung wird übersprungen, da die App ohnehin im Namen aller Postfächer senden darf."
-                -Resource $config.Graph.SenderMailbox
+        } else {
+            Write-Ok "Keine globale Entra ID Berechtigung. Prüfe Exchange Application RBAC Einschränkung..."
             
-            $role = $auth | Where-Object { $_.RoleName -eq "Application Mail.Send" } | Select-Object -First 1
+            Import-Module ExchangeOnlineManagement -Force -ErrorAction Stop
+            Write-Info "Exchange Online Anmeldung erforderlich (Admin)."
+            Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop
 
-            if ($role -and $role.InScope) {
+            try {
-                Write-Ok "Exchange Application Mail.Send: SenderMailbox ist InScope."
+                $auth = Test-ServicePrincipalAuthorization `
-                if ($role.AllowedResourceScope) {
+                    -Identity $sp.Id `
-                    Write-Info "AllowedResourceScope: $($role.AllowedResourceScope)"
+                    -Resource $config.Graph.SenderMailbox
+
+                $role = $auth | Where-Object { $_.RoleName -eq "Application Mail.Send" } | Select-Object -First 1
+
+                if ($role -and $role.InScope) {
+                    Write-Ok "Exchange Application Mail.Send: SenderMailbox ist InScope."
+                    if ($role.AllowedResourceScope) {
+                        Write-Info "AllowedResourceScope: $($role.AllowedResourceScope)"
+                    }
+                }
+                else {
+                    Write-Fail "Exchange Application Mail.Send fehlt oder SenderMailbox ist nicht InScope."
                 }
             }
-            else {
+            finally {
-                Write-Fail "Exchange Application Mail.Send fehlt oder SenderMailbox ist nicht InScope."
+                Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
             }
         }
-        finally {
-            Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
-        }
     }
     finally {
         Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null