MAIEREDV/SMTPGraphRelay
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Setup-SMTPGraphRelay.ps1 aktualisiert

Browse Source
This commit is contained in:
manuel.maier
2026-08-18 14:42:39 +02:00
parent 70afda86bf
commit 48a8f39990
1 changed files with 63 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Setup-SMTPGraphRelay.ps1
+39 -3
View File
@@ -1,4 +1,4 @@
#Requires -Version 5.1
#Requires -Version 5.1
#Requires -RunAsAdministrator
<#
.SYNOPSIS
@@ -901,14 +901,40 @@ function Install-New {
}
Write-Ok "Entra Service Principal erstellt: $($sp.Id)"
Test-NoGlobalMailSend -ServicePrincipalObjectId $sp.Id
$useRbac = Confirm-Yes "Soll der E-Mail-Versand auf das Postfach '$senderMailbox' per Exchange RBAC begrenzt werden (Nein = Tenant-weiter Versand erlaubt)?"
if ($useRbac) {
Test-NoGlobalMailSend -ServicePrincipalObjectId $sp.Id
Ensure-ExchangeRbac `
-TenantId $tenantId `
-ClientId $app.AppId `
-ServicePrincipalObjectId $sp.Id `
-AppName $appName `
-SenderMailbox $senderMailbox
} else {
Write-Warn "Überspringe Exchange RBAC. Erteile stattdessen globale Mail.Send Berechtigung in Entra ID."
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'" -Property "id,appRoles"
$mailSendRole = $graphSp.AppRoles | Where-Object { $_.Value -eq "Mail.Send" -and $_.AllowedMemberTypes -contains "Application" } | Select-Object -First 1
if (-not $mailSendRole) {
throw "Microsoft Graph AppRole 'Mail.Send' konnte nicht gefunden werden."
}
$existingAssig = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All -ErrorAction SilentlyContinue | Where-Object { $_.AppRoleId -eq $mailSendRole.Id }
if (-not $existingAssig) {
New-MgServicePrincipalAppRoleAssignment `
-ServicePrincipalId $sp.Id `
-PrincipalId $sp.Id `
-ResourceId $graphSp.Id `
-AppRoleId $mailSendRole.Id | Out-Null
Write-Ok "Globale 'Mail.Send' Application Role (ohne Einschränkung) erfolgreich vergeben."
} else {
Write-Ok "Globale 'Mail.Send' Berechtigung war bereits vergeben."
}
}
$config = [ordered]@{
Smtp = [ordered]@{
@@ -1319,7 +1345,16 @@ function Verify-CloudRbac {
}
Write-Ok "Entra Service Principal gefunden: $($sp.Id)"
Test-NoGlobalMailSend -ServicePrincipalObjectId $sp.Id
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'" -Property "id,appRoles"
$mailSendRole = $graphSp.AppRoles | Where-Object { $_.Value -eq "Mail.Send" -and $_.AllowedMemberTypes -contains "Application" } | Select-Object -First 1
$globalAssig = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All -ErrorAction SilentlyContinue | Where-Object { $_.AppRoleId -eq $mailSendRole.Id }
if ($globalAssig) {
Write-Warn "App besitzt GLOBALE (tenant-weite) Microsoft Graph Mail.Send Berechtigung in Entra ID."
Write-Info "Eine Exchange RBAC Prüfung wird übersprungen, da die App ohnehin im Namen aller Postfächer senden darf."
} else {
Write-Ok "Keine globale Entra ID Berechtigung. Prüfe Exchange Application RBAC Einschränkung..."
Import-Module ExchangeOnlineManagement -Force -ErrorAction Stop
Write-Info "Exchange Online Anmeldung erforderlich (Admin)."
@@ -1346,6 +1381,7 @@ function Verify-CloudRbac {
Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
}
}
}
finally {
Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}