Using PowerShell to Create a New Service Principal

Technical Articles

Solution

Application

Content Type

Technical Documentation

Utilities & Services

ft:locale

en-US

For instructions on how to configure the SMTP server settings in the Jamf Pro interface, see SMTP Server Integration in the Jamf Pro Documentation.

Open PowerShell.
Run the following command to import the ExchangeOnlineManagement module:
```
Import-module ExchangeOnlineManagement
```
Note:
If PowerShell returns a "module not found" error, you may need to install the module before continuing. See the following Microsoft documentation for more information: About the Exchange Online PowerShell module
Run a command to define the variables to be used by PowerShell. Complete the commands with the variables you collected in the Creating an App Registration in Microsoft Entra for Jamf Pro and Configuring Permissions in Exchange Admin Center sections of this article.
- After $Tenant, enter the tenant ID.
- After $ClientId=, enter the client ID.
- After $ServicePrincipal=, enter the service principal object ID.
- After $EmailGroupId=, enter the email address you want emails to be sent from.
```
$Tenant='0344bcc1-e70b-4ff4-0000-922cb9a226a7';
$ClientId='a8fc014b-3a7c-495e-8998-b945b225d4ff';
$ServicePrincipal='f2cddd66-67f6-42fb-9827-fec98920984a'; 
$EmailGroupId='jamfpro@example.com'; 

                        
```
Run the following command to connect PowerShell to Exchange Online. When prompted, enter the credentials of an Exchange account with Organization Management credentials.
```
Connect-ExchangeOnline -Organization $Tenant 
```
Run the following command to enable Organization Customization:
```
Enable-OrganizationCustomization 
```
Note:
In order to perform the steps in this section, the Enable-OrganizationCustomization setting must be enabled in the tenant. To verify, execute the following command:
Get-OrganizationConfig | fl Identity, IsDehydrated
If PowerShell returns a value of False, the tenant is correctly configured. Proceed with the steps in this section.
If PowerShell returns a value of True, execute the following command before proceeding:
Enable-OrganizationCustomization

Run the following command to create a new service principal:

 New-ServicePrincipal -AppId $ClientId -ObjectId $ServicePrincipal -DisplayName "Service Principal"

Run the following command to create a role to send mail for mail-enabled security groups:

New-ManagementRoleAssignment -App $ClientId -Role "Application Mail.Send" -RecipientGroupScope $EmailGroupId