* using below script to create a Azure App.

## Define the client app name

$appName = ‘Exo_V2_App’

## Get the Office 365 Exchange Online API details.

$api = (Get-AzureADServicePrincipal -Filter “AppID eq ‘00000002-0000-0ff1-ce00-000000000000′”)

## Get the API permission ID

$permission = $api.AppRoles | Where-Object { $_.Value -eq ‘Exchange.ManageAsApp’ }

## Build the API permission object (TYPE: Role = Application, Scope = User)

$apiPermission = [Microsoft.Open.AzureAD.Model.RequiredResourceAccess]@{

    ResourceAppId  = $api.AppId ;

    ResourceAccess = [Microsoft.Open.AzureAD.Model.ResourceAccess]@{

        Id   = $permission.Id ;

        Type = “Role”

    }

}

## Register the new Azure AD App with API Permissions

$myApp = New-AzureADApplication -DisplayName $appName -ReplyUrls ‘http://localhost’ -RequiredResourceAccess $apiPermission

## Enable the Service Principal

$mySP = New-AzureADServicePrincipal -AppID $myApp.AppID

## Display the new app properties

$myApp | Format-List DisplayName,ObjectID,AppID

* above scripts adding Exchange.ManageAsApp as API permission.

* using role in Azure to add app to Exchange Admin role.

* copy down application client id.

* upload a ssl cert with public key (not private key) and add ssl cert with private key into user’s ssl store.

* use the following PS to auto sign into EXO.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 

Connect-ExchangeOnline -CertificateThumbPrint “95DFF4FAC027DECA8C53B076273C37bb3026951e” -AppID “18181a2c-aaf4-43cb-904d-6d067244fb17” -Organization “domain.onmicrosoft.com”