O365 Powershell 供客户使用

Question

I am currently using O365 Graph API to create services for customers and realized that some of the capabilities that customers need, ie creating transport rules or accessing quarantined email information, are only available through PowerShell.

Can a vendor create transport rules or execute PowerShell commands for their customers? Similar to how vendors register their Azure AD application and request permissions, is there a way to run PowerShell command for customers by a vendor?

Documentation is not really helpful on this front.

Answer 1

When using Graph, I don't think you can, but if you want to do it with Powershell, if you're a Microsoft Partner, and have configured yourself as an advisor (delegated access permissions) for your clients (invite them to add you, or add yourself if you have their consent and global admin access to their tenancy).

Adding a partner to a tenant:

https://docs.microsoft.com/en-us/partner-center/customers_revoke_admin_privileges

See a bit of additional info here:

https://docs.microsoft.com/en-us/office365/enterprise/powershell/manage-office-365-tenants-with-windows-powershell-for-delegated-access-permissio

When running Powershell commands, you'll need to refer to the TenantID when running a command on the client's tenancy (rather than your own).

A simple example of this might be:

Get a list of TenantIDs:

Get-MsolPartnerContract -All | Select-Object TenantId

Get a list of mailboxes for one of the TenantIds listed above:

Get-Mailbox -TenantID "asddfsdfadfg-dsfgsdfg-sdfgsdfg-dsfgsdfg"

This relies on you having logged into the Powershell session with a user that has administrative 'Partner' permissions in your partner tenancy.

Hopefully that helps somewhat!