Configure OAuth2 Client Credentials Flow (SMTP.SendAsApp) for SMTP AUTH in Exchange Online Using PowerShell

# 1. Connect to Microsoft Graph & Exchange Online
Connect-MgGraph -Scopes "Application.Read.All" -NoWelcome
Connect-ExchangeOnline -ShowBanner:$false

# 2. Fetch the Enterprise Application (Service Principal) details via Microsoft Graph
$AppDisplayName = "LAB365-SMTP-Relay"
$EntraSp = Get-MgServicePrincipal -Filter "displayName eq '$AppDisplayName'"

if (-not $EntraSp) {
    throw "Service Principal '$AppDisplayName' not found in Entra ID!"
}

Write-Host "Found Service Principal -> AppId: $($EntraSp.AppId) | Enterprise App ObjectId: $($EntraSp.Id)" -ForegroundColor Cyan

# 3. Register the Service Principal inside Exchange Online
New-ServicePrincipal -AppId $EntraSp.AppId `
    -ObjectId $EntraSp.Id `
    -DisplayName $EntraSp.DisplayName

# 4. Grant FullAccess permission on the sender mailbox to the Service Principal
$SenderMailbox = "[email protected]"
Add-MailboxPermission -Identity $SenderMailbox `
    -User $EntraSp.Id `
    -AccessRights FullAccess

# 5. Ensure Authenticated SMTP (SmtpClientAuthenticationDisabled) is enabled on the sender mailbox
Set-CASMailbox -Identity $SenderMailbox -SmtpClientAuthenticationDisabled:$false

function Send-ExoMailMessageOAuth2 {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [string]$TenantId,

        [Parameter(Mandatory = $true)]
        [string]$ClientId,

        [Parameter(Mandatory = $true)]
        [string]$ClientSecret,

        [Parameter(Mandatory = $true)]
        [string]$From,

        [Parameter(Mandatory = $true)]
        [string]$To,

        [Parameter(Mandatory = $true)]
        [string]$Subject,

        [Parameter(Mandatory = $true)]
        [string]$Body
    )

    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

    # 1. Request OAuth 2.0 Access Token for Exchange Online
    $TokenUri = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"
    $TokenBody = @{
        client_id     = $ClientId
        client_secret = $ClientSecret
        scope         = "https://outlook.office365.com/.default"
        grant_type    = "client_credentials"
    }

    $TokenResponse = Invoke-RestMethod -Method Post -Uri $TokenUri -Body $TokenBody -ContentType "application/x-www-form-urlencoded"
    $AccessToken   = $TokenResponse.access_token

    # 2. Verify JWT Token Contains 'SMTP.SendAsApp' Role Claim
    $PayloadPart = $AccessToken.Split('.')[1].Replace('', '+').Replace('_', '/')
    while ($PayloadPart.Length % 4 -ne 0) { $PayloadPart += "=" }
    $JwtClaims = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($PayloadPart)) | ConvertFrom-Json

    if ($JwtClaims.roles -notcontains "SMTP.SendAsApp") {
        throw "Access token does NOT contain 'SMTP.SendAsApp' in roles claim! Current roles: $($JwtClaims.roles -join ', ')"
    }
    Write-Host "[+] Verified JWT Role Claim: SMTP.SendAsApp (Token Audience: $($JwtClaims.aud))" -ForegroundColor Green

    # 3. Build SASL XOAUTH2 String: "user=" + User + "^Aauth=Bearer " + Token + "^A^A"
    $CtrlA = [char]1
    $XOAuth2Raw = "user=$From${CtrlA}auth=Bearer $AccessToken${CtrlA}${CtrlA}"
    $XOAuth2B64 = [Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($XOAuth2Raw))

    # 4. Connect to smtp.office365.com:587, Upgrade to STARTTLS, & Authenticate via XOAUTH2
    $TcpClient = New-Object System.Net.Sockets.TcpClient("smtp.office365.com", 587)
    $NetStream = $TcpClient.GetStream()
    $Reader    = New-Object System.IO.StreamReader($NetStream)
    $Writer    = New-Object System.IO.StreamWriter($NetStream)
    $Writer.AutoFlush = $true

    Write-Host "[*] Server Banner: $($Reader.ReadLine())" -ForegroundColor DarkGray
    $Writer.WriteLine("EHLO lab365.in")
    while (($Line = $Reader.ReadLine()) -and $Line.Substring(3, 1) -eq "-") {}

    $Writer.WriteLine("STARTTLS")
    $StartTlsResp = $Reader.ReadLine()
    if (-not $StartTlsResp.StartsWith("220")) {
        throw "Failed to initiate STARTTLS: $StartTlsResp"
    }

    $SslStream = New-Object System.Net.Security.SslStream($NetStream, $false)
    $SslStream.AuthenticateAsClient("smtp.office365.com")
    $SslReader = New-Object System.IO.StreamReader($SslStream)
    $SslWriter = New-Object System.IO.StreamWriter($SslStream)
    $SslWriter.AutoFlush = $true

    $SslWriter.WriteLine("EHLO lab365.in")
    while (($Line = $SslReader.ReadLine()) -and $Line.Substring(3, 1) -eq "-") {}

    $SslWriter.WriteLine("AUTH XOAUTH2 $XOAuth2B64")
    $AuthResp = $SslReader.ReadLine()
    if (-not $AuthResp.StartsWith("235")) {
        throw "SMTP XOAUTH2 Authentication Failed: $AuthResp"
    }
    Write-Host "[+] SMTP Authentication Successful: $AuthResp" -ForegroundColor Green

    # 5. Transmit Message
    $SslWriter.WriteLine("MAIL FROM:<$From>")
    [void]$SslReader.ReadLine()
    $SslWriter.WriteLine("RCPT TO:<$To>")
    [void]$SslReader.ReadLine()
    $SslWriter.WriteLine("DATA")
    [void]$SslReader.ReadLine()

    $SslWriter.WriteLine("From: $From")
    $SslWriter.WriteLine("To: $To")
    $SslWriter.WriteLine("Subject: $Subject")
    $SslWriter.WriteLine("Content-Type: text/html; charset=utf-8")
    $SslWriter.WriteLine("")
    $SslWriter.WriteLine($Body)
    $SslWriter.WriteLine(".")

    $DataResp = $SslReader.ReadLine()
    Write-Host "[+] Message Sent: $DataResp" -ForegroundColor Green

    $SslWriter.WriteLine("QUIT")
    $TcpClient.Close()
}

# Example Usage:
# Send-ExoMailMessageOAuth2 `
#     -TenantId "ab85c7a1-366d-44ba-acc6-924fa0950045" `
#     -ClientId "c841ae33-4093-4385-8a90-6a530761f9b9" `
#     -ClientSecret "YOUR_CLIENT_SECRET" `
#     -From "[email protected]" `
#     -To "[email protected]" `
#     -Subject "Test OAuth2 SMTP.SendAsApp Relay" `
#     -Body "<h3>Sent via Exchange Online SMTP OAuth 2.0 Client Credentials Flow</h3>"