Unable to connect to Exchange Online and Graph in same runbook

Won't be the first time they mess up things, see this article from Tony on a similar issue last year: https://office365itpros.com/2025/04/14/microsoft-graph-powershell-sdk-2261/

In a nutshell, the modules depend on additional binaries and this is not aligned between the different teams within Microsoft, causing conflicts when trying to load both modules. You might have to "mix and match" the module versions and the PowerShell host before you find a working solution.

In Azure Automation with a system-assigned managed identity, Exchange Online and Microsoft Graph can both be used in the same runbook, but each has specific requirements that must be satisfied inside the Automation account context.

Key points based on the documented pattern:

1. Ensure Exchange Online module is added correctly to the Automation account
   • In the Automation account, add the ExchangeOnlineManagement module from the gallery, not just as a dependency in code.
   • Use the documented pattern where the first command in the runbook is the Exchange Online connection:

          Connect-ExchangeOnline -ManagedIdentity -Organization domain.onmicrosoft.com
     

   • After connecting, a simple test such as:

          Get-AcceptedDomain | Format-Table Name
     

     confirms the module is loaded and the connection works in that Automation context.
2. Ensure Microsoft Graph SDK is installed and available in the Automation account
   • The Microsoft Graph PowerShell SDK (including Microsoft.Graph.Authentication) must be imported as modules into the Automation account, similar to how ExchangeOnlineManagement is added.
   • The error in Windows PowerShell 5.1:

          Connect-MgGraph : The 'Connect-MgGraph' command was found in the module 'Microsoft.Graph.Authentication', but the module could not be loaded.
     

     indicates the module is visible but not loadable in that runbook environment. This is typically resolved by importing the module into the Automation account from the gallery (not only relying on local development machine installs) and ensuring all dependencies are present.
3. Use the supported connection pattern for system-assigned managed identity
   • For Exchange Online in Automation:

          Connect-ExchangeOnline -ManagedIdentity -Organization domain.onmicrosoft.com
     

   • For Graph in the same runbook, use the managed identity pattern documented for Graph (the Automation account’s system-assigned identity must have the required Graph permissions and roles granted in Microsoft Entra ID). The Graph SDK itself is installed following the guidance in Install the Microsoft Graph PowerShell SDK referenced from the Exchange Online managed identity article.
4. Verify the managed identity has the correct roles and API permissions
   • For Exchange Online, the system-assigned managed identity must have:
     • The Exchange.ManageAsApp app role on the Office 365 Exchange Online service principal.
     • A supported Microsoft Entra role (for example, Exchange Administrator) assigned to the managed identity.
   • The documented steps use Microsoft Graph PowerShell to grant these:

          Connect-MgGraph -Scopes AppRoleAssignment.ReadWrite.All,Application.Read.All
          
          # Verify Office 365 Exchange Online service principal exists
          Get-MgServicePrincipal -Filter "AppId eq '00000002-0000-0ff1-ce00-000000000000'"
          
          # Assign Exchange.ManageAsApp to the managed identity (using $MI_ID, $AppRoleID, $ResourceID)
     

   • For role assignment (for example, Exchange Administrator) to the managed identity:

          Connect-MgGraph -Scopes RoleManagement.ReadWrite.Directory
          
          $RoleID = (Get-MgRoleManagementDirectoryRoleDefinition -Filter "DisplayName eq 'Exchange Administrator'").Id
          New-MgRoleManagementDirectoryRoleAssignment -PrincipalId $MI_ID -RoleDefinitionId $RoleID -DirectoryScopeId "/"
     

5. Runbook structure Once modules and permissions are correctly configured in the Automation account, a combined runbook can follow this pattern:

      # Exchange Online first
      Connect-ExchangeOnline -ManagedIdentity -Organization domain.onmicrosoft.com
      Get-Mailbox -ResultSize 1
      
      # Then Graph using the same system-assigned managed identity
      Connect-MgGraph -Identity
      Get-MgUser -Top 1
   

If either side fails:

• For Exchange Online errors like Unable to find type [Microsoft.Exchange.Management.RestApiClient.ExchangeEnvironment] in PowerShell 7.2 on an Azure VM, ensure the ExchangeOnlineManagement module is installed on that VM as per the documented instructions for Azure VMs with system-assigned managed identities.
• For Graph errors in Automation, re-import the Microsoft Graph modules into the Automation account from the gallery and confirm that the managed identity has the necessary Graph permissions.

References:

• Use Azure managed identities to connect to Exchange Online PowerShell
• Configure Exchange Online PowerShell for Automated Admin Tasks - Microsoft Q&A