The connection: app-only, certificate, least-role
Connect-ExchangeOnline -CertificateThumbprint -AppId -Organization — no passwords, ever. The footnote that bites: EXO app-only historically wanted CSP-provider certs, not CNG (our VERIFY_FIRST history records the trap) — generate deliberately and TEST before trusting a pipeline. Role: the MINIMUM — a View-Only-style RBAC assignment for a read pipeline (RBAC concept); the constitution is enforceable AS configuration.
The read-only posture (the constitutional core)
serv365's runner is Get-* by allowlist — a compromised reporting job is incapable of change BY DESIGN. The pattern:
- Enumerate the verbs you use; allowlist Get-* + the specific safe others; refuse the rest — a supply-chain compromise can't Set/Remove.
- Persist every cmdlet run + outcome (command-execution audit) — 'what did it do' is a query forever, and the proof of the read-only claim.
- Honest gaps: RBAC-denied cmdlets RECORDED as 'not served', never silently skipped (the Purview app-only reality) — a quiet omission is worse than a flag.
Throttle-aware bulk
The -EXO high-volume cmdlets (Get-EXOMailbox — REST-backed, paged) for large reads; honour service-protection backoff; batch and pace. The runner reads 500+ config objects nightly without tripping throttles because it's polite, not privileged.
What to watch (proofs)
- Connection canary: Get-ConnectionInformation at start — auth mode, org, cert thumbprint; fail fast, named cause.
- The allowlist enforced: the runner rejecting a Set-* in test — the read-only constitution demonstrated (the proof a security team wants).
- Execution-audit completeness: every run's cmdlets + outcomes persisted — the 'prove it never wrote' evidence.
- Throttle health: backoff counts trending flat — polite at scale.