Exchange Online中PowerShell启用禁用审核邮箱遇403 Forbidden错误

问题场景 #

已在Azure AD注册应用并授予权限，使用PowerShell调用Microsoft Graph API时，https://graph.microsoft.com/v1.0/users接口可正常返回用户列表，但遍历调用/users/{id}/mailboxSettings查询邮箱审核状态时，返回403 Forbidden错误。

使用的脚本：

# API endpoint to fetch mailboxes
$mailboxes = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users" -Headers @{Authorization = "Bearer $AccessToken"} -Method Get

# Filter mailboxes with auditing disabled
foreach ($mailbox in $mailboxes.value) {
    # Check if auditing is disabled

    $auditStatus = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/$($mailbox.id)/mailboxSettings" -Headers @{Authorization = "Bearer $AccessToken"} -Method Get
    }
    if ($auditStatus.AuditEnabled -eq $true) {
        # Enable auditing
        Write-Host "every mailbox is enabled"
        #Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/$($mailbox.id)/mailboxSettings" -Headers @{Authorization = "Bearer $AccessToken"} -Method Patch -Body (@{AuditEnabled = $true} | ConvertTo-Json -Depth 10)

        # Log the action
        #"$($mailbox.mail),$false,Enabled Auditing" | Out-File -FilePath $logFilePath -Append
    }
}

报错信息：

Invoke-RestMethod : The remote server returned an error: (403) Forbidden.
At line:1 char:16
+ ... ditStatus = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/ ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

核心原因分析 #

1. 权限不匹配：/users接口仅需User.Read.All应用权限即可访问，但/users/{id}/mailboxSettings接口需要单独的权限：
   • 查询审核状态：需要MailboxSettings.Read应用权限
   • 修改审核状态：需要MailboxSettings.ReadWrite应用权限
     若Azure应用未添加上述权限，或未完成管理员同意授权，则会返回403错误。
2. 脚本语法错误：原脚本中foreach循环的闭合括号位置错误，导致if语句脱离循环范围，即使权限正常也会引发逻辑问题。

解决步骤 #

1. 补充并确认Azure应用权限 #

• 登录Azure门户，进入应用注册 -> 目标应用 -> API权限
• 添加以下应用权限（注意选择「应用权限」而非「委派权限」）：
  • Microsoft Graph -> MailboxSettings.Read（用于查询审核状态）
  • Microsoft Graph -> MailboxSettings.ReadWrite（用于启用审核）
• 点击授予管理员同意，确保权限生效（若刚添加权限，可能需要等待10-30分钟）

2. 修正脚本语法与逻辑 #

修正循环闭合错误，添加错误处理，确保逻辑正确：

# API endpoint to fetch mailboxes
$mailboxes = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users" -Headers @{Authorization = "Bearer $AccessToken"} -Method Get
$logFilePath = ".\audit-enable-log.csv"

# 初始化日志文件（可选）
if (-not (Test-Path $logFilePath)) {
    "Mailbox,PreviousAuditStatus,Action" | Out-File -FilePath $logFilePath -Encoding utf8
}

# Filter mailboxes with auditing disabled
foreach ($mailbox in $mailboxes.value) {
    try {
        # Check if auditing is disabled
        $auditStatus = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/$($mailbox.id)/mailboxSettings" -Headers @{Authorization = "Bearer $AccessToken"} -Method Get -ErrorAction Stop

        if (-not $auditStatus.AuditEnabled) {
            # Enable auditing
            $patchBody = @{AuditEnabled = $true} | ConvertTo-Json -Depth 10
            Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/$($mailbox.id)/mailboxSettings" -Headers @{Authorization = "Bearer $AccessToken"; "Content-Type" = "application/json"} -Method Patch -Body $patchBody -ErrorAction Stop
            
            Write-Host "已启用邮箱 $($mailbox.mail) 的审核功能"
            # Log the action
            "$($mailbox.mail),$false,Enabled Auditing" | Out-File -FilePath $logFilePath -Append -Encoding utf8
        } else {
            Write-Host "邮箱 $($mailbox.mail) 的审核功能已启用"
            "$($mailbox.mail),$true,No Action Needed" | Out-File -FilePath $logFilePath -Append -Encoding utf8
        }
    } catch {
        Write-Host "处理邮箱 $($mailbox.mail) 时出错: $($_.Exception.Message)"
        "$($mailbox.mail),N/A,Error: $($_.Exception.Message)" | Out-File -FilePath $logFilePath -Append -Encoding utf8
    }
}

3. 验证权限生效 #

重新获取AccessToken（确保使用更新后的权限范围），运行修正后的脚本，确认不再返回403错误。

内容的提问来源于stack exchange，提问作者Abivanth