How to reset the Microsoft Service Principle if it has expired (Basic Authentication)

2 min read

When using MailStore to archive Microsoft Office365 and using basic authentication one important step is to create a Service Principle account using the Microsoft Azure PowerShell interface.

By default, this Service Principle account id is only valid for 365 days from the point of creation.

Once it expires any further MailStore Directory Service user synchronisations will fail with an error relating to expired API tokens like this:.

“MailStore Server was unable to retrieve a list of users from Directory Services. Requesting Microsoft Graph API token failed: AADSTS7000215: Invalid client secret is provided.”

To resolve this, the existing Service Principle (typically named MailStoreSP) will need to be removed and a new one created.

Steps:

  1. Open a PowerShell Session.
  2. Connect to the Office 365 Azure AD tenant using the command:

    Connect-MsolService -AzureEnvironment AzureCloud

    A login dialog opens. Enter admin credentials of your Microsoft Office365 plan.
  3. To get a list of all service principals that are created as the name MailStoreSP use the command:

    Get-MsolServicePrincipal -SearchString MailStoreSP

    Note you may have given this account a different name if you did not follow the existing setup guide, check MailStore Directory Services configuration for the exact account name

    This should return every Service Principle created with that name like this example:

    ExtensionData : System.Runtime.Serialization.ExtensionDataObject
    AccountEnabled : True
    Addresses : {}
    AppPrincipalId : 72c95713-a7e2-4170-9f91-ad9fe457ac1a
    DisplayName : MailStoreSP
    ObjectId : 39857919-9c7e-4e7e-9870-7ed650036d4b
    ServicePrincipalNames : {72c95713-a7e2-4170-9f91-ad9fe457ac1a, MailStoreSP}
    TrustedForDelegation : False

  4. It is the ObjectId value that we need to remove the existing account and this is done by running the following command:

    Remove-MsolServicePrincipal -ObjectId 39857919-9c7e-4e7e-9870-7ed650036d4b

    Replace with the correct ObjectId for your account
  5. Finally to create a new account with a 10 year expiry use these two commands:

    $principal = New-MsolServicePrincipal -DisplayName ‘MailStoreSP’ -ServicePrincipalNames @(“MailStoreSP”) -Type Password -Value ‘use_a_password_of_your_choice_here’ -StartDate (Get-Date) -EndDate (Get-Date).AddYears(10)

    Replace use_a_password_of_your_choice_here with the correct password

    Add-MsolRoleMember -RoleName “Directory Readers” -RoleMemberType ServicePrincipal -RoleMemberObjectId $principal.ObjectId