Konfiguration der modernen Authentifizierung

				# Neue Anwendungsgruppe erstellen
New-AdfsApplicationGroup -Name 'Outlook' -ApplicationGroupIdentifier 'Outlook' -Disabled:$false

# Bereiche erstellen
Add-AdfsScopeDescription -Name 'EAS.AccessAsUser.All' -Description 'EAS-Bereich'
Add-AdfsScopeDescription -Name 'EWS.AccessAsUser.All' -Description 'EWS-Bereich'
Add-AdfsScopeDescription -Name 'offline_access' -Description 'Offline-Zugriff'

# Anwendung erstellen - Outlook Desktop
Add-AdfsNativeClientApplication -Name 'Outlook Desktop' -ApplicationGroupIdentifier 'Outlook' -Identifier 'd3590ed6-52b3-4102-aeff-aad2292ab01c' -RedirectUri @('ms-appx-web://Microsoft.AAD.BrokerPlugin/d3590ed6-52b3-4102-aeff-aad2292ab01c','msauth.com.microsoft.Outlook://auth','urn:ietf:wg:oauth:2.0:oob')

# (Optional) Anwendung erstellen - iOS Mail App
Add-AdfsNativeClientApplication -Name 'iOS/macOS - Mail-App' -ApplicationGroupIdentifier 'Outlook' -Identifier 'f8d98a96-0999-43f5-8af3-69971c7bb423' -RedirectUri @('com.apple.mobilemail://oauth-redirect','com.apple.preferences.internetaccounts://oauth-redirect/','com.apple.Preferences://oauth-redirect/')

# URLs definieren - hier die URL(s) eintragen, die für den Zugriff auf Exchange und Autodiscover verwendet werden
$EXSServiceFQDNs = @('https://autodiscover.microwsoft.de/','https://mail.microwsoft.de/')

# Transformations-Regeln erstellen
$issuanceTransformRules = @'
@RuleName = 'ActiveDirectoryUserSID'
c:[Type == 'http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid']
 => issue(claim = c);

@RuleName = 'ActiveDirectoryUPN'
c:[Type == 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn']
 => issue(claim = c);

@RuleName = 'AppIDACR'
 => issue(Type = 'appidacr', Value = '2');

@RuleName = 'SCP'
 => issue(Type = 'scp', Value = 'user_impersonation');

@RuleName = 'SCPEAS'
 => issue(Type = 'scp', Value = 'EAS.AccessAsUser.All');

@RuleName = 'SCPEWS'
 => issue(Type = 'scp', Value = 'EWS.AccessAsUser.All');

@RuleName = 'offlineaccess'
 => issue(Type = 'scp', Value = 'offline_access');
'@

# Web API-Anwendungen erstellen
foreach ($FQDN in $EXSServiceFQDNs) 
   {
   Add-AdfsWebApiApplication -Name 'Outlook - Web-API ($((New-Guid).ToString('N')))' -ApplicationGroupIdentifier 'Outlook' -Identifier $fqdn -IssuanceTransformRules $issuanceTransformRules -AccessControlPolicyName 'Permit Everyone'
   }

# Clientberechtigungen in Web API-Anwendungen hinzufügen
$clientRoleIdentifier = @('f8d98a96-0999-43f5-8af3-69971c7bb423','d3590ed6-52b3-4102-aeff-aad2292ab01c')
(Get-AdfsWebApiApplication -ApplicationGroupIdentifier 'Outlook') | ForEach-Object {
    [string]$serverRoleIdentifier = $_.Identifier
    foreach ($id in $clientRoleIdentifier) {
        Grant-AdfsApplicationPermission -ClientRoleIdentifier $id -ServerRoleIdentifier $serverRoleIdentifier -ScopeNames 'winhello_cert','email','profile','vpn_cert','logon_cert','user_impersonation','allatclaims','offline_access','EAS.AccessAsUser.All','EWS.AccessAsUser.All','openid','aza'
    }
}