Adopt shared Connect-EXOAdvanced in remaining EXO callers (ValidateEXOPFDumpster.ps1, CrossTenantMailboxMigrationValidation.ps1)

Parent: #2590
Depends on: #2591

Two remaining root scripts have their own variants of the connect problem. ValidateEXOPFDumpster.ps1 is close-to-right; CrossTenantMailboxMigrationValidation.ps1 is the reference case for the -AllowMultipleSessions + -Prefix path.

PublicFolders/ValidateEXOPFDumpster.ps1

Status: 🟡 partial fix — uses -ErrorAction Stop (good), but no Import-Module check, no sovereign-cloud parameter.

Problem code — line 56:

Connect-ExchangeOnline -ErrorAction Stop

Target pseudocode:

. $PSScriptRoot\..\Shared\M365\EXOConnection.ps1

$exo = Connect-EXOAdvanced -AzureADAuthorizationEndpointUri $AzureADAuthorizationEndpointUri
if (-not $exo) { return }
try {
    # ...dumpster validation...
} finally {
    Disconnect-EXOAdvanced -Connection $exo
}

Also add a -AzureADAuthorizationEndpointUri script parameter so callers can pass it through.

Admin/CrossTenantMailboxMigrationValidation.ps1

Status: ❌ Two prefixed Connect-ExchangeOnline calls, no error handling, no import check.

Problem code — lines 150-172:

function ConnectToEXOTenants {
    Write-Verbose "Connecting to SOURCE EXO tenant"
    $wsh.Popup("...SOURCE tenant admin credentials", 0, "SOURCE tenant") | Out-Null
    Connect-ExchangeOnline -Prefix Source -ShowBanner:$false   # 🐛 no ErrorAction, no import check

    Write-Verbose "Connecting to TARGET EXO tenant"
    $wsh.Popup("...TARGET tenant admin credentials", 0, "TARGET tenant") | Out-Null
    Connect-ExchangeOnline -Prefix Target -ShowBanner:$false   # 🐛 no ErrorAction, no import check
}

If either connect silently fails, subsequent Get-SourceMailbox / Get-TargetMailUser returns nothing and validation results are meaningless.

Target pseudocode:

. $PSScriptRoot\..\Shared\M365\EXOConnection.ps1

function ConnectToEXOTenants {
    $wsh.Popup("...SOURCE tenant admin credentials", 0, "SOURCE tenant") | Out-Null
    $script:sourceExo = Connect-EXOAdvanced -AllowMultipleSessions -Prefix Source
    if (-not $script:sourceExo) { throw "Failed to connect to source tenant." }

    $wsh.Popup("...TARGET tenant admin credentials", 0, "TARGET tenant") | Out-Null
    $script:targetExo = Connect-EXOAdvanced -AllowMultipleSessions -Prefix Target
    if (-not $script:targetExo) { throw "Failed to connect to target tenant." }
}

At script end (or in try/finally):

if ($script:sourceExo) { Disconnect-EXOAdvanced -Connection $script:sourceExo }
if ($script:targetExo) { Disconnect-EXOAdvanced -Connection $script:targetExo }

Validation

• Pester tests for both scripts covering: connect success returns non-null; connect failure short-circuits execution; disconnect only called when connect succeeded; -AllowMultipleSessions used correctly for the Source/Target case.
• Lab test: one dumpster validation run, one cross-tenant validation run (source + target actually different tenants).

Start with Shared/M365/EXOConnection.ps1, then inspect PublicFolders/ValidateEXOPFDumpster.ps1 around line 56 and Admin/CrossTenantMailboxMigrationValidation.ps1 around lines 150-172. Run or add the Pester tests for both scripts, covering successful and failed connections, conditional disconnects, and the Source/Target multiple-session path. Done means both scripts use the shared connection flow and the documented lab validations pass.