PowerShell in Exchange Online

Exchange Online is a SaaS (Software as a Service) cloud service within the Microsoft 365 platform. It offers users the functionality of an Exchange mail server. It is currently one of the most popular cloud services. As with many other Microsoft solutions, Exchange Online offers the option of using PowerShell. In the following text, you will learn the basics of navigating Exchange Online using commands. We will also discuss simple, sample scripts that can be used in a production environment.

Connecting to Exchange Online using PowerShell

Before you begin, you'll need to install and import the appropriate PowerShell module and enable script execution on your system.

To enable script execution:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

 For Exchange Online, you can install the module using the command:

Install-Module -Name ExchangeOnlineManagement

Then import the ExchangeOnlineManagement module:

Import-Module ExchangeOnlineManagement

Connect to Exchange:

Connect-ExchangeOnline

A message will appear asking you to log in using the credentials of the account you'll be using (usually an account with administrator privileges).

If your account is secured with MFA, you'll also need to verify it with a second authentication method. In this case, it's your phone number:

Once you successfully authenticate your account, you'll be connected to the Exchange cloud.

More information about connecting to Exchange Online:

https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps

Required Permissions

To connect to Exchange Online, the user we'll use must have the "RemotePowerShellEnabled" parameter set to true. You can check the contents of this parameter for a specific user with the "Get-User" command. You can also set it to false or true. This will allow or deny the user access to PowerShell.

#Check the RemotePowershellEnabled value for user user@contoso.com Get-User user@contoso.com | Select Name, RemotePowerShellEnabled #Set the RemotePowershellEnabled value to true – allowing the user to use PowerShell Set-User user@contoso.com -RemotePowerShellEnabled $true #Set the RemotePowershellEnabled value to false – prohibiting the user from using PowerShell Set-User user@contoso.com -RemotePowerShellEnabled $false

By default, every user is set to true – they can connect using the "Connect-ExchangeOnline" command. For security reasons, you can block this, but it's not necessary, as commands are limited by the account's role. You can check the roles and their capabilities in the Microsoft 365 admin panel. All commands and scripts included in this article were tested with an account assigned the Global Administrator role, which grants access to almost all commands.

Get-Mailbox vs Get-EXOMailbox

"Get-Mailbox" - a basic command for checking email mailbox parameters. Since Exchange Online V2 (EXO V2), the "Get-EXOMailbox" command has also been introduced. "Get-Mailbox" returns all mailbox parameters, while "Get-EXOMailbox" returns only a subset (including the selected ones). This makes "Get-EXOMailbox" much more efficient – ​​the output is smaller. This is more noticeable when working with a large number of mailboxes.

Each mailbox in Exchange consists of many parameters that determine its settings. You can check them using "Get-Mailbox":

#Display all mailbox parameters user@contoso.com #"Format-List" can be replaced with "FL" Get-Mailbox -Identity user@contoso.com | Format-List

The command outputs all the parameters for the user@contoso.com mailbox. A lot of information is displayed. What if you're only interested in a few parameters?

You can refine your command:

#Export a list of aliases assigned to all mailboxes in the tenant #Using Get-Mailbox Get-Mailbox | Select UserPrincipalName, EmailAddresses | Export-Csv C:\getm.csv #Using Get-EXOMailbox Get-EXOMailbox | Select UserPrincipalName, EmailAddresses | Export-Csv C:\getEXOm.csv

The result is a list of all mailboxes and their aliases.

I mentioned earlier the improved performance of "Get-EXOMailbox." So let's compare "Get-Mailbox" and "Get-EXOMailbox":

#Export the mailbox parameters user@contoso.com to a CSV file using Get-Mailbox Get-Mailbox user@contoso.com | Export-Csv C:\getm.csv #returned CSV file is 10KB #Exporting mailbox parameters user@contoso.com to a CSV file using Get-EXOMailbox Get-EXOMailbox user@contoso.com | Export-Csv C:\exo.csv #returned CSV file is 2KB

In this case, the output file is five times smaller using the newer version of the command because the Get-ExoMailbox command returns fewer mailbox parameters. It's easy to calculate how big a difference this makes when operating on hundreds or thousands of mailboxes.

You can check out all the features of the "Get-Mailbox" and "Get-EXOMailbox" commands in the documentation provided by Microsoft:

https://learn.microsoft.com/en-us/powershell/module/exchange/get-mailbox?view=exchange-ps

https://learn.microsoft.com/en-us/powershell/module/exchange/get-exomailbox?view=exchange-ps

Set-Mailbox

Interested in making changes to mailbox settings? Use the "Set-Mailbox" command! Using it, you can make changes to mailbox parameters you've verified with "Get-Mailbox." As with other "setters" (commands with the "Set" prefix that make changes), be careful. It's worth testing them before using them in a test environment. Removing all aliases in the tenant would be problematic 😊.

For testing purposes, let's assume we want to add the alias u@contoso.com to the user@contoso.com mailbox:

#Adding the alias u@contoso.com to the user@contoso.com mailbox #Adding the alias to the EmailAddresses attribute Set-Mailbox user@contoso.com -EmailAddresses @{add="u@contoso.com"}

Are you planning to monitor your mailboxes using logs? You can also configure this using "Set-Mailbox":

#Start collecting logs for all users in the tenant #Get-Mailbox returns all mailboxes, filtering them by user mailboxes (-Filter {RecipientTypeDetails -eq "UserMailbox"). #Using the pipeline ("|") character, we send the Get-Users result to the Set-Mailbox command #Set-Mailbox sets the "AuditEnabled" parameter to true for these mailboxes Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled $true

From now on, mailbox activity will be monitored. You can view it in the Microsoft 365 admin center or using the "Search-MailboxAuditLog" command.

Below is a link to detailed information about "Set-Mailbox": https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailbox?view=exchange-ps

Example PowerShell Uses in Exchange Online

This article lists several commands and scripts that can be used in a production environment. Presenting an example task and a script to solve it will best illustrate how useful PowerShell is. If you manage Exchange Online, you may encounter the following examples in your daily work.

The company has purchased a new domain – contoso.com. Your task is to assign an additional alias to all mailboxes within this domain. Currently, there are approximately 500 mailboxes in your tenant – in this case, a PowerShell script will be the fastest solution.

#Connecting to Exchange Online Connect-ExchangeOnline #Creating the $mailboxes variable containing all mailboxes $mailboxes = Get-EXOMailbox #The Foreach loop will execute for each mailbox in the $mailboxes variable Foreach($mailbox in $mailboxes){ #Creating the $newalias variable with a new alias for the mailbox currently being processed by the loop $newalias = "$($mailbox.alias)@contoso.com" #Adding a new alias Set-Mailbox $mailbox –EmailAddresses @{Add=’$newalias’} }

The invoices@contoso.com mailbox was created, which was supposed to be a shared mailbox. Unfortunately, someone in the IT department made a mistake and created it as a user mailbox with an assigned license. Your task is to change the mailbox type to “Shared.” Deleting and recreating it is not an option – dozens of invoices have already been sent to the mailbox, which must be preserved. In this case, you can easily complete the task in the Exchange Online admin center, but let's use the following commands:

#Connecting to Exchange Online Connect-ExchangeOnline #Setting the mailbox type to shared Set-Mailbox invoices@contoso.com -Type Shared #Checking if the mailbox type has been changed to Shared - "RecipientTypeDetails" now contains the value "SharedMailbox" Get-EXOMailbox invoices@contoso.com | fl Name,RecipientTypeDetails

Your manager has asked you to prepare a list of all shared mailboxes. Can you complete the task as soon as possible?

#Connecting to Exchange Online Connect-ExchangeOnline #Get-EXOMailbox with a filter allows you to select all mailboxes whose "RecipientTypeDetails" parameter contains "SharedMailbox." #The selected mailboxes are sent to the Select command – we're only interested in the address without the details, so we only select "PrimarySmtpAddress." #The addresses are sent to the Export-Csv command, which exports them to a CSV file and saves them in the selected location. Get-EXOMailbox -Filter{RecipientTypeDetails -eq "SharedMailbox"} | Select PrimarySmtpAddress | Export-Csv -Path c:\SharedMailboxes.csv

Your task is to check the mailboxes that have the "Forwarding" option enabled. A simple command will do this:

#Script displaying a list of forwarded mailboxes #Connect to ExchangeOnline Connect-ExchangeOnline #Get-Mailbox returns all mailboxes #Where limits mailboxes to only those whose "ForwardingAddress" field is not empty #Then, using Select, displays the email address and mailbox to which emails are forwarded Get-Mailbox | Where {$_.ForwardingAddress -ne $Null} | Select PrimarySmtpAddress,ForwardingAddress

There are many other commands that apply to Exchange Online. This article focuses on "Get-Mailbox" and "Set-Mailbox" – those are the ones you'll use most often. If you'd like to learn more about other commands, I encourage you to check out the documentation provided by Microsoft (https://learn.microsoft.com/en-us/powershell/module/exchange/?view=exchange-ps#powershell-v2-module). You'll find all available commands there, along with their descriptions and syntax. You can also use the Get-Help command 😊.