PowerShell Connect to Microsoft 365 with ExchangeOnline

─□✕

Managing 5,000 mailboxes through the Exchange Admin Center is where people go to waste time. PowerShell connect Exchange Online via the ExchangeOnlineManagement module gives you the full Exchange surface area as cmdlets — mailbox queries, permissions, forwarding rules, size reports, and bulk operations — all scriptable and automatable. This post walks through module installation, modern authentication, app-only access for unattended scripts, and the most useful mailbox operations.

Install ExchangeOnlineManagement Module

The module is available from the PowerShell Gallery and supports both Windows PowerShell 5.1 and PowerShell 7. Always install the latest version — older versions used Basic Auth which Microsoft has disabled.

# Install for current user
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force

# Update to latest version
Update-Module -Name ExchangeOnlineManagement

# Verify version installed
Get-InstalledModule -Name ExchangeOnlineManagement | Select-Object Name, Version

Connect-ExchangeOnline with MFA

Connect-ExchangeOnline opens a modern authentication browser popup for interactive login. This handles MFA automatically — the module manages the token refresh internally. Provide your UPN to pre-fill the login prompt.

Import-Module ExchangeOnlineManagement

# Interactive login (MFA-compatible)
Connect-ExchangeOnline -UserPrincipalName "[email protected]"

# Confirm connection
Get-ConnectionInformation

ConnectionId         : abc123
State                : Connected
UserPrincipalName    : [email protected]
Organization         : yourdomain.onmicrosoft.com

Once connected, all Exchange Online cmdlets (Get-Mailbox, Set-Mailbox, etc.) are available in your session.

App-Only Authentication

For unattended scripts (scheduled tasks, automation pipelines), interactive MFA login is not possible. Use app-only (certificate-based) authentication with an Azure AD app registration. This requires a certificate assigned to the app and the app granted Exchange management permissions.

# Connect with certificate-based app-only auth
Connect-ExchangeOnline `
    -AppId           "your-app-client-id" `
    -Organization    "yourdomain.onmicrosoft.com" `
    -CertificateThumbprint "ABCDEF1234567890ABCDEF1234567890ABCDEF12"

The certificate must be installed in the local machine’s certificate store, and the Azure AD app must have the Exchange.ManageAsApp API permission (application type, not delegated) and the Exchange Administrator role assigned.

Get Mailbox Info

Get-Mailbox is the primary cmdlet for retrieving mailbox details. It works identically to on-premises Exchange but targets Exchange Online. Use -ResultSize Unlimited to retrieve more than the default 1,000 results.

# Get a specific mailbox
Get-Mailbox -Identity "[email protected]" |
    Select-Object DisplayName, Alias, PrimarySmtpAddress, ProhibitSendQuota

# Get all mailboxes (use -ResultSize Unlimited for large tenants)
Get-Mailbox -ResultSize Unlimited |
    Select-Object DisplayName, RecipientTypeDetails, PrimarySmtpAddress |
    Export-Csv -Path "C:\Logs\mailboxes.csv" -NoTypeInformation

Common Mailbox Management Tasks

Here are the most frequently run Exchange Online operations:

# Check mailbox size
Get-MailboxStatistics -Identity "[email protected]" |
    Select-Object DisplayName, TotalItemSize, ItemCount

# Set forwarding
Set-Mailbox -Identity "[email protected]" `
    -ForwardingSMTPAddress "[email protected]" `
    -DeliverToMailboxAndForward $true

# Add a Send As permission
Add-RecipientPermission -Identity "[email protected]" `
    -Trustee "[email protected]" `
    -AccessRights SendAs -Confirm:$false

# Block a mailbox from sending
Set-Mailbox -Identity "[email protected]" `
    -ProhibitSendQuota "50GB" -ProhibitSendReceiveQuota "50.5GB"

Disconnect-ExchangeOnline

Always disconnect when your script is done to release the session token and avoid leaving persistent connections open.

Disconnect-ExchangeOnline -Confirm:$false
Write-Output "Disconnected from Exchange Online."

Common Errors and Fixes

Legacy basic auth blocked: If you receive “Basic authentication is disabled” or authentication fails with older connection methods ($UserCredential + New-PSSession style), you’re using the deprecated Basic Auth connection method. The ExchangeOnlineManagement module v3.x uses modern auth exclusively. Ensure you’re on the latest module version and using Connect-ExchangeOnline without a -Credential parameter for interactive sessions.
App-only auth needs certificates or client secret: App-only connections fail if the Azure AD app hasn’t been granted the Exchange.ManageAsApp application permission (not delegated) and assigned the Exchange Administrator role. After adding permissions, admin consent must be granted in Azure AD. Check the app registration’s API permissions and ensure all status shows “Granted” before troubleshooting the PowerShell connection.

Related Cmdlets / See Also

Wrapping Up

The ExchangeOnlineManagement module with modern auth is the production-ready way to manage Exchange Online at scale — from mailbox audits to bulk forwarding configurations. As a next step, implement app-only certificate authentication for your automation scripts so they can run unattended without MFA prompts, and store the certificate in a key vault for secure access.

#connect #eo-management #exchange-online #m365