diff --git a/exchange/docs-conceptual/connect-to-exchange-online-powershell.md b/exchange/docs-conceptual/connect-to-exchange-online-powershell.md index 75be6dcc6a..b3409d0e1c 100644 --- a/exchange/docs-conceptual/connect-to-exchange-online-powershell.md +++ b/exchange/docs-conceptual/connect-to-exchange-online-powershell.md @@ -2,7 +2,7 @@ title: Connect to Exchange Online PowerShell author: chrisda manager: deniseb -ms.date: 05/07/2025 +ms.date: 07/11/2025 ms.audience: Admin audience: Admin ms.topic: article @@ -13,14 +13,17 @@ ms.collection: Strat_EX_Admin ms.custom: ms.assetid: search.appverid: MET150 -description: "Learn how to use the Exchange Online PowerShell V3 module to connect to Exchange Online PowerShell with modern authentication and/or multi-factor authentication (MFA)." +description: "Learn how to use the Exchange Online PowerShell V3 module to connect to Exchange Online PowerShell with modern authentication and/or multifactor authentication (MFA)." --- # Connect to Exchange Online PowerShell -This article contains instructions for how to connect to Exchange Online PowerShell using the Exchange Online PowerShell module with or without multi-factor authentication (MFA). +This article contains instructions for how to connect to Exchange Online PowerShell using the Exchange Online PowerShell module with or without multifactor authentication (MFA). -The Exchange Online PowerShell module uses modern authentication for connecting to all Exchange-related PowerShell environments in Microsoft 365: Exchange Online PowerShell, Security & Compliance PowerShell, and standalone Exchange Online Protection (EOP) PowerShell. For more information about the Exchange Online PowerShell module, see [About the Exchange Online PowerShell module](exchange-online-powershell-v2.md). +> [!TIP] +> The connection instructions in this article also apply to Exchange Online Protection PowerShell for cloud protection of on-premises email environments without cloud mailboxes. + +The Exchange Online PowerShell module uses modern authentication for connecting to Exchange Online PowerShell and Security & Compliance PowerShell. For more information about the Exchange Online PowerShell module, see [About the Exchange Online PowerShell module](exchange-online-powershell-v2.md). To connect to Exchange Online PowerShell for automation, see [App-only authentication for unattended scripts](app-only-auth-powershell-v2.md) and [Use Azure managed identities to connect to Exchange Online PowerShell](connect-exo-powershell-managed-identity.md). @@ -30,24 +33,18 @@ To connect to Exchange Online PowerShell from C#, see [Use C# to connect to Exch - The requirements for installing and using the module are described in [Install and maintain the Exchange Online PowerShell module](exchange-online-powershell-v2.md#install-and-maintain-the-exchange-online-powershell-module). - > [!NOTE] - > Remote PowerShell connections are deprecated in Exchange Online PowerShell. For more information, see [Deprecation of Remote PowerShell in Exchange Online](https://techcommunity.microsoft.com/t5/exchange-team-blog/deprecation-of-remote-powershell-in-exchange-online-re-enabling/ba-p/3779692). - > - > REST API connections in the Exchange Online PowerShell V3 module require the PowerShellGet and PackageManagement modules. For more information, see [PowerShellGet for REST-based connections in Windows](exchange-online-powershell-v2.md#powershellget-for-rest-api-connections-in-windows). +- REST API connections in the Exchange Online PowerShell V3 module require the PowerShellGet and PackageManagement modules. For more information, see [PowerShellGet for REST-based connections in Windows](exchange-online-powershell-v2.md#powershellget-for-rest-api-connections-in-windows). -- After you connect, the cmdlets and parameters that you have or don't have access to is controlled by role-based access control (RBAC). For more information, see [Permissions in Exchange Online](/exchange/permissions-exo/permissions-exo). +- After you connect, role-based access control (RBAC) controls the cmdlets and parameters that you have or don't have access to. For more information, see [Permissions in Exchange Online](/exchange/permissions-exo/permissions-exo). To find the permissions that are required to run specific Exchange Online cmdlets, see [Find the permissions required to run any Exchange cmdlet](find-exchange-cmdlet-permissions.md). -> [!TIP] -> Having problems? Ask in the [Exchange Online](https://go.microsoft.com/fwlink/p/?linkId=267542) forum. - ## Step 1: Load the Exchange Online PowerShell module > [!NOTE] > If the module is already installed, you can typically skip this step and run **Connect-ExchangeOnline** without manually loading the module first. -After you've [installed the module](exchange-online-powershell-v2.md#install-and-maintain-the-exchange-online-powershell-module), open a PowerShell window and load the module by running the following command: +After you [install the module](exchange-online-powershell-v2.md#install-and-maintain-the-exchange-online-powershell-module), open a PowerShell window and load the module by running the following command: ```powershell Import-Module ExchangeOnlineManagement @@ -56,12 +53,12 @@ Import-Module ExchangeOnlineManagement ## Step 2: Connect and authenticate > [!NOTE] -> Connect commands will likely fail if the profile path of the account that you used to connect contains special PowerShell characters (for example, `$`). The workaround is to connect using a different account that doesn't have special characters in the profile path. +> Connect commands likely fail if the profile path of the account that you used to connect contains special PowerShell characters (for example, `$`). The workaround is to connect using a different account that doesn't have special characters in the profile path. The command that you need to run uses the following syntax: ```powershell -Connect-ExchangeOnline -UserPrincipalName [-ExchangeEnvironmentName ] [-ShowBanner:$false] [-LoadCmdletHelp] [-DelegatedOrganization ] [-SkipLoadingFormatData] [-DisableWAM] +Connect-ExchangeOnline [-UserPrincipalName ] [-ExchangeEnvironmentName ] [-ShowBanner:$false] [-LoadCmdletHelp] [-DelegatedOrganization ] [-SkipLoadingFormatData] [-DisableWAM] ``` For detailed syntax and parameter information, see [Connect-ExchangeOnline](/powershell/module/exchange/connect-exchangeonline). @@ -90,13 +87,13 @@ For detailed syntax and parameter information, see [Connect-ExchangeOnline](/pow - Use the _SkipLoadingFormatData_ switch to avoid errors when connecting to Exchange Online PowerShell from within a Windows service. -- Using the module in PowerShell 7 requires version 2.0.4 or later. +- PowerShell 7 requires version 2.0.4 or later. - In version 3.7.2 or later, the _DisableWAM_ switch is available to disable Web Account Manager (WAM) if you get WAM-related connection errors. The connection examples in the following sections use modern authentication, and are incapable of using Basic authentication. -### Connect to Exchange Online PowerShell with an interactive login prompt +### Connect to Exchange Online PowerShell with an interactive sign in prompt 1. The following examples work in Windows PowerShell 5.1 and PowerShell 7 for accounts with or without MFA: @@ -124,16 +121,16 @@ The connection examples in the following sections use modern authentication, and Connect-ExchangeOnline -UserPrincipalName lukas@fabrikam.de -ExchangeEnvironmentName O365GermanyCloud ``` -2. In the sign-in window that opens, enter your password, and then click **Sign in**. +2. In the sign-in window that opens, enter your password, and then select **Sign in**. ![Enter your password in the Sign in to your account window.](media/connect-exo-password-prompt.png) > [!NOTE] > In PowerShell 7, browser-based single sign-on (SSO) is used by default, so the sign-in prompt opens in your default web browser instead of a standalone dialog. -3. **MFA only**: A verification code is generated and delivered based on the response option that's configured for your account (for example, a text message or the Microsoft Authenticator app on your device). +3. **MFA only**: A verification code is generated and delivered based on the response option configured for your account (for example, a text message or the Microsoft Authenticator app on your device). - In the verification window that opens, enter the verification code, and then click **Verify**. + In the verification window that opens, enter the verification code, and then select **Verify**. ![Enter your verification code in the Sign in to your account window.](media/connect-exo-mfa-verify-prompt.png) @@ -163,17 +160,17 @@ The connection examples in the following sections use modern authentication, and 3. Enter your credentials on the resulting pages. - 4. In the confirmation prompt, click **Continue**. The next message should indicate success, and you can close the browser or tab. + 4. In the confirmation prompt, select **Continue**. The next message should indicate success, and you can close the browser or tab. 5. The command from step 1 continues to connect you to Exchange Online PowerShell. -### Connect to Exchange Online PowerShell without a login prompt (unattended scripts) +### Connect to Exchange Online PowerShell without a sign in prompt (unattended scripts) For complete instructions, see [App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell](app-only-auth-powershell-v2.md). ### Connect to Exchange Online PowerShell in customer organizations -For more information about partners and customer organizations, see the following topics: +For more information about partners and customer organizations, see the following articles: - [What is the Cloud Solution Provider (CSP) program?](/partner-center/csp-overview). - [Introduction to granular delegated admin privileges (GDAP)](/partner-center/gdap-introduction) @@ -182,7 +179,7 @@ This example connects to customer organizations in the following scenarios: - Connect to a customer organization using a CSP account. - Connect to a customer organization using a GDAP. -- Connect to a customer organization as a guest user. +- Connect to a customer organization as a guest. ```powershell Connect-ExchangeOnline -UserPrincipalName navin@contoso.onmicrosoft.com -DelegatedOrganization adatum.onmicrosoft.com @@ -219,11 +216,11 @@ Disconnect-ExchangeOnline -Confirm:$false ``` > [!NOTE] -> The disconnect command will likely fail if the profile path of the account that you used to connect contains special PowerShell characters (for example, `$`). The workaround is to connect using a different account that doesn't have special characters in the profile path. +> The disconnect command likely fails if the profile path of the account that you used to connect contains special PowerShell characters (for example, `$`). The workaround is to connect using a different account that doesn't have special characters in the profile path. -## How do you know you've connected successfully? +## How do you know you connected successfully? -If you don't receive any errors, you've connected successfully. A quick test is to run an Exchange Online PowerShell cmdlet, for example, **Get-AcceptedDomain**, and see the results. +If you don't receive any errors, you connected successfully. A quick test is to run an Exchange Online PowerShell cmdlet, for example, **Get-AcceptedDomain**, and see the results. If you receive errors, check the following requirements: @@ -233,25 +230,25 @@ If you receive errors, check the following requirements: - TCP port 80 traffic needs to be open between your local computer and Microsoft 365. It's probably open, but it's something to consider if your organization has a restrictive internet access policy. -- If your organization uses federated authentication, and your identity provider (IDP) and/or security token service (STS) isn't publicly available, you can't use a federated account to connect to Exchange Online PowerShell. Instead, create and use a non-federated account in Microsoft 365 to connect to Exchange Online PowerShell. +- If your organization uses federated authentication, and your identity provider (IDP) and/or security token service (STS) isn't publicly available, you can't use a federated account to connect to Exchange Online PowerShell. Instead, create and use a nonfederated account in Microsoft 365 to connect to Exchange Online PowerShell. -- REST-based connections to Exchange Online PowerShell require the PowerShellGet module, and by dependency, the PackageManagement module, so you'll receive errors if you try to connect without having them installed. For example, you might see the following error: +- REST-based connections to Exchange Online PowerShell require the PowerShellGet module. By dependency, the PowerShellGet module requires the PackageManagement module. You get errors if you try to connect without having both modules installed. For example, you might see the following error: > The term 'Update-ModuleManifest' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. For more information about the PowerShellGet and PackageManagement module requirements, see [PowerShellGet for REST-based connections in Windows](exchange-online-powershell-v2.md#powershellget-for-rest-api-connections-in-windows). -- After you connect, you might received an error that looks like this: +- After you connect, you might receive an error that looks like this: > Could not load file or assembly 'System.IdentityModel.Tokens.Jwt,Version=\, Culture=neutral, PublicKeyToken=\'. Could not find or load a specific file. - This error happens when the Exchange Online PowerShell module conflicts with another module that's imported into the runspace. Try connecting in a new Windows PowerShell window before importing other modules. + This error happens when the Exchange Online PowerShell module conflicts with another module imported into the runspace. Try connecting in a new Windows PowerShell window before importing other modules. ## Appendix: Comparison of old and new connection methods -This section attempts to compare older connection methods that have been replaced by the Exchange Online PowerShell module. The Basic authentication and OAuth token procedures are included for historical reference only and are no longer supported. +This section attempts to compare older connection methods the Exchange Online PowerShell module replaced. The Basic authentication and OAuth token procedures are included for historical reference only and are no longer supported. -### Connect without multi-factor authentication +### Connect without multifactor authentication - **Exchange Online PowerShell module with interactive credential prompt**: @@ -293,7 +290,7 @@ This section attempts to compare older connection methods that have been replace Import-PSSession $Session ``` -### Connect with multi-factor authentication +### Connect with multifactor authentication - **Exchange Online PowerShell module with interactive credential prompt**: @@ -369,7 +366,7 @@ This section attempts to compare older connection methods that have been replace Import-PSSession $Session ``` -### Connect to a customer organization as a guest user +### Connect to a customer organization as a guest - **Exchange Online PowerShell module**: diff --git a/exchange/docs-conceptual/connect-to-exchange-online-protection-powershell.md b/exchange/docs-conceptual/connect-to-exchange-online-protection-powershell.md deleted file mode 100644 index 7e28d7e8a7..0000000000 --- a/exchange/docs-conceptual/connect-to-exchange-online-protection-powershell.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Connect to Exchange Online Protection PowerShell -author: chrisda -manager: deniseb -ms.date: 8/21/2023 -ms.audience: Admin -audience: Admin -ms.topic: article -ms.service: exchange-powershell -ms.reviewer: -ms.localizationpriority: high -ms.collection: Strat_EX_Admin -ms.custom: -ms.assetid: -search.appverid: MET150 -description: "Learn how to use the Exchange Online PowerShell V3 module to connect to standalone Exchange Online Protection PowerShell with modern authentication and/or multi-factor authentication (MFA)." ---- - -# Connect to Exchange Online Protection PowerShell - -This article contains instructions for how to connect to Exchange Online Protection PowerShell using the Exchange Online PowerShell module with or without using multi-factor authentication (MFA). - -The Exchange Online PowerShell module uses modern authentication for connecting to all Exchange-related PowerShell environments in Microsoft 365: Exchange Online PowerShell, Security & Compliance PowerShell, and standalone Exchange Online Protection (EOP) PowerShell. For more information about the module, see [About the Exchange Online PowerShell module](exchange-online-powershell-v2.md). - -For more information about Exchange Online Protection PowerShell, see [Exchange Online Protection PowerShell](exchange-online-protection-powershell.md). - -> [!NOTE] -> As of June 2020, the instructions for connecting to standalone Exchange Online Protection PowerShell and Exchange Online PowerShell are basically the same. If you use the **Connect-IPPSSession** cmdlet with the _ConnectionUri_ parameter value `https://ps.protection.outlook.com/powershell-liveid/`, you're redirected to the same `https://outlook.office365.com/powershell-liveid/` endpoint that's used by **Connect-ExchangeOnline** for Exchange Online PowerShell connections. -> -> Remote PowerShell connections in Exchange Online PowerShell are deprecated. For more information, see [Deprecation of Remote PowerShell in Exchange Online](https://techcommunity.microsoft.com/t5/exchange-team-blog/deprecation-of-remote-powershell-in-exchange-online-re-enabling/ba-p/3779692). -> -> REST API connections in the Exchange Online PowerShell V3 module require the PowerShellGet and PackageManagement modules. For more information, see [PowerShellGet for REST-based connections in Windows](exchange-online-powershell-v2.md#powershellget-for-rest-api-connections-in-windows). - -## What do you need to know before you begin? - -- The requirements for installing and using the module are described in [Install and maintain the Exchange Online PowerShell module](exchange-online-powershell-v2.md#install-and-maintain-the-exchange-online-powershell-module). - -- After you connect, the cmdlets and parameters that you have or don't have access to is controlled by role-based access control (RBAC). For more information, see [Permissions in standalone EOP](/exchange/standalone-eop/manage-admin-role-group-permissions-in-eop). - -> [!TIP] -> Having problems? Ask for help in the [Exchange Online Protection](https://go.microsoft.com/fwlink/p/?linkId=285351) forum. - -## Connect to Exchange Online Protection PowerShell using modern authentication with or without MFA - -These connection instructions use modern authentication and work with or without multi-factor authentication (MFA). - -## Step 1: Load the Exchange Online PowerShell module - -> [!NOTE] -> If the module is already installed, you can typically skip this step and run **Connect-ExchangeOnline** without manually loading the module first. - -After you've [installed the module](exchange-online-powershell-v2.md#install-and-maintain-the-exchange-online-powershell-module), open a PowerShell window and load the module by running the following command: - -```powershell -Import-Module ExchangeOnlineManagement -``` - -## Step 2: Connect and authenticate - -> [!NOTE] -> Connect commands will likely fail if the profile path of the account that you used to connect contains special PowerShell characters (for example, `$`). The workaround is to connect using a different account that doesn't have special characters in the profile path. - -The command that you need to run uses the following syntax: - -```powershell -Connect-ExchangeOnline -UserPrincipalName [-ShowBanner:$false] -``` - -For detailed syntax and parameter information, see [Connect-IPPSSession](/powershell/module/exchange/connect-ippssession). - -- _\_ is your account in user principal name format (for example, `navin@contoso.onmicrosoft.com`). - -- With the EXO V3 module (v3.0.0 or later) and the [demise of Basic authentication (remote PowerShell) connections to Exchange Online](https://techcommunity.microsoft.com/t5/exchange-team-blog/deprecation-of-remote-powershell-rps-protocol-in-security-and/ba-p/3815432), you're using REST API cmdlets only. For more information, see [REST API connections in the EXO V3 module](exchange-online-powershell-v2.md#rest-api-connections-in-the-exo-v3-module). - -### Connect to Exchange Online Protection PowerShell with an interactive login prompt - -This example works in Windows PowerShell 5.1 and PowerShell 7 for accounts with or without MFA: - -```powershell -Connect-ExchangeOnline -UserPrincipalName navin@contoso.onmicrosoft.com -``` - -## Step 3: Disconnect when you're finished - -Be sure to disconnect the session when you're finished. If you close the PowerShell window without disconnecting the session, you could use up all the sessions available to you, and you need to wait for the sessions to expire. To disconnect the session, run the following command: - -```powershell -Disconnect-ExchangeOnline -``` - -To silently disconnect without a confirmation prompt, run the following command: - -```powershell -Disconnect-ExchangeOnline -Confirm:$false -``` - -## How do you know you've connected successfully? - -The Exchange Online Protection Protection cmdlets are imported into your local Windows PowerShell session and tracked by a progress bar. If you don't receive any errors, you've connected successfully. A quick test is to run an Exchange Online Protection cmdlet, for example, **Get-AcceptedDomain**, and see the results. - -If you receive errors, check the following requirements: - -- A common problem is an incorrect password. Run the connection steps again and pay close attention to the username and password that you use. - -- TCP port 80 traffic needs to be open between your local computer and Microsoft 365. It's probably open, but it's something to consider if your organization has a restrictive Internet access policy. - -- You might fail to connect if your client IP address changes during the connection request. This can happen if your organization uses a source network address translation (SNAT) pool that contains multiple IP addresses. The connection error looks like this: - - > The request for the Windows Remote Shell with ShellId \ failed because the shell was not found on the server. Possible causes are: the specified ShellId is incorrect or the shell no longer exists on the server. Provide the correct ShellId or create a new shell and retry the operation. - - To fix the issue, use an SNAT pool that contains a single IP address, or force the use of a specific IP address for connections to the Exchange Online Protection PowerShell endpoint. diff --git a/exchange/docs-conceptual/connect-to-scc-powershell.md b/exchange/docs-conceptual/connect-to-scc-powershell.md index b35779fdaf..77365e508f 100644 --- a/exchange/docs-conceptual/connect-to-scc-powershell.md +++ b/exchange/docs-conceptual/connect-to-scc-powershell.md @@ -2,7 +2,7 @@ title: Connect to Security & Compliance PowerShell author: chrisda manager: deniseb -ms.date: 05/07/2025 +ms.date: 07/11/2025 ms.audience: Admin audience: Admin ms.topic: article @@ -13,14 +13,14 @@ ms.collection: Strat_EX_Admin ms.custom: ms.assetid: search.appverid: MET150 -description: "Learn how to use the Exchange Online PowerShell V3 module to connect to Security & Compliance PowerShell with modern authentication and/or multi-factor authentication (MFA)." +description: "Learn how to use the Exchange Online PowerShell V3 module to connect to Security & Compliance PowerShell with modern authentication and/or multifactor authentication (MFA)." --- # Connect to Security & Compliance PowerShell -This article contains instructions for how to connect to Security & Compliance PowerShell using the Exchange Online PowerShell module with or without multi-factor authentication (MFA). +This article contains instructions for how to connect to Security & Compliance PowerShell using the Exchange Online PowerShell module with or without multifactor authentication (MFA). -The Exchange Online PowerShell module uses modern authentication for connecting to all Exchange-related PowerShell environments in Microsoft 365: Exchange Online PowerShell, Security & Compliance PowerShell, and standalone Exchange Online Protection (EOP) PowerShell. For more information about the Exchange Online PowerShell module, see [About the Exchange Online PowerShell module](exchange-online-powershell-v2.md). +The Exchange Online PowerShell module uses modern authentication for connecting to Exchange Online PowerShell and Security & Compliance PowerShell. For more information about the Exchange Online PowerShell module, see [About the Exchange Online PowerShell module](exchange-online-powershell-v2.md). To connect to Security & Compliance PowerShell for automation, see [App-only authentication for unattended scripts](app-only-auth-powershell-v2.md). @@ -28,19 +28,16 @@ To connect to Security & Compliance PowerShell for automation, see [App-only aut - The requirements for installing and using the module are described in [Install and maintain the Exchange Online PowerShell module](exchange-online-powershell-v2.md#install-and-maintain-the-exchange-online-powershell-module). - > [!NOTE] - > Remote PowerShell connections are deprecated in Security & Compliance PowerShell. For more information, see [Deprecation of Remote PowerShell (RPS) Protocol in Security & Compliance PowerShell](https://techcommunity.microsoft.com/t5/exchange-team-blog/deprecation-of-remote-powershell-rps-protocol-in-security-and/ba-p/3815432). - > - > REST API connections in the Exchange Online PowerShell V3 module require the PowerShellGet and PackageManagement modules. For more information, see [PowerShellGet for REST-based connections in Windows](exchange-online-powershell-v2.md#powershellget-for-rest-api-connections-in-windows). +- REST API connections in the Exchange Online PowerShell V3 module require the PowerShellGet and PackageManagement modules. For more information, see [PowerShellGet for REST-based connections in Windows](exchange-online-powershell-v2.md#powershellget-for-rest-api-connections-in-windows). -- After you connect, the cmdlets and parameters that you have or don't have access to is controlled by role-based access control (RBAC). For more information, see [Permissions in the Microsoft Defender portal](/defender-office-365/mdo-portal-permissions) and [Permissions in the Microsoft Purview compliance portal](/purview/purview-compliance-portal-permissions). +- After you connect, role-based access control (RBAC) controls the cmdlets and parameters that you have or don't have access to. For more information, see [Permissions in the Microsoft Defender portal](/defender-office-365/mdo-portal-permissions) and [Permissions in the Microsoft Purview portal](/purview/purview-permissions). ## Step 1: Load the Exchange Online PowerShell module > [!NOTE] > If the module is already installed, you can typically skip this step and run **Connect-IPPSSession** without manually loading the module first. -After you've [installed the module](exchange-online-powershell-v2.md#install-and-maintain-the-exchange-online-powershell-module), open a PowerShell window and load the module by running the following command: +After you [install the module](exchange-online-powershell-v2.md#install-and-maintain-the-exchange-online-powershell-module), open a PowerShell window and load the module by running the following command: ```powershell Import-Module ExchangeOnlineManagement @@ -49,7 +46,7 @@ Import-Module ExchangeOnlineManagement ## Step 2: Connect and authenticate > [!NOTE] -> Connect commands will likely fail if the profile path of the account that you used to connect contains special PowerShell characters (for example, `$`). The workaround is to connect using a different account that doesn't have special characters in the profile path. +> Connect commands likely fail if the profile path of the account that you used to connect contains special PowerShell characters (for example, `$`). The workaround is to connect using a different account that doesn't have special characters in the profile path. The command that you need to run uses the following syntax: @@ -81,7 +78,7 @@ For detailed syntax and parameter information, see [Connect-IPPSSession](/powers - If you aren't using MFA, you should be able to use the _Credential_ parameter instead of the _UserPrincipalName_ parameter. First, run the command `$Credential = Get-Credential`, enter your username and password, and then use the variable name for the _Credential_ parameter (`-Credential $Credential`). If it doesn't work, then you need to use the _UserPrincipalName_ parameter. -### Connect to Security & Compliance PowerShell with an interactive login prompt +### Connect to Security & Compliance PowerShell with an interactive sign in prompt 1. The following examples work in Windows PowerShell 5.1 and PowerShell 7 for accounts with or without MFA: @@ -109,20 +106,20 @@ For detailed syntax and parameter information, see [Connect-IPPSSession](/powers Connect-IPPSSession -UserPrincipalName li@fabrikam.cn -ConnectionUri https://ps.compliance.protection.partner.outlook.cn/powershell-liveid -AzureADAuthorizationEndpointUri https://login.chinacloudapi.cn/common ``` -2. In the sign-in window that opens, enter your password, and then click **Sign in**. +2. In the sign-in window that opens, enter your password, and then select **Sign in**. ![Enter your password in the Sign in to your account window.](media/connect-exo-password-prompt.png) > [!NOTE] > In PowerShell 7, browser-based single sign-on (SSO) is used by default, so the sign in prompt opens in your default web browser instead of a standalone dialog. -3. **MFA only**: A verification code is generated and delivered based on the response option that's configured for your account (for example, a text message or the Microsoft Authenticator app on your device). +3. **MFA only**: A verification code is generated and delivered based on the response option configured for your account (for example, a text message or the Microsoft Authenticator app on your device). - In the verification window that opens, enter the verification code, and then click **Verify**. + In the verification window that opens, enter the verification code, and then select **Verify**. ![Enter your verification code in the Sign in to your account window.](media/connect-exo-mfa-verify-prompt.png) -### Connect to Security & Compliance PowerShell without a login prompt (unattended scripts) +### Connect to Security & Compliance PowerShell without a sign in prompt (unattended scripts) For complete instructions, see [App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell](app-only-auth-powershell-v2.md). @@ -132,7 +129,7 @@ The procedures in this section require version 3.0.0 or later of the module. In Security & Compliance PowerShell, you need to use the _AzureADAuthorizationEndpointUri_ with the _DelegatedOrganization_ parameter. -For more information, about partners and customer organizations, see the following topics: +For more information, about partners and customer organizations, see the following articles: - [What is the Cloud Solution Provider (CSP) program?](/partner-center/csp-overview). - [Introduction to granular delegated admin privileges (GDAP)](/partner-center/gdap-introduction) @@ -141,7 +138,7 @@ This example connects to customer organizations in the following scenarios: - Connect to a customer organization using a CSP account. - Connect to a customer organization using a GDAP. -- Connect to a customer organization as a guest user. +- Connect to a customer organization as a guest. ```powershell Connect-IPPSSession -UserPrincipalName navin@contoso.onmicrosoft.com -DelegatedOrganization adatum.onmicrosoft.com -AzureADAuthorizationEndpointUri https://login.microsoftonline.com/adatum.onmicrosoft.com @@ -162,11 +159,11 @@ Disconnect-ExchangeOnline -Confirm:$false ``` > [!NOTE] -> The disconnect command will likely fail if the profile path of the account that you used to connect contains special PowerShell characters (for example, `$`). The workaround is to connect using a different account that doesn't have special characters in the profile path. +> The disconnect command likely fails if the profile path of the account that you used to connect contains special PowerShell characters (for example, `$`). The workaround is to connect using a different account that doesn't have special characters in the profile path. -## How do you know you've connected successfully? +## How do you know you connected successfully? -The Security & Compliance PowerShell cmdlets are imported into your local Windows PowerShell session and tracked by a progress bar. If you don't receive any errors, you've connected successfully. A quick test is to run a Security & Compliance PowerShell cmdlet, for example, **Get-RetentionCompliancePolicy**, and see the results. +The Security & Compliance PowerShell cmdlets are imported into your local Windows PowerShell session and tracked by a progress bar. If you don't receive any errors, you connected successfully. A quick test is to run a Security & Compliance PowerShell cmdlet, for example, **Get-RetentionCompliancePolicy**, and see the results. If you receive errors, check the following requirements: @@ -176,14 +173,17 @@ If you receive errors, check the following requirements: - TCP port 80 traffic needs to be open between your local computer and Microsoft 365. It's probably open, but it's something to consider if your organization has a restrictive internet access policy. -- REST-based connections to Security & Compliance PowerShell require the PowerShellGet module, and by dependency, the PackageManagement module, so you'll receive errors if you try to connect without having them installed. For example, you might see the following error: +- REST-based connections to Security & Compliance PowerShell require the PowerShellGet module. By dependency, the PowerShellGet module requires the PackageManagement module. You get errors if you try to connect without having both modules installed. For example, you might see the following error: > The term 'Update-ModuleManifest' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. For more information about the PowerShellGet and PackageManagement module requirements, see [PowerShellGet for REST-based connections in Windows](exchange-online-powershell-v2.md#powershellget-for-rest-api-connections-in-windows). -- You might fail to connect if your client IP address changes during the connection request. This can happen if your organization uses a source network address translation (SNAT) pool that contains multiple IP addresses. The connection error looks like this: +- You might fail to connect if your client IP address changes during the connection request. The failure occurs if your organization uses a source network address translation (SNAT) pool with multiple IP addresses. The connection error looks like this: > The request for the Windows Remote Shell with ShellId \ failed because the shell was not found on the server. Possible causes are: the specified ShellId is incorrect or the shell no longer exists on the server. Provide the correct ShellId or create a new shell and retry the operation. - To fix the issue, use an SNAT pool that contains a single IP address, or force the use of a specific IP address for connections to the Security & Compliance PowerShell endpoint. + To fix the issue, do either of the following steps: + + - Use an SNAT pool that contains a single IP address. + - Force the use of a specific IP address for connections to the Security & Compliance PowerShell endpoint. diff --git a/exchange/docs-conceptual/disable-access-to-exchange-online-powershell.md b/exchange/docs-conceptual/disable-access-to-exchange-online-powershell.md index 79a641ef08..83778c6b43 100644 --- a/exchange/docs-conceptual/disable-access-to-exchange-online-powershell.md +++ b/exchange/docs-conceptual/disable-access-to-exchange-online-powershell.md @@ -3,7 +3,7 @@ title: "Enable or disable access to Exchange Online PowerShell" ms.author: chrisda author: chrisda manager: deniseb -ms.date: 12/11/2024 +ms.date: 07/11/2025 ms.audience: Admin audience: Admin ms.topic: article @@ -16,7 +16,7 @@ description: "Admins can learn how to disable or enable access to Exchange Onlin # Enable or disable access to Exchange Online PowerShell -Exchange Online PowerShell is the administrative interface that enables admins to manage the Exchange Online part of a Microsoft 365 organization from the command line (including many security features in Exchange Online Protection and Microsoft Defender for Office 365). +Exchange Online PowerShell is the administrative interface that enables you to manage the Exchange Online part of your Microsoft 365 organization from the command line (including many default email protections for all cloud mailboxes and protections in Microsoft Defender for Office 365). By default, all accounts in Microsoft 365 are allowed to use Exchange Online PowerShell. This access doesn't give users administrative capabilities. They're still limited by [role based access control (RBAC)](/exchange/permissions-exo/permissions-exo). For example, they can configure some settings on their own mailbox and manage distribution groups that they own, but not much else. @@ -29,7 +29,7 @@ Admins can use the procedures in this article to disable or enable a user's abil - The procedures in this article are available only in Exchange Online PowerShell. To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](connect-to-exchange-online-powershell.md). - You need to be assigned permissions before you can do the procedures in this article. You have the following options: - - [Exchange Online RBAC](/exchange/permissions-exo/permissions-exo): Membership in the **Organization Management** or **Recipient Management** role groups. + - [Exchange Online permissions](/exchange/permissions-exo/permissions-exo): Membership in the **Organization Management** or **Recipient Management** role groups. - [Microsoft Entra RBAC](/microsoft-365/admin/add-users/about-admin-roles): Membership in the **Exchange Administrator** or **Global Administrator**\* roles gives users the required permissions *and* permissions for other features in Microsoft 365. > [!IMPORTANT] @@ -41,9 +41,6 @@ Admins can use the procedures in this article to disable or enable a user's abil - For detailed information about OPATH filter syntax in Exchange Online, see [Additional OPATH syntax information](recipient-filters.md#additional-opath-syntax-information). -> [!TIP] -> Having problems? Ask for help in the Exchange forums. Visit the forums at: [Exchange Online](https://go.microsoft.com/fwlink/p/?linkId=267542), or [Exchange Online Protection](https://go.microsoft.com/fwlink/p/?linkId=285351). - ## Enable or disable access to Exchange Online PowerShell for a user This example disables access to Exchange Online PowerShell for the user `david@contoso.onmicrosoft.com`. diff --git a/exchange/docs-conceptual/exchange-cmdlet-syntax.md b/exchange/docs-conceptual/exchange-cmdlet-syntax.md index 2d91c08839..b5b796e1be 100644 --- a/exchange/docs-conceptual/exchange-cmdlet-syntax.md +++ b/exchange/docs-conceptual/exchange-cmdlet-syntax.md @@ -3,36 +3,44 @@ title: "Exchange cmdlet syntax" ms.author: chrisda author: chrisda manager: deniseb -ms.date: 9/7/2023 +ms.date: 07/11/2025 ms.audience: Admin audience: Admin ms.topic: article ms.service: exchange-online ms.localizationpriority: medium ms.assetid: 85ffe9c8-7f03-4877-8e55-3cbd40228d84 -description: "Learn about the structure and syntax of cmdlets in Exchange PowerShell, Exchange Online PowerShell, standalone Exchange Online Protection (EOP) PowerShell, and Security & Compliance PowerShell." +description: "Learn about the structure and syntax of cmdlets in Exchange PowerShell, Exchange Online PowerShell, Security & Compliance PowerShell, and Exchange Online Protection PowerShell for cloud protection of on-premises email environments." --- # Exchange cmdlet syntax Exchange cmdlet reference articles use a standardized method that describes key aspects about the cmdlet. For example: -- Parameters that are available on the cmdlet. +- Parameters available on the cmdlet. - Values that each parameter accepts. - Parameters that can be used together, and parameters that need to be used separately. -This article explains these conventions, and also the syntax that's required to run commands in Exchange PowerShell. +This article explains these conventions, and also the syntax required to run commands in Exchange PowerShell. ## Command conventions in Exchange PowerShell -Exchange PowerShell help follows conventions that indicate what's required or optional, and how to enter parameters and values when you run a command. These command conventions are listed in the following table. - -|Symbol|Description| -|---|---| -|`-`|A hyphen indicates a parameter. For example, `-Identity`.| -|`< >`|Angle brackets indicate the possible values for a parameter. For example, `-Location ` or -Enabled \<$true \| $false\>.| -|`[ ]`|Square brackets indicate optional parameters and their values. For example, `[-WhatIf]` or `[-ResultSize ]`.

Parameter-value pairs that aren't enclosed in square brackets are required. For example, `-Password `.

Square brackets around the parameter name itself indicates a _positional_ parameter (you can use the parameter value without specifying the parameter name), and positional parameters can be required or optional.

For example, `Get-Mailbox [[-Identity] ]` means the _Identity_ parameter is positional (because it's enclosed in square brackets) and optional (because the whole parameter-value pair is enclosed in square brackets), so you can use `Get-Mailbox -Identity ` or `Get-Mailbox `. Similarly, `Set-Mailbox [-Identity] ` means the _Identity_ parameter is positional (because it's enclosed in square brackets) and required (because the whole parameter-value pair isn't enclosed in square brackets), so you can use `Set-Mailbox -Identity ` or `Set-Mailbox `.| -|`|`|Pipe symbols in parameter values indicate a choice between values. For example, -Enabled \<$true \| $false\> indicates the _Enabled_ parameter can have the value `$true` or `$false`.| +Exchange PowerShell help follows conventions to indicate required or optional information, and how to enter parameters and values when you run a command. These command conventions are described in the following list: + +- `-`: A hyphen indicates a parameter. For example, `-Identity`. +- `< >`: Angle brackets indicate the possible values for a parameter. For example, `-Location ` or `-Enabled <$true | $false>`. +- `[ ]`: Square brackets indicate optional parameters and their values. For example, `[-WhatIf]` or `[-ResultSize ]`. + - Parameter-value pairs not enclosed in square brackets are required. For example, `-Password `. + - Square brackets around the parameter name itself indicates a _positional_ parameter where you can use the parameter value without specifying the parameter name. Positional parameters are required or optional. For example: + - `Get-Mailbox [[-Identity] ]` means the _Identity_ parameter is: + - Positional because the parameter enclosed in square brackets. + - Optional because the whole parameter-value pair is enclosed in square brackets. + - So, you can use `Get-Mailbox -Identity ` or `Get-Mailbox `. + - `Set-Mailbox [-Identity] ` means the _Identity_ parameter is: + - Positional because the parameter is enclosed in square brackets. + - Required because the whole parameter-value pair isn't enclosed in square brackets. + - So, you can use `Set-Mailbox -Identity ` or `Set-Mailbox `. +- `|`: Pipe symbols in parameter values indicate a choice between values. For example, `-Enabled <$true | $false>` indicates the _Enabled_ parameter can have the value `$true` or `$false`. These command conventions help you understand how a command is constructed. Except for the hyphen that indicates a parameter, you don't use these symbols as they're described in the table when you run cmdlets in Exchange PowerShell. @@ -116,26 +124,38 @@ If you enclose the string in single quotation marks, the only special character ## Command operators in Exchange PowerShell -The following table shows the valid operators that you can use in an Exchange command. Some of these symbols were also described in the earlier [Command conventions in Exchange PowerShell](#command-conventions-in-exchange-powershell) section. However, these symbols have different meanings when they're used on the command line as operators. For example, the minus sign that's used to indicate a parameter can also be used in a command as a mathematical operator. - -|Operator|Description| -|---|---| -|`=`|The equal sign is an assignment character. The value on the right side of the equal sign is assigned to the variable on the left side of the equal sign (for example, `$x= Get-Mailbox`). You can also use other characters with the equal sign:
  • `+=`: Add the value on the right side of the equal sign to the current value that's contained in the variable on the left side of the equal sign.
  • `-=`: Subtract the value on the right side of the equal sign from the current value that's contained in the variable on the left side of the equal sign.
  • `*=`: Multiply the current value of the variable on the left side of the equal sign by the value that's specified on the right side of the equal sign.
  • `/=`: Divide the current value of the variable on the left side of the equal sign by the value that's specified on the right side of the equal sign.
  • `%=`: Modify the current value of the variable on the left side of the equal sign by the value that's specified on the right side of the equal sign.
| -|`:`|Use a colon to separate a parameter's name from the parameter's value. For example, `-Enabled:$True`. A colon separator works and is optional on virtually all parameter-value pairs. A colon separator is required on switch parameters. For more information about switch parameters, see [about_Parameters](/powershell/module/microsoft.powershell.core/about/about_parameters).| -|`!`|The exclamation point is the logical NOT operator. The combined pair `!=` means "not equal to."| -|`[ ]`|Brackets specify the index value of an array position. Index values are offsets that always start at zero. For example, in the array named `$Red`, the value of the tenth position in the array is `$Red[9]`.

Brackets can also assign a type to a variable. For example, to identify the variable named `$A` as XML, use `$A=[XML] "value"`. The following variable types are available: `Array`, `Bool`, `Byte`, `Char`, `Char[]`, `Decimal`, `Double`, `Float`, `Int`, `Int[]`, `Long`, `Long[]`, `RegEx`, `Single`, `ScriptBlock`, `String`, `Type`, and `XML.`| -|`{ }`|Use braces to include an expression in a command. For example, `Get-Process | Where {$_.HandleCount -gt 400}`| -|`|`|Use the pipe symbol to pipe the output of one command to another command. For example, `Get-Mailbox -Server SRV1 | Set-Mailbox -ProhibitSendQuota 2GB`.| -|`>`|Use the right-angle bracket to send the output of a command to a file. If the file already exists, the contents are overwritten. For example, `Get-TransportRule > "C:\My Documents\TransportRules.txt"`.| -|`>>`|Use double right-angle brackets to append the output of a command to an existing file. If the file doesn't exist, a new file is created. For example, `Get-TransportRule >> "C:\My Documents\TransportRules.txt"`.| -|`"`|Use double quotation marks to enclose text strings that contain spaces. As previously described, variables are replaced with their actual values.| -|`$`|The dollar sign indicates a variable. For example, to create a variable named `$Blue` with the value 10, use `$Blue = 10`. After you store the variable, you can use it as the value of a parameter.| -|`@`|The at symbol references an associative array. For more information, see [about_Arrays](/powershell/module/microsoft.powershell.core/about/about_arrays).| -|`$( )`|A dollar sign with parentheses indicates command substitution. You can use command substitution when you want to use the output of one command as an argument in another command. For example, `Get-ChildItem $(Read-Host -Prompt "Enter FileName: ")`.| -|`..`|Double-periods indicate a value range. For example, if an array contains several indexes, you can return the values of all indexes between the second and fifth indexes by running the command: `$Blue[2..5]`.| -|`+`|The plus sign operator adds two values together. For example, `6 + 6` equals `12`.| -|`-`|The minus sign operator subtracts one value from another value (for example, `12 - 6` equals `6`) or indicates a negative number (for example, `-6 * 6` equals `-36`).| -|`*`|You can use an asterisk to:
  • **Match strings**: For example, `Get-User | Where-Object {$_.Department -like 'Sales*'})`
  • **Multiply numeric values**: For example, `6 * 6` equals `36`
  • **Repeat the string value a specified number of times**: For example, `"Test" * 3` equals `TestTestTest`
| -|`/`|A forward slash divides one value by another. For example, `6 / 6` equals `1`.| -|`%`|The percent sign has the following uses:
  • In a numerical evaluation, it returns the remainder from a division operator. For example, `6 % 4` equals `2`.
  • In a [pipeline](/powershell/module/microsoft.powershell.core/about/about_pipelines), it's shorthand for the **ForEach-Object** cmdlet. For example, `Import-Csv C:\MyFile.csv | ForEach-Object {Set-Mailbox $_.Identity -Name $_.Name}` is the same as `Import-Csv C:\MyFile.csv | % {Set-Mailbox $_.Identity -Name $_.Name}`.
| -|`?`|The question mark character is shorthand for the **Where-Object** cmdlet. For example, `Get-Alias | Where-Object {$_.Definition -eq "Clear-Host"}` is the same as `Get-Alias | ? {$_.Definition -eq "Clear-Host"}`.| +The following list shows the valid operators you can use in an Exchange command. Some of these symbols were also described in the earlier [Command conventions in Exchange PowerShell](#command-conventions-in-exchange-powershell) section. However, these symbols have different meanings when used as operators. For example, the minus sign that indicates a parameter can also be used as a mathematical operator. + +- `=`: The equal sign is an assignment character. The value on the right side of the equal sign is assigned to the variable on the left side. For example, `$x = Get-Mailbox`. You can also use other characters with the equal sign: + - `+=`: Add the value on the right side of the equal sign to the current value in the variable on the left side. + - `-=`: Subtract the value on the right side of the equal sign from the current in the variable on the left side. + - `*=`: Multiply the current value of the variable on the left side of the equal sign by the value specified on the right side. + - `/=`: Divide the current value of the variable on the left side of the equal sign by the value specified on the right side. + - `%=`: Modify the current value of the variable on the left side of the equal sign by the value specified on the right side. +- `:`: Use a colon to separate a parameter name from the parameter value. For example, `-Enabled:$True`. + - A colon separator works and is optional on virtually all parameter-value pairs. + - A colon separator is required on switch parameters. For more information about switch parameters, see [about_Parameters](/powershell/module/microsoft.powershell.core/about/about_parameters). +- `!`: The exclamation point is the logical NOT operator. The combined pair `!=` means "not equal to." +- `[ ]`: Brackets specify the index value of an array position. Index values are offsets that always start at zero. For example, in the array named `$Red`, the value of the tenth position in the array is `$Red[9]`. + + Brackets can also assign a type to a variable. For example, to identify the variable named `$A` as XML, use `$A=[XML] "value"`. The following variable types are available: `Array`, `Bool`, `Byte`, `Char`, `Char[]`, `Decimal`, `Double`, `Float`, `Int`, `Int[]`, `Long`, `Long[]`, `RegEx`, `Single`, `ScriptBlock`, `String`, `Type`, and `XML.` +- `{ }`: Use braces to include an expression in a command. For example, `Get-Process | Where {$_.HandleCount -gt 400}`. +- `|`: Use the pipe symbol to pipe the output of one command to another command. For example, `Get-Mailbox -Server SRV1 | Set-Mailbox -ProhibitSendQuota 2GB`. +- `>`: Use the right-angle bracket to send the output of a command to a file. If the file already exists, the contents are overwritten. For example, `Get-TransportRule > "C:\My Documents\TransportRules.txt"`. +- `>>`: Use double right-angle brackets to append the output of a command to an existing file. If the file doesn't exist, a new file is created. For example, `Get-TransportRule >> "C:\My Documents\TransportRules.txt"`. +- `"`: Use double quotation marks to enclose text strings that contain spaces. As previously described, variables are replaced with their actual values. +- `$`: The dollar sign indicates a variable. For example, to create a variable named `$Blue` with the value 10, use `$Blue = 10`. After you store the variable, you can use it as a parameter value. +- `@`: The at symbol references an associative array. For more information, see [about_Arrays](/powershell/module/microsoft.powershell.core/about/about_arrays). +- `$( )`: A dollar sign with parentheses indicates command substitution. You can use command substitution when you want to use the output of one command as an argument in another command. For example, `Get-ChildItem $(Read-Host -Prompt "Enter FileName: ")`. +- `..`: Double-periods indicate a value range. For example, if an array contains several indexes, you can return the values of all indexes between the second and fifth indexes by running the command: `$Blue[2..5]`. +- `+`: The plus sign operator adds two values together. For example, `6 + 6` equals `12`. +- `-`: The minus sign operator subtracts one value from another value (for example, `12 - 6` equals `6`) or indicates a negative number (for example, `-6 * 6` equals `-36`). +- `*`: You can use an asterisk for the following tasks: + - **Match strings**: For example, `Get-User | Where-Object {$_.Department -like 'Sales*'})`. + - **Multiply numeric values**: For example, `6 * 6` equals `36`. + - **Repeat the string value a specified number of times**: For example, `"Test" * 3` equals `TestTestTest`. +- `/`: A forward slash divides one value by another. For example, `6 / 6` equals `1`. +- `%`: The percent sign has the following uses: + - In a numerical evaluation, it returns the remainder from a division operator. For example, `6 % 4` equals `2`. + - In a [pipeline](/powershell/module/microsoft.powershell.core/about/about_pipelines), it's shorthand for the **ForEach-Object** cmdlet. For example, `Import-Csv C:\MyFile.csv | ForEach-Object {Set-Mailbox $_.Identity -Name $_.Name}` is the same as `Import-Csv C:\MyFile.csv | % {Set-Mailbox $_.Identity -Name $_.Name}`. + - `?`: The question mark is shorthand for the **Where-Object** cmdlet. For example, `Get-Alias | Where-Object {$_.Definition -eq "Clear-Host"}` is the same as `Get-Alias | ? {$_.Definition -eq "Clear-Host"}`.| diff --git a/exchange/docs-conceptual/exchange-online-powershell-v2.md b/exchange/docs-conceptual/exchange-online-powershell-v2.md index 82056ae911..6c58de1513 100644 --- a/exchange/docs-conceptual/exchange-online-powershell-v2.md +++ b/exchange/docs-conceptual/exchange-online-powershell-v2.md @@ -3,7 +3,7 @@ title: About the Exchange Online PowerShell V3 module ms.author: chrisda author: chrisda manager: deniseb -ms.date: 06/23/2025 +ms.date: 07/11/2025 ms.audience: Admin audience: Admin ms.topic: article @@ -15,45 +15,42 @@ ms.custom: ms.assetid: search.appverid: MET150 keywords: Exchange Online PowerShell V2 module, Exchange Online PowerShell V3 module, EXO V2 module, EXO V3 module -description: "Admins can learn about the installation, maintenance, and design of the Exchange Online PowerShell V3 module that they use to connect to all Exchange-related PowerShell environments in Microsoft 365." +description: "Admins can learn about the installation, maintenance, and design of the Exchange Online PowerShell V3 module that they use to connect to all Exchange cloud-related PowerShell environments." --- # About the Exchange Online PowerShell module -The Exchange Online PowerShell module uses modern authentication and works with or without multi-factor authentication (MFA) for connecting to all Exchange-related PowerShell environments in Microsoft 365: Exchange Online PowerShell, Security & Compliance PowerShell, and standalone Exchange Online Protection (EOP) PowerShell. +The Exchange Online PowerShell module (also known as the Exchange Online PowerShell V3 module or EXO V3 module since 2022) uses modern authentication and works with or without multifactor authentication (MFA) for connecting to all Exchange cloud-related PowerShell environments: Exchange Online PowerShell, Security & Compliance PowerShell, and Exchange Online Protection PowerShell for cloud protection of on-premises email environments. For connection instructions using the module, see the following articles: - [Connect to Exchange Online PowerShell](connect-to-exchange-online-powershell.md) + + > [!TIP] + > Exchange Online Protection PowerShell for cloud protection of on-premises email environments uses the same connection instructions as Exchange Online PowerShell. + - [Connect to Security & Compliance PowerShell](connect-to-scc-powershell.md) -- [Connect to Exchange Online Protection PowerShell](connect-to-exchange-online-protection-powershell.md) - [App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell](app-only-auth-powershell-v2.md) - [Use Azure managed identities to connect to Exchange Online PowerShell](connect-exo-powershell-managed-identity.md) - [Use C# to connect to Exchange Online PowerShell](connect-to-exo-powershell-c-sharp.md) The rest of this article explains how the module works, how to install and maintain the module, and the optimized Exchange Online cmdlets that are available in the module. -> [!TIP] -> Version 3.0.0 and later (2022) is known as the Exchange Online PowerShell V3 module (abbreviated as the EXO V3 module). Version 2.0.5 and earlier (2021) was known as the Exchange Online PowerShell V2 module (abbreviated as the EXO V2 module). - ## REST API connections in the EXO V3 module -Exchange Online PowerShell and Security & Compliance PowerShell now use REST API connections for all cmdlets: - -- **Exchange Online PowerShell**: EXO V3 module v3.0.0 or later. -- **Security & Compliance PowerShell**: EXO V3 module v3.2.0 or later. +Exchange Online PowerShell and Security & Compliance PowerShell use REST API connections for all cmdlets since 2023. -REST API connections require the PowerShellGet and PackageManagement modules. For more information, see [PowerShellGet for REST-based connections in Windows](#powershellget-for-rest-api-connections-in-windows). +REST API connections require the PowerShellGet and PackageManagement modules. For more information, see [PowerShellGet for REST-based connections in Windows](#powershellget-required-in-windows). Cmdlets in REST API connections have the following advantages over their historical counterparts: -- **More secure**: Built-in support for modern authentication and no dependence on the remote PowerShell session. PowerShell on your client computer doesn't need [Basic authentication in WinRM](#turn-on-basic-authentication-in-winrm). +- **More secure**: Built-in support for modern authentication and no dependence on the remote PowerShell session. PowerShell on your client computer doesn't need [Basic authentication in WinRM](#basic-authentication-in-winrm). - **More reliable**: Transient failures use built-in retries, so failures or delays are minimized. For example: - Failures due to network delays. - Delays due to large queries that take a long time to complete. - **Better performance**: REST API connections avoid setting up a PowerShell runspace. -The benefits of cmdlets in REST API connections are described in the following table: +The following table compares the benefits of REST API cmdlets to unavailable remote PowerShell cmdlets and the [exclusive Get-EXO\* cmdlets in the EXO V3 module](#cmdlets-in-the-exchange-online-powershell-module) | |Remote PowerShell cmdlets|Get-EXO\* cmdlets|REST API cmdlets| |---|---|---|---| @@ -62,21 +59,19 @@ The benefits of cmdlets in REST API connections are described in the following t |**Reliability**|Least reliable|Highly reliable|Highly reliable| |**Functionality**|All parameters and output properties available|Limited parameters and output properties available|All parameters and output properties available| -REST API cmdlets have the same cmdlet names and work just like their remote PowerShell equivalents, so you don't need to update cmdlet names or parameters in older scripts. +REST API cmdlets have the same cmdlet names and work just like their remote PowerShell equivalents, so you don't need to update cmdlet names or parameters in scripts. > [!TIP] > The [Invoke-Command](/powershell/module/microsoft.powershell.core/invoke-command) cmdlet doesn't work in REST API connections. For alternatives, see [Workarounds for Invoke-Command scenarios in REST API connections](invoke-command-workarounds-rest-api.md). -Basic authentication (remote PowerShell) connections are deprecated in Exchange Online PowerShell and Security & Compliance PowerShell. For more information, see [here](https://techcommunity.microsoft.com/t5/exchange-team-blog/deprecation-of-remote-powershell-in-exchange-online-re-enabling/ba-p/3779692) and [here](https://techcommunity.microsoft.com/t5/exchange-team-blog/deprecation-of-remote-powershell-rps-protocol-in-security-and/ba-p/3815432). - -A few cmdlets in Exchange Online PowerShell have been updated with the experimental _UseCustomRouting_ switch in REST API connections. This switch routes the command directly to the required Mailbox server, and might improve overall performance. Use the _UseCustomRouting_ switch experimentally. +A few cmdlets in Exchange Online PowerShell are updated with the experimental _UseCustomRouting_ switch. This switch routes the command directly to the required Mailbox server, and might improve overall performance. Use the _UseCustomRouting_ switch experimentally. - When you use the _UseCustomRouting_ switch, you can use only the following values for identity of the mailbox: - User principal name (UPN) - Email address - Mailbox GUID -- The _UseCustomRouting_ switch is available only on the following Exchange Online PowerShell cmdlets in REST API connections: +- The _UseCustomRouting_ switch is available only on the following Exchange Online PowerShell cmdlets: - **Get-Clutter** - **Get-FocusedInbox** - **Get-InboxRule** @@ -96,14 +91,14 @@ A few cmdlets in Exchange Online PowerShell have been updated with the experimen - **Set-MailboxRegionalConfiguration** - **Set-UserPhoto** -- Use the [Get-ConnectionInformation](/powershell/module/exchange/get-connectioninformation) cmdlet to get information about REST API connections to Exchange Online PowerShell and Security & Compliance PowerShell. This cmdlet is required because the [Get-PSSession](/powershell/module/microsoft.powershell.core/get-pssession) cmdlet in Windows PowerShell doesn't return information for REST API connections. +- Use the [Get-ConnectionInformation](/powershell/module/exchange/get-connectioninformation) cmdlet to get information about connections to Exchange Online PowerShell and Security & Compliance PowerShell. This cmdlet is required because the [Get-PSSession](/powershell/module/microsoft.powershell.core/get-pssession) cmdlet in Windows PowerShell doesn't return information for REST API connections. Scenarios where you can use **Get-ConnectionInformation** are described in the following table: |Scenario|Expected output| |---|---| - |Run after **Connect-ExchangeOnline** or **Connect-IPPSSession** commands for REST API connections.|Returns one connection information object.| - |Run after multiple **Connect-ExchangeOnline** or **Connect-IPPSSession** commands for REST API connections.|Returns a collection of connection information objects.| + |Run after **Connect-ExchangeOnline** or **Connect-IPPSSession** commands.|Returns one connection information object.| + |Run after multiple **Connect-ExchangeOnline** or **Connect-IPPSSession** commands.|Returns a collection of connection information objects.| - Use the _SkipLoadingFormatData_ switch on the **Connect-ExchangeOnline** cmdlet to avoid loading format data and to run **Connect-ExchangeOnline** commands faster. @@ -134,9 +129,9 @@ For more information about what's new in the EXO V3 module, see the [Release not ## Report bugs and issues for Preview versions of the Exchange Online PowerShell module > [!TIP] -> For General Availability (GA) versions of the module, don't use the following email address to report issues. Messages about GA versions of the module won't be answered. Instead, open a support ticket. +> For General Availability (GA) versions of the module, don't use the following email address to report issues. Messages about GA versions of the module aren't answered. Instead, open a support ticket. -For **Preview versions of the module**, use `exocmdletpreview[at]service[dot]microsoft[dot]com` to report any issues that you might encounter. Be sure to include the log files in your email message. To generate the log files, replace \ with an output folder, and then run the following command: +For **Preview versions of the module only**, use `exocmdletpreview[at]service[dot]microsoft[dot]com` to report any issues that you might encounter. Be sure to include the log files in your email message. To generate the log files, replace \ with an output folder, and then run the following command: ```powershell Connect-ExchangeOnline -EnableErrorReporting -LogDirectoryPath -LogLevel All @@ -173,7 +168,7 @@ The connection-related cmdlets in the module are listed in the following table: > [!TIP] > Frequent use of the **Connect-ExchangeOnline** and **Disconnect-ExchangeOnline** cmdlets in a single PowerShell session or script might lead to a memory leak. The best way to avoid this issue is to use the _CommandName_ parameter on the **Connect-ExchangeOnline** cmdlet to limit the cmdlets that are used in the session. -Miscellaneous Exchange Online cmdlets that happen to be in the module are listed in the following table: +Miscellaneous Exchange Online feature cmdlets that happen to be in the module are listed in the following table: |Cmdlet|Comments| |---|---| @@ -205,9 +200,7 @@ The procedures in this section explain how to install, update, and uninstall the ### Supported operating systems for the Exchange Online PowerShell module -The latest versions of the module are officially supported in PowerShell 7 on Windows, Linux, and Apple macOS. - -Specifically, version **2.0.4 or later** is supported in **PowerShell 7.0.3 or later**. +Versions of the module since 2021 are officially supported in PowerShell 7 on Windows, Linux, and Apple macOS (PowerShell 7.0.3 or later). For more information about PowerShell 7, see [Announcing PowerShell 7.0](https://devblogs.microsoft.com/powershell/announcing-PowerShell-7-0/). @@ -264,7 +257,7 @@ After you install PowerShell 7, do the following steps: Now you can do the [regular PowerShell prerequisites](#prerequisites-for-the-exchange-online-powershell-module) and [install the Exchange Online PowerShell module](#install-the-exchange-online-powershell-module). > [!NOTE] -> If you connect to Exchange Online PowerShell from a network that's behind a proxy server, the EXO V2 module (version v2.0.5 or earlier) doesn't work in Linux. You need to use the EXO V3 module (v3.0.0 or later) in Linux to connect from a network that's behind a proxy server. +> If you connect to Exchange Online PowerShell on Linux from a network behind a proxy server, you need to use the EXO V3 module (v3.0.0 or later). #### Windows @@ -282,7 +275,7 @@ Windows PowerShell requirements and module support **in older versions of Window - Windows Server 2008 R2 SP1² ³ ⁴ - ¹ PowerShell 7 on this version of Windows requires the [Windows 10 Universal C Runtime (CRT)](https://www.microsoft.com/download/details.aspx?id=50410). -- ² Support for this version of Windows has ended, and is now supported only in Azure virtual machines. +- ² Support for this version of Windows is over. This version of Windows is supported only in Azure virtual machines. - ³ This version of Windows supports only v2.0.3 or earlier versions of the module. - ⁴ Windows PowerShell 5.1 on this version of Windows requires the .NET Framework 4.5 or later and the Windows Management Framework 5.1. For more information, see [Windows Management Framework 5.1](https://aka.ms/wmf5download). @@ -297,7 +290,7 @@ PowerShell needs to be configured to run scripts, and by default, it isn't. You > Files cannot be loaded because running scripts is disabled on this system. Provide a valid certificate with which to sign the files. -To require all PowerShell scripts that you download from the internet are signed by a trusted publisher, run the following command in an elevated PowerShell window (a PowerShell window you open by selecting **Run as administrator**): +To require trusted publisher signing for all PowerShell scripts downloaded from the internet, run the following command in an elevated PowerShell window (a PowerShell window you open by selecting **Run as administrator**): ```powershell Set-ExecutionPolicy RemoteSigned @@ -305,56 +298,22 @@ Set-ExecutionPolicy RemoteSigned For more information about execution policies, see [About Execution Policies](/powershell/module/microsoft.powershell.core/about/about_execution_policies). -#### Turn on Basic authentication in WinRM - -> [!IMPORTANT] -> REST API connections don't require Basic authentication in WinRM as described in this section. As described [earlier in this article](#rest-api-connections-in-the-exo-v3-module), Basic authentication (remote PowerShell) access to Exchange Online PowerShell and Security & Compliance PowerShell are deprecated. The information in this section is maintained for historical purposes. - -For remote PowerShell connections that don't use the REST API (which are now impossible), WinRM needs to allow Basic authentication. **We don't send the username and password combination**. The Basic authentication **header** is required to send the session's OAuth token, because the client-side implementation of WinRM doesn't support OAuth. - -To verify that Basic authentication is enabled for WinRM, run the following command in a **Command Prompt** or **Windows PowerShell**: - -> [!NOTE] -> The following commands require that WinRM is enabled. To enable WinRM, run the following command: `winrm quickconfig`. - -```DOS -winrm get winrm/config/client/auth -``` - -If you don't see the value `Basic = true`, you need to run **one** of the following commands to enable Basic authentication for WinRM: - -- **In a Command Prompt**: - - ```DOS - winrm set winrm/config/client/auth @{Basic="true"} - ``` - -- **In Windows PowerShell**: - - ```powershell - winrm set winrm/config/client/auth '@{Basic="true"}' - ``` - -- **In Windows PowerShell to modify the registry**: + - ```PowerShell - Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client' -Name 'AllowBasic' -Type DWord -Value '1' - ``` +#### Basic authentication in WinRM -If Basic authentication for WinRM is disabled, you get one of the following errors when you try to connect using a Basic authentication (remote PowerShell) connection: +As of October 2023, REST API connections replaced basic authentication (remote PowerShell) connections in [Exchange Online PowerShell](https://techcommunity.microsoft.com/blog/exchange/deprecation-of-remote-powershell-in-exchange-online-%e2%80%93-re-enabling-or-extending-r/3779692) and [Security & Compliance PowerShell](https://techcommunity.microsoft.com/blog/exchange/deprecation-of-remote-powershell-rps-protocol-in-security-and-compliance-powersh/3815432). REST API connections don't require Basic authentication in WinRM. -> The WinRM client cannot process the request. Basic authentication is currently disabled in the client configuration. Change the client configuration and try the request again. -> -> Create Powershell Session is failed using OAuth. + -### PowerShellGet for REST API connections in Windows +### PowerShellGet required in Windows -[REST API connections](#rest-api-connections-in-the-exo-v3-module) in Windows require the PowerShellGet module, and by dependency, the PackageManagement module. Consideration for these modules is more for PowerShell 5.1 than PowerShell 7, but all versions of PowerShell benefit from having the latest versions of the modules installed. For installation and update instructions, see [Installing PowerShellGet on Windows](/powershell/scripting/gallery/installing-psget). +REST API connections in Windows require the PowerShellGet module. By dependency, the PowerShellGet module requires the PackageManagement module. Consideration for these modules is more for PowerShell 5.1 than PowerShell 7, but all versions of PowerShell benefit from having the latest versions of the modules installed. For installation and update instructions, see [Installing PowerShellGet on Windows](/powershell/scripting/gallery/installing-psget). > [!TIP] -> Beta versions of the PackageManagement or PowerShellGet modules might cause connection issues. If you have connection issues, verify that you don't have Beta versions of the modules installed by running the following command: `Get-InstalledModule PackageManagement -AllVersions; Get-InstalledModule PowerShellGet -AllVersions`. +> Preview versions of the PackageManagement or PowerShellGet modules might cause connection issues. If you have connection issues, verify that you don't have preview versions of the modules installed by running the following command: `Get-InstalledModule PackageManagement -AllVersions; Get-InstalledModule PowerShellGet -AllVersions`. -If you don't have PowerShellGet installed when you try to create a REST API connection, you get the following error when you try to connect: +If you don't have PowerShellGet installed when you try to connect, you get the following error: > Cannot find a cmdlet Update-Manifest @@ -364,9 +323,9 @@ To install the module for the first time, complete the following steps: 1. Install or update the PowerShellGet module as described in [Installing PowerShellGet](/powershell/scripting/gallery/installing-psget). -2. Close and re-open the Windows PowerShell window. +2. Close and reopen the Windows PowerShell window. -3. Now you can use the **Install-Module** cmdlet to install the module from the PowerShell Gallery. Typically, you want the latest public version of the module, but you can also install a Preview version if any are available. +3. Now you can use the **Install-Module** cmdlet to install the module from the PowerShell Gallery. Typically, you want the latest public version of the module, but you can also install a Preview version that's newer than the current version. - To install **the latest public version** of the module, run **one** of the following commands: @@ -486,7 +445,7 @@ If the module is already installed on your computer, you can use the procedures When you're finished, enter **Y** to accept the license agreement. -3. To confirm that the update was successful, run the following commands to check the version information of the module that's installed: +3. To confirm that the update was successful, run the following commands to check the version information of the installed module: ```powershell Import-Module ExchangeOnlineManagement; Get-Module ExchangeOnlineManagement @@ -504,7 +463,7 @@ For detailed syntax and parameter information, see [Update-Module](/powershell/m > WARNING: Unable to download the list of available providers. Check your internet connection. - Update your installation of the PowerShellGet module to the latest version as described in [Installing PowerShellGet](/powershell/scripting/gallery/installing-psget). Be sure to close and re-open the PowerShell window before you attempt to update the ExchangeOnlineManagement module again. + Update your installation of the PowerShellGet module to the latest version as described in [Installing PowerShellGet](/powershell/scripting/gallery/installing-psget). Be sure to close and reopen the PowerShell window before you attempt to update the ExchangeOnlineManagement module again. - You receive the following error: @@ -571,7 +530,7 @@ For detailed syntax and parameter information, see [Uninstall-Module](/powershel Traditional Exchange Online cmdlets return all possible object properties, including many blank or uninteresting properties. This behavior causes degraded performance (more server computation and added network load). You rarely (if ever) need the full complement of properties in the cmdlet output. -The **Get-EXO\*** cmdlets in the module have categorized output properties. Instead of giving all properties equal importance and returning them in all scenarios, we categorized specific related properties into _property sets_. These property sets are buckets of two or more related properties on the cmdlet. +The **Get-EXO\*** cmdlets in the module contain categorized output properties. Instead of giving all properties equal importance and returning them in all scenarios, we categorized specific related properties into _property sets_. These property sets are buckets of two or more related properties on the cmdlet. The biggest and most used **Get-EXO\*** cmdlets use property sets: @@ -580,7 +539,7 @@ The biggest and most used **Get-EXO\*** cmdlets use property sets: - [Get-EXOMailboxStatistics](/powershell/module/exchange/get-exomailboxstatistics) - [Get-EXORecipient](/powershell/module/exchange/get-exorecipient) -In those cmdlets, property sets are controlled by the following parameters: +In those cmdlets, the following parameters control property sets: - _PropertySets_: This parameter accepts one or more available property set names separated by commas. The available property sets are described in [Property sets in Exchange Online PowerShell module cmdlets](cmdlet-property-sets.md). - _Properties_: This parameter accepts one or more property names separated by commas. @@ -616,8 +575,8 @@ Unless otherwise noted, the current release of the Exchange Online PowerShell mo #### Version 3.8.0 - Support for providing an access token with **Connect-IPPSSession**. -- **Get-VivaModuleFeature** now returns information about ParentFeature, ChildFeature, and PolicyModes. These values represents parent and child features of a Viva app feature along with available enablement modes for future policies. -- New parameters _IsUserOptedInByDefault_ on the **Add-VivaModuleFeaturePolicy** and **Update-VivaModuleFeaturePolicy** cmdlets and the corresponding property value in all **\*-VivaModuleFeaturePolicy** cmdlets. The value indicates if users are opted in or out by the policy, as long as the user hasn't set a preference. +- **Get-VivaModuleFeature** now returns information about ParentFeature, ChildFeature, and PolicyModes. These values represent parent and child features of a Viva app feature along with available enablement modes for future policies. +- New parameters _IsUserOptedInByDefault_ on the **Add-VivaModuleFeaturePolicy** and **Update-VivaModuleFeaturePolicy** cmdlets and the corresponding property value in all **\*-VivaModuleFeaturePolicy** cmdlets. The value indicates if users are opted in or out by the policy, as long as the user doesn't set a preference. You can use this parameter to keep the feature enabled in your organization while opting out the impacted users by default, effectively soft disabling the feature for those users. @@ -645,21 +604,21 @@ Unless otherwise noted, the current release of the Exchange Online PowerShell mo #### Version 3.6.0 -- **Get-VivaModuleFeature** now returns information about the kinds of identities that the feature supports creating policies for (for example, users, groups, or the entire tenant). +- **Get-VivaModuleFeature** now returns information about the kinds of identities that the feature supports creating policies for (for example, users, groups, or the entire organization). - Cmdlets for Viva feature access management now handle continuous access evaluation (CAE) claim challenges. - Added fix for compatibility issue with the Microsoft.Graph module. #### Version 3.5.1 - Bug fixes in **Get-EXOMailboxPermission** and **Get-EXOMailbox**. -- The module has been upgraded to run on .NET 8, replacing the previous version based on .NET 6. +- The module is upgraded to run on .NET 8, replacing the previous version based on .NET 6. - Enhancements in **Add-VivaModuleFeaturePolicy**. #### Version 3.5.0 - New **Get-VivaFeatureCategory** cmdlet. - Added support for policy operations at the category level in Viva Feature Access Management (VFAM). -- New IsFeatureEnabledByDefault property in the output of **Get-VivaModuleFeaturePolicy**. The value of this property shows the default enablement state for users in the tenant when no tenant or user/group policies were created. +- New IsFeatureEnabledByDefault property in the output of **Get-VivaModuleFeaturePolicy**. The value of this property shows the default enablement state for users when no organization or user/group policies were created. #### Version 3.4.0 @@ -699,12 +658,12 @@ Unless otherwise noted, the current release of the Exchange Online PowerShell mo - The [Get-ConnectionInformation](/powershell/module/exchange/get-connectioninformation) cmdlet for REST-based connections (version 2.0.6-Preview7 or later). - The _SkipLoadingFormatData_ switch on the **Connect-ExchangeOnline** cmdlet for REST-based connections (version 2.0.6-Preview8 or later). - The _DelegatedOrganization_ parameter works in the **Connect-IPPSSession** cmdlet as long as you also use the _AzureADAuthorizationEndpointUri_ parameter in the command. -- Certain cmdlets that used to prompt for confirmation in specific scenarios no longer do so. By default, the cmdlet runs to completion. +- Certain cmdlets that prompted for confirmation in specific scenarios no longer do so. By default, the cmdlet runs to completion. - The format of the error returned from failed cmdlet execution is slightly modified. The exception now contains more data (for example, the exception type), and the `FullyQualifiedErrorId` doesn't contain the `FailureCategory`. The format of the error is subject to further modification. #### Version 2.0.5 -- New **Get-OwnerlessGroupPolicy** and **Set-OwnerlessGroupPolicy** cmdlets to manage ownerless Microsoft 365 groups. +- New **Get-OwnerlessGroupPolicy** and **Set-OwnerlessGroupPolicy** cmdlets to manage ownerless Microsoft 365 Groups. > [!NOTE] > Although the _cmdlets_ are available in the module, the _feature_ is only available to members of a Private Preview. @@ -735,13 +694,13 @@ Unless otherwise noted, the current release of the Exchange Online PowerShell mo - Connect to Exchange Online PowerShell and Security & Compliance PowerShell simultaneously in a single PowerShell window. - The new _CommandName_ parameter allows you to specify and restrict the Exchange Online PowerShell cmdlets that are imported in a session. This option reduces the memory footprint for high usage PowerShell applications. - **Get-EXOMailboxFolderPermission** now supports ExternalDirectoryObjectID in the _Identity_ parameter. -- Optimized latency of the first V2 cmdlet call. Lab results show the first call latency has been reduced from 8 seconds to approximately 1 second. Actual results depend on the cmdlet result size and the tenant environment. +- Optimized latency of the first V2 cmdlet call. Lab results show the first call latency decreased from 8 seconds to approximately 1 second. Actual results depend on the cmdlet result size and the organization environment. #### Version 1.0.1 - General Availability (GA) version of the EXO V2 module. It's stable and ready for use in production environments. - **Get-EXOMobileDeviceStatistics** cmdlet now supports the _Identity_ parameter. -- Improved reliability of session auto-reconnect in certain cases where a script was running for ~50 minutes and threw a "Cmdlet not found" error due to a bug in auto-reconnect logic. +- Improved reliability for auto reconnect of sessions in certain scenarios where a script was running for ~50 minutes and threw a "Cmdlet not found" error due to a bug in auto reconnect logic. - Fixed data-type issues of two commonly used "User" and "MailboxFolderUser" attributes for easy migration of scripts. - Enhanced support for filters as it now supports four more operators: EndsWith, Contains, Not and NotLike support. Check [Filters in the Exchange Online PowerShell module](filters-v2.md) for attributes that aren't supported in filters. @@ -752,15 +711,15 @@ Unless otherwise noted, the current release of the Exchange Online PowerShell mo - You can now use `FolderId` as an identity parameter in **Get-EXOMailboxFolderPermission**. You can get the `FolderId` value using **Get-MailboxFolder**. For example: `Get-MailboxFolderPermission -Identity :` `Get-MailboxFolderPermission -Identity :\` -- Improved reliability of **Get-EXOMailboxStatistics** as certain request routing errors that led to failures have been resolved. -- Optimized memory usage when a session is created by re-using any existing module with a new session instead of creating a new one every time a session is imported. +- Improved reliability of **Get-EXOMailboxStatistics** as certain request routing errors that led to failures are resolved. +- Optimized memory usage for new sessions created from reusing existing modules instead of creating a new session every time a session is imported. #### Version 0.4368.1 - Added support for Security & Compliance PowerShell cmdlets using the **Connect-IPPSSession** cmdlet. - Hiding the announcement banner is available using the _ShowBanner_ switch (`-ShowBanner:$false`). - Terminate cmdlet execution on client exception. -- Remote PowerShell contained various complex data types that were intentionally not supported in EXO cmdlets to improve performance. Differences in non-complex data types between remote PowerShell cmdlets and V2 cmdlets have been resolved to allow seamless migration of management scripts. +- Remote PowerShell contained various complex data types that were intentionally not supported in EXO cmdlets to improve performance. Differences in noncomplex data types between remote PowerShell cmdlets and V2 cmdlets are resolved to allow seamless migration of management scripts. #### Version 0.3582.0 @@ -784,7 +743,7 @@ Unless otherwise noted, the current release of the Exchange Online PowerShell mo #### Version 0.3527.3 -- Added support for managing Exchange for a different tenant using delegation flow. +- Added support for managing Exchange for a different organization using delegation flow. - Works in tandem with other PowerShell modules in a single PowerShell window. - Added support for positional parameters. - Date Time field now supports client locale. diff --git a/exchange/docs-conceptual/exchange-online-powershell.md b/exchange/docs-conceptual/exchange-online-powershell.md index 348084ae8d..0f485e3fbc 100644 --- a/exchange/docs-conceptual/exchange-online-powershell.md +++ b/exchange/docs-conceptual/exchange-online-powershell.md @@ -16,13 +16,10 @@ description: "Learn about articles that are available for using PowerShell in Ex # Exchange Online PowerShell -Exchange Online PowerShell is the administrative interface that enables you to manage the Exchange Online part of your Microsoft 365 organization from the command line (including many security features in Exchange Online Protection and Microsoft Defender for Office 365). For example, you can use Exchange Online PowerShell to configure mail flow rules (also known as transport rules) and connectors. The following articles provide information about using Exchange Online PowerShell: +Exchange Online PowerShell is the administrative interface that enables you to manage the Exchange Online part of your Microsoft 365 organization from the command line (including many default email protections for all cloud mailboxes and protections in Microsoft Defender for Office 365). For example, you can use Exchange Online PowerShell to configure mail flow rules (also known as transport rules) and connectors. The following articles provide information about using Exchange Online PowerShell: - To learn about the ExchangeOnlineManagement module that's required to connect to Exchange Online PowerShell, see [About the Exchange Online PowerShell module](exchange-online-powershell-v2.md). - > [!TIP] - > Version 3.0.0 and later (2022) is known as the Exchange Online PowerShell V3 module (abbreviated as the EXO V3 module). Version 2.0.5 and earlier (2021) was known as the Exchange Online PowerShell V2 module (abbreviated as the EXO V2 module). - To learn about what's new in the Exchange Online PowerShell module, see [What's new in the Exchange Online PowerShell module](whats-new-in-the-exo-module.md). - To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](connect-to-exchange-online-powershell.md). @@ -41,6 +38,6 @@ Exchange Online PowerShell is the administrative interface that enables you to m - To learn about recipient filters in Exchange Online PowerShell, see [Recipient filters in Exchange Management Shell and Exchange Online PowerShell commands](recipient-filters.md). -- To learn about recipient filters for the nine exclusive **Get-EXO\*** cmdlets in the Exchange Online PowerShell, see [Filters in the Exchange Online PowerShell module](filters-v2.md). +- To learn about recipient filters for the nine exclusive **Get-EXO\*** cmdlets in the Exchange Online PowerShell module, see [Filters in the Exchange Online PowerShell module](filters-v2.md). - To learn about property sets in the nine exclusive **Get-EXO\*** cmdlets in the Exchange Online PowerShell module, see [Property sets in Exchange Online PowerShell module cmdlets](cmdlet-property-sets.md). diff --git a/exchange/docs-conceptual/exchange-online-protection-powershell.md b/exchange/docs-conceptual/exchange-online-protection-powershell.md index 93e9dd4bf7..cb28f5339f 100644 --- a/exchange/docs-conceptual/exchange-online-protection-powershell.md +++ b/exchange/docs-conceptual/exchange-online-protection-powershell.md @@ -1,39 +1,36 @@ --- -title: "Exchange Online Protection PowerShell" +title: "Exchange Online Protection PowerShell for cloud protection of on-premises email environments" ms.author: chrisda author: chrisda manager: deniseb -ms.date: 9/1/2023 +ms.date: 07/11/2025 ms.audience: Admin audience: Admin ms.topic: article ms.service: exchange-powershell ms.localizationpriority: medium ms.assetid: f7918a88-774a-405e-945b-bc2f5ee9f748 -description: "Learn about the articles that are available for using PowerShell in Exchange Online Protection (EOP) only organizations without cloud mailboxes." +description: "Learn about the articles available for using Exchange Online Protection PowerShell to manage cloud protection features for on-premises email environments." --- -# Exchange Online Protection PowerShell +# Exchange Online Protection PowerShell for cloud protection of on-premises email environments -Exchange Online Protection PowerShell is the administrative interface that enables you to manage security features in Exchange Online Protection (EOP) organizations from the command line. For example, you can use Exchange Online Protection PowerShell to configure anti-spam policies, mail flow rules (also known as transport rules) and connectors. +Exchange Online Protection PowerShell is the administrative interface that enables you to manage cloud protection features for on-premises email environments from the command line. For example, you can use Exchange Online Protection PowerShell to configure anti-spam policies, mail flow rules (also known as transport rules) and connectors to support on-premises email protection. > [!TIP] -> Microsoft 365 organizations with cloud mailboxes (Microsoft 365 A3/E3/G3, A5/E5/G5, Microsoft 365 Business Premium, etc.) use [Exchange Online PowerShell](exchange-online-powershell.md) to manage these same features. +> All organizations with cloud mailboxes (Microsoft 365 A3/E3/G3, A5/E5/G5, Microsoft 365 Business Premium, etc.) use [Exchange Online PowerShell](exchange-online-powershell.md) to manage these same features for cloud email protection. -Exchange Online Protection PowerShell includes the following environments: +Exchange Online Protection PowerShell for cloud protection of on-premises email environments is available in the following scenarios: -- **Standalone EOP organizations**: Your Microsoft 365 subscription includes no Exchange Online mailboxes, because you use EOP to protect your on-premises email environment. -- **Exchange Enterprise CAL with Services**: The licenses for your on-premises Exchange organization include Exchange Enterprise CAL with Services (EOP is one of the services). +- **On-premises email environments (not just Microsoft Exchange)**: Mail from the internet passes through cloud protection and filtering before delivery to on-premises recipients. The cloud environment contains no mailboxes. +- **Exchange Enterprise CAL with Services**: The licenses for your on-premises Exchange organization include Exchange Enterprise CAL with Services (cloud protection of on-premises mailboxes is one of the services). -The following articles provide information about using Exchange Online Protection PowerShell: +The following articles provide information about using Exchange Online Protection PowerShell for cloud protection of on-premises email environments: -- To learn about the ExchangeOnlineManagement module that's required to connect to standalone Exchange Online Protection PowerShell, see [About the Exchange Online PowerShell module](exchange-online-powershell-v2.md). - - > [!TIP] - > Version 3.0.0 and later (2022) is known as the Exchange Online PowerShell V3 module (abbreviated as the EXO V3 module). Version 2.0.5 and earlier (2021) was known as the Exchange Online PowerShell V2 module (abbreviated as the EXO V2 module). +- To learn about the ExchangeOnlineManagement module that's required to connect to Exchange Online Protection PowerShell, see [About the Exchange Online PowerShell module](exchange-online-powershell-v2.md). To learn about what's new in the Exchange Online PowerShell module, see [What's new in the Exchange Online PowerShell module](whats-new-in-the-exo-module.md). -- To connect to Exchange Online Protection PowerShell, see [Connect to Exchange Online Protection PowerShell](connect-to-exchange-online-protection-powershell.md). +- The connection instructions for Exchange Online Protection PowerShell and Exchange Online PowerShell are the same. For instructions, see [Connect to Exchange Online PowerShell](connect-to-exchange-online-powershell.md). -- To learn about the structure and layout of the cmdlet reference articles in Exchange Online Protection PowerShell, see [Exchange cmdlet syntax](exchange-cmdlet-syntax.md). +- To learn about the structure and layout of the cmdlet reference articles, see [Exchange cmdlet syntax](exchange-cmdlet-syntax.md). diff --git a/exchange/docs-conceptual/find-exchange-cmdlet-permissions.md b/exchange/docs-conceptual/find-exchange-cmdlet-permissions.md index e19393384e..6b4f22af79 100644 --- a/exchange/docs-conceptual/find-exchange-cmdlet-permissions.md +++ b/exchange/docs-conceptual/find-exchange-cmdlet-permissions.md @@ -50,8 +50,7 @@ You can use PowerShell to find the permissions required to run any Exchange or E ## Use PowerShell to find the permissions required to run a cmdlet 1. If you haven't already, open the Exchange PowerShell environment that you're interested in: - - **Exchange Online**: [Connect to Exchange Online PowerShell](connect-to-exchange-online-powershell.md). - - **Exchange Online Protection** (Microsoft 365 organizations without Exchange Online mailboxes): [Connect to Exchange Online Protection PowerShell](connect-to-exchange-online-protection-powershell.md). + - **Exchange Online PowerShell**: [Connect to Exchange Online PowerShell](connect-to-exchange-online-powershell.md). - **Exchange Server**: [Open the Exchange Management Shell](open-the-exchange-management-shell.md) or [Connect to Exchange servers using remote PowerShell](connect-to-exchange-servers-using-remote-powershell.md). 2. Replace `` and optionally, `,,...` with the values that you want to use, and run the following command: diff --git a/exchange/docs-conceptual/index.yml b/exchange/docs-conceptual/index.yml index 7fe140c922..31d1e247ed 100644 --- a/exchange/docs-conceptual/index.yml +++ b/exchange/docs-conceptual/index.yml @@ -31,7 +31,7 @@ landingContent: url: /powershell/exchange/exchange-online-powershell - text: Security & Compliance PowerShell url: /powershell/exchange/scc-powershell - - text: Exchange Online Protection PowerShell + - text: Exchange Online Protection PowerShell for cloud protection of on-premises email environments url: /powershell/exchange/exchange-online-protection-powershell - title: Connect linkLists: @@ -45,8 +45,6 @@ landingContent: url: /powershell/exchange/connect-to-exchange-online-powershell - text: Connect to Security & Compliance PowerShell url: /powershell/exchange/connect-to-scc-powershell - - text: Connect to Exchange Online Protection PowerShell - url: /powershell/exchange/connect-to-exchange-online-protection-powershell - title: More linkLists: - linkListType: overview diff --git a/exchange/docs-conceptual/scc-powershell.md b/exchange/docs-conceptual/scc-powershell.md index e5ec203673..bf972d6ad0 100644 --- a/exchange/docs-conceptual/scc-powershell.md +++ b/exchange/docs-conceptual/scc-powershell.md @@ -25,7 +25,7 @@ Security & Compliance PowerShell is the administrative interface that enables yo To learn about what's new in the Exchange Online PowerShell module, see [What's new in the Exchange Online PowerShell module](whats-new-in-the-exo-module.md). -- To connect to Security & Compliance PowerShell, see [Connect to Security & Compliance PowerShell](connect-to-scc-powershell.md). The connection instructions are different from Exchange Online PowerShell or standalone Exchange Online Protection (EOP) PowerShell. +- To connect to Security & Compliance PowerShell, see [Connect to Security & Compliance PowerShell](connect-to-scc-powershell.md). The connection instructions are different from Exchange Online PowerShell. To connect to Security & Compliance PowerShell for unattended scripts, see [App-only authentication for unattended scripts in the Exchange Online PowerShell module](app-only-auth-powershell-v2.md). @@ -35,7 +35,7 @@ Security & Compliance PowerShell contains the following types of cmdlets: - Cmdlets that correspond to features available only in Purview compliance and the Microsoft Purview compliance portal. Most cmdlets in Security & Compliance PowerShell fall into this category. - Basic cmdlets that are also available in Exchange Online PowerShell (for example, [Get-User](/powershell/module/exchange/get-user), and [Get-RoleGroup](/powershell/module/exchange/get-rolegroup)). -- A few cmdlets that correspond to security features available in Exchange Online Protection (EOP) and Microsoft Defender for Office 365 in the Microsoft Defender portal (for example, [Set-SecOpsOverridePolicy](/powershell/module/exchange/set-secopsoverridepolicy)). +- A few cmdlets that correspond to default protections for cloud mailboxes and protections in Microsoft Defender for Office 365 in the Microsoft Defender portal (for example, [Set-SecOpsOverridePolicy](/powershell/module/exchange/set-secopsoverridepolicy)). Cmdlets for most EOP and Defender for Office 365 security features (for example, [anti-spam policies](/defender-office-365/anti-spam-protection-about)) are available only in [Exchange Online PowerShell](exchange-online-powershell.md). diff --git a/exchange/docs-conceptual/toc.yml b/exchange/docs-conceptual/toc.yml index b19c66c699..fdf23fce6e 100644 --- a/exchange/docs-conceptual/toc.yml +++ b/exchange/docs-conceptual/toc.yml @@ -28,7 +28,7 @@ items: - name: About the Exchange Online PowerShell module href: exchange-online-powershell-v2.md - - name: Connect to Exchange Online PowerShell - modern auth and MFA + - name: Connect to Exchange Online PowerShell href: connect-to-exchange-online-powershell.md - name: Connect using app-only authentication for unattended scripts href: app-only-auth-powershell-v2.md @@ -62,7 +62,7 @@ items: - name: About the Exchange Online PowerShell module href: exchange-online-powershell-v2.md - - name: Connect to Security & Compliance PowerShell - modern auth and MFA + - name: Connect to Security & Compliance PowerShell href: connect-to-scc-powershell.md - name: App-only authentication for unattended scripts href: app-only-auth-powershell-v2.md @@ -72,13 +72,13 @@ href: client-advanced-settings.md - name: What's new in the Exchange Online PowerShell module href: whats-new-in-the-exo-module.md - - name: Exchange Online Protection PowerShell + - name: Exchange Online Protection PowerShell for cloud protection of on-premises email environments href: exchange-online-protection-powershell.md items: - name: About the Exchange Online PowerShell module href: exchange-online-powershell-v2.md - - name: Connect to Exchange Online Protection PowerShell - modern auth and MFA - href: connect-to-exchange-online-protection-powershell.md + - name: Connect to Exchange Online Protection PowerShell + href: connect-to-exchange-online-powershell.md - name: Exchange cmdlet syntax href: exchange-cmdlet-syntax.md - name: What's new in the Exchange Online PowerShell module diff --git a/exchange/docs-conceptual/whats-new-in-the-exo-module.md b/exchange/docs-conceptual/whats-new-in-the-exo-module.md index b95ba6f12f..8fd4fe23ec 100644 --- a/exchange/docs-conceptual/whats-new-in-the-exo-module.md +++ b/exchange/docs-conceptual/whats-new-in-the-exo-module.md @@ -20,7 +20,7 @@ description: "Learn about the new features and functionality available in the la # What's new in the Exchange Online PowerShell module -This article lists new features in the Exchange Online PowerShell module that's used for connecting to Exchange Online PowerShell, Security & Compliance PowerShell, and standalone Exchange Online Protection (EOP) PowerShell. Features that are currently in preview are denoted with **(preview)**. +This article lists new features in the Exchange Online PowerShell module used for connecting to Exchange Online PowerShell, Security & Compliance PowerShell, and Exchange Online Protection PowerShell for cloud protection of on-premises email environments. Features that are currently in preview are denoted with **(preview)**. ## May 2025 diff --git a/exchange/exchange-ps/exchange/Connect-ExchangeOnline.md b/exchange/exchange-ps/exchange/Connect-ExchangeOnline.md index 96f0891ba3..241205492f 100644 --- a/exchange/exchange-ps/exchange/Connect-ExchangeOnline.md +++ b/exchange/exchange-ps/exchange/Connect-ExchangeOnline.md @@ -15,7 +15,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the Exchange Online PowerShell module. For more information, see [About the Exchange Online PowerShell module](https://aka.ms/exov3-module). -Use the Connect-ExchangeOnline cmdlet in the Exchange Online PowerShell module to connect to Exchange Online PowerShell or standalone Exchange Online Protection PowerShell using modern authentication. This cmdlet works for accounts with or without multi-factor authentication (MFA). +Use the Connect-ExchangeOnline cmdlet in the Exchange Online PowerShell module to use modern authentication to connect to Exchange Online PowerShell or Exchange Online Protection PowerShell for cloud protection of on-premises email environments. This cmdlet works for accounts with or without multi-factor authentication (MFA). To connect to Security & Compliance PowerShell, use the [Connect-IPPSSession](https://learn.microsoft.com/powershell/module/exchange/connect-ippssession) cmdlet. diff --git a/exchange/exchange-ps/exchange/Get-EOPProtectionPolicyRule.md b/exchange/exchange-ps/exchange/Get-EOPProtectionPolicyRule.md index 6ca809c445..b10e5bcf46 100644 --- a/exchange/exchange-ps/exchange/Get-EOPProtectionPolicyRule.md +++ b/exchange/exchange-ps/exchange/Get-EOPProtectionPolicyRule.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Get-EOPProtectionPolicyRule cmdlet to view rules for Exchange Online Protection (EOP) protections in preset security policies. The rules specify recipient conditions and exceptions for the protection, and also allow you to turn on and turn off the associated preset security policies. +Use the Get-EOPProtectionPolicyRule cmdlet to view rules for default email protections for all cloud mailboxes in preset security policies. The rules specify recipient conditions and exceptions for the protection, and also allow you to turn on and turn off the associated preset security policies. For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Get-ExoPhishSimOverrideRule.md b/exchange/exchange-ps/exchange/Get-ExoPhishSimOverrideRule.md index 0baced66e2..06a2ade932 100644 --- a/exchange/exchange-ps/exchange/Get-ExoPhishSimOverrideRule.md +++ b/exchange/exchange-ps/exchange/Get-ExoPhishSimOverrideRule.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Get-ExoPhishSimOverrideRule cmdlet to view third-party phishing simulation override rules to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Get-ExoPhishSimOverrideRule cmdlet to view third-party phishing simulation override rules that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Get-ExoSecOpsOverrideRule.md b/exchange/exchange-ps/exchange/Get-ExoSecOpsOverrideRule.md index 4f8ca933c6..e315241786 100644 --- a/exchange/exchange-ps/exchange/Get-ExoSecOpsOverrideRule.md +++ b/exchange/exchange-ps/exchange/Get-ExoSecOpsOverrideRule.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Get-ExoSecOpsOverrideRule cmdlet to view SecOps mailbox override rules to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Get-ExoSecOpsOverrideRule cmdlet to view SecOps mailbox override rules that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Get-MailDetailATPReport.md b/exchange/exchange-ps/exchange/Get-MailDetailATPReport.md index 910389aec2..2894c21ea7 100644 --- a/exchange/exchange-ps/exchange/Get-MailDetailATPReport.md +++ b/exchange/exchange-ps/exchange/Get-MailDetailATPReport.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Get-MailDetailATPReport cmdlet to list details about Exchange Online Protection and Microsoft Defender for Office 365 detections in your cloud-based organization for the last 10 days. +Use the Get-MailDetailATPReport cmdlet to list details about Microsoft Defender for Office 365 detections in your cloud-based organization for the last 10 days. For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Get-MailTrafficATPReport.md b/exchange/exchange-ps/exchange/Get-MailTrafficATPReport.md index b18dc3f97a..f846e08198 100644 --- a/exchange/exchange-ps/exchange/Get-MailTrafficATPReport.md +++ b/exchange/exchange-ps/exchange/Get-MailTrafficATPReport.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Get-MailTrafficATPReport cmdlet to view the results of Exchange Online Protection and Microsoft Defender for Office 365 detections in your cloud-based organization for the last 90 days. +Use the Get-MailTrafficATPReport cmdlet to view the results of Microsoft Defender for Office 365 detections in your cloud-based organization for the last 90 days. For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Get-MailboxJunkEmailConfiguration.md b/exchange/exchange-ps/exchange/Get-MailboxJunkEmailConfiguration.md index bc4b367757..4f8fe4884f 100644 --- a/exchange/exchange-ps/exchange/Get-MailboxJunkEmailConfiguration.md +++ b/exchange/exchange-ps/exchange/Get-MailboxJunkEmailConfiguration.md @@ -34,7 +34,7 @@ The junk email settings on the mailbox are: - Enable or disable the junk email rule: In on-premises Exchange, the junk email rule (a hidden Inbox rule named Junk E-mail Rule) controls the delivery of messages to the Junk Email folder or the Inbox based on the SCL Junk Email Folder threshold (for the organization or the mailbox) and the safelist collection on the mailbox. - In the cloud-based service, the junk email rule has no effect on mail flow. Exchange Online Protection delivers messages to the Junk Email folder based on the actions set in anti-spam policies. The junk email rule on the mailbox still controls what happens to messages after delivery based on the safelist collection of the mailbox. + In the cloud-based service, the junk email rule has no effect on mail flow. Messages are delivered to the Junk Email folder based on the actions set in anti-spam policies. The junk email rule on the mailbox still controls what happens to messages after delivery based on the safelist collection of the mailbox. Users can enable or disable the junk email rule in their own mailbox by using Outlook on the web. diff --git a/exchange/exchange-ps/exchange/Get-PhishSimOverridePolicy.md b/exchange/exchange-ps/exchange/Get-PhishSimOverridePolicy.md index 7cb3d2c953..c5fcf6330b 100644 --- a/exchange/exchange-ps/exchange/Get-PhishSimOverridePolicy.md +++ b/exchange/exchange-ps/exchange/Get-PhishSimOverridePolicy.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Get-PhishSimOverridePolicy cmdlet to view third-party phishing simulation override policies to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Get-PhishSimOverridePolicy cmdlet to view third-party phishing simulation override policies that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Get-SecOpsOverridePolicy.md b/exchange/exchange-ps/exchange/Get-SecOpsOverridePolicy.md index 31c46f8403..3f5f28a83b 100644 --- a/exchange/exchange-ps/exchange/Get-SecOpsOverridePolicy.md +++ b/exchange/exchange-ps/exchange/Get-SecOpsOverridePolicy.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Get-SecOpsOverridePolicy cmdlet to view SecOps mailbox override policies to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Get-SecOpsOverridePolicy cmdlet to view SecOps mailbox override policies that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/New-EOPProtectionPolicyRule.md b/exchange/exchange-ps/exchange/New-EOPProtectionPolicyRule.md index 0f0e180485..f070348810 100644 --- a/exchange/exchange-ps/exchange/New-EOPProtectionPolicyRule.md +++ b/exchange/exchange-ps/exchange/New-EOPProtectionPolicyRule.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the New-EOPProtectionPolicyRule cmdlet to create rules for Exchange Online Protection (EOP) protections in preset security policies. The rules specify recipient conditions and exceptions for the protection, and also allow you to turn on and turn off the associated preset security policies. +Use the New-EOPProtectionPolicyRule cmdlet to create rules for default email protections for all cloud mailboxes in preset security policies. The rules specify recipient conditions and exceptions for the protection, and also allow you to turn on and turn off the associated preset security policies. **Note**: Unless you manually removed a rule using the Remove-EOPProtectionPolicyRule cmdlet, we don't recommend using this cmdlet to create rules. To create the rule, you need to specify the existing individual security policies that are associated with the preset security policy. We never recommend creating these required individual security policies manually. Turning on the preset security policy for the first time in the Microsoft Defender portal automatically creates the required individual security policies, but also creates the associated rules using this cmdlet. So, if the rules already exist, you don't need to use this cmdlet to create them. diff --git a/exchange/exchange-ps/exchange/New-ExoPhishSimOverrideRule.md b/exchange/exchange-ps/exchange/New-ExoPhishSimOverrideRule.md index cc46098b0a..7f59781969 100644 --- a/exchange/exchange-ps/exchange/New-ExoPhishSimOverrideRule.md +++ b/exchange/exchange-ps/exchange/New-ExoPhishSimOverrideRule.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the New-ExoPhishSimOverrideRule cmdlet to create third-party phishing simulation override rules to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the New-ExoPhishSimOverrideRule cmdlet to create third-party phishing simulation override rules that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/New-ExoSecOpsOverrideRule.md b/exchange/exchange-ps/exchange/New-ExoSecOpsOverrideRule.md index 7abc967735..0761211fff 100644 --- a/exchange/exchange-ps/exchange/New-ExoSecOpsOverrideRule.md +++ b/exchange/exchange-ps/exchange/New-ExoSecOpsOverrideRule.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the New-ExoSecOpsOverrideRule cmdlet to create SecOps mailbox override rules to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the New-ExoSecOpsOverrideRule cmdlet to create SecOps mailbox override rules that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/New-HostedContentFilterPolicy.md b/exchange/exchange-ps/exchange/New-HostedContentFilterPolicy.md index ef6356928d..c11691fd96 100644 --- a/exchange/exchange-ps/exchange/New-HostedContentFilterPolicy.md +++ b/exchange/exchange-ps/exchange/New-HostedContentFilterPolicy.md @@ -284,7 +284,7 @@ The BulkSpamAction parameter specifies the action to take on messages that are m - AddXHeader: Add the AddXHeaderValue parameter value to the message header and deliver the message. - Delete: Delete the message during filtering. Use caution when selecting this value, because you can't recover the deleted message. - ModifySubject: Add the ModifySubject parameter value to the beginning of the subject line, deliver the message, and move the message to the Junk Email folder (same caveats as MoveToJmf). -- MoveToJmf: This is the default value. Deliver the message to the Junk Email folder in the recipient's mailbox. In standalone Exchange Online Protection environments, you need to configure mail flow rules in your on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). +- MoveToJmf: This is the default value. Deliver the message to the Junk Email folder in the recipient's mailbox. Hybrid environments need mail flow rules in the on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). - NoAction - Quarantine: Deliver the message to quarantine. By default, messages that are quarantined as bulk email are available to the intended recipients and admins. Or, you can use the BulkQuarantineTag parameter to specify what end-users are allowed to do on quarantined messages. - Redirect: Redirect the message to the recipients specified by the RedirectToRecipients parameter. @@ -556,7 +556,7 @@ The HighConfidenceSpamAction parameter specifies the action to take on messages - AddXHeader: Add the AddXHeaderValue parameter value to the message header, deliver the message, and move the message to the Junk Email folder (same caveats as MoveToJmf). - Delete: Delete the message during filtering. Use caution when selecting this value, because you can't recover the deleted message. - ModifySubject: Add the ModifySubject parameter value to the beginning of the subject line, deliver the message, and move the message to the Junk Email folder (same caveats as MoveToJmf). -- MoveToJmf: Deliver the message to the Junk Email folder in the recipient's mailbox. In standalone Exchange Online Protection environments, you need to configure mail flow rules in your on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). +- MoveToJmf: Deliver the message to the Junk Email folder in the recipient's mailbox. Hybrid environments need mail flow rules in the on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). - Quarantine: Deliver the message to quarantine. By default, messages that are quarantined as high confidence spam are available to the intended recipients and admins. Or, you can use the HighConfidenceSpamQuarantineTag parameter to specify what end-users are allowed to do on quarantined messages. - Redirect: Redirect the message to the recipients specified by the RedirectToRecipients parameter. @@ -1171,7 +1171,7 @@ The SpamAction parameter specifies the action to take on messages that are marke - AddXHeader: Add the AddXHeaderValue parameter value to the message header, deliver the message, and move the message to the Junk Email folder (same caveats as MoveToJmf). - Delete : Delete the message during filtering. Use caution when selecting this value, because you can't recover the deleted message. - ModifySubject: Add the ModifySubject parameter value to the beginning of the subject line, deliver the message, and move the message to the Junk Email folder (same caveats as MoveToJmf). -- MoveToJmf: This is the default value. Deliver the message to the Junk Email folder in the recipient's mailbox. In standalone Exchange Online Protection environments, you need to configure mail flow rules in your on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). +- MoveToJmf: This is the default value. Deliver the message to the Junk Email folder in the recipient's mailbox. Hybrid environments need mail flow rules in the on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). - Quarantine: Deliver the message to quarantine. By default, messages that are quarantined as spam are available to the intended recipients and admins. Or, you can use the SpamQuarantineTag parameter to specify what end-users are allowed to do on quarantined messages. - Redirect: Redirect the message to the recipients specified by the RedirectToRecipients parameter. diff --git a/exchange/exchange-ps/exchange/New-HybridConfiguration.md b/exchange/exchange-ps/exchange/New-HybridConfiguration.md index 7d9e42ecac..a345872239 100644 --- a/exchange/exchange-ps/exchange/New-HybridConfiguration.md +++ b/exchange/exchange-ps/exchange/New-HybridConfiguration.md @@ -14,7 +14,10 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in on-premises Exchange. -Use the New-HybridConfiguration cmdlet to create the HybridConfiguration object and set up a hybrid deployment between your on-premises Exchange organization and a Microsoft 365 for enterprises organization. +Use the New-HybridConfiguration cmdlet to manually create the HybridConfiguration object and manually set up a hybrid deployment between your on-premises Exchange organization and Exchange Online in Microsoft 365 for enterprises. + +> [!NOTE] +> We strongly recommend that you use the Hybrid Configuration wizard to create the HybridConfiguration object and configure your hybrid deployment with Exchange Online. For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). @@ -41,7 +44,9 @@ New-HybridConfiguration ``` ## DESCRIPTION -A hybrid deployment offers organizations the ability to extend the feature-rich experience and administrative control they have with their existing on-premises Microsoft Exchange organization to the cloud. The New-HybridConfiguration cmdlet is used with the Hybrid Configuration wizard and is typically configured when the hybrid deployment is initially created by the wizard. We strongly recommend that you use the Hybrid Configuration wizard to create the HybridConfiguration object and configure your hybrid deployment with the Exchange Online organization. +A hybrid deployment offers organizations the ability to extend the feature-rich experience and administrative control they have with their existing on-premises Exchange organization to the cloud. + +The available settings in this cmdlet are configured when the Hybrid Configuration Wizard initially creates the the HybridConfiguration object. For more information, see [Exchange Server hybrid deployments](https://learn.microsoft.com/exchange/exchange-hybrid). @@ -61,11 +66,13 @@ This example creates the hybrid configuration named Hybrid Configuration with th ### -ClientAccessServers This parameter is available only in Exchange Server 2010. -The ClientAccessServers parameter specifies the Exchange Server 2010 SP2 servers with the Client Access server role installed that will be configured to support the hybrid deployment features. At least one Client Access server must be defined and be externally accessible from the Internet on ports 80 and 443. The servers will be configured to enable the following: +The ClientAccessServers parameter specifies the Hub Transport servers in Exchange Server 2010 SP2 or later that are configured to support hybrid deployment features. You need to specify at least one Client Access server that's accessible from the internet on TCP ports 80 and 443. The servers are configured to enable the following features: + +- Mailbox Replication Service (MRS) Proxy: Enable the MRS Proxy service configuration. +- Virtual Directories: Host the default web sites for Exchange Web Services (EWS), offline address books, and ActiveSync services. +- Outlook Anywhere: Enabled. -- Mailbox Replication Service (MRS) Proxy The MRS Proxy service configuration on the Client Access servers will be enabled. -- Virtual Directories The Client Access servers will host the default Web sites for the Exchange Web Services (EWS), offline address books, and ActiveSync services. -- Outlook Anywhere The Client Access servers will have Outlook Anywhere enabled. +You can specify multiple servers separated by commas. ```yaml Type: MultiValuedProperty @@ -116,7 +123,9 @@ Accept wildcard characters: False ``` ### -Domains -The Domains parameter specifies the domain namespaces that are used in the hybrid deployment. These domains must be configured as accepted domains in either the on-premises Exchange organization or the Exchange Online service. The domains are used in configuring the organization relationships and Send and Receive connectors used by the hybrid configuration. +The Domains parameter specifies the domain namespaces used in the hybrid deployment. These domains must be configured as accepted domains in either on-premises Exchange or Exchange Online. The domains are used in configuring the organization relationships and Send and Receive connectors used by the hybrid configuration. + +You can specify multiple domains separated by commas. ```yaml Type: MultiValuedProperty @@ -132,9 +141,14 @@ Accept wildcard characters: False ``` ### -EdgeTransportServers -The EdgeTransportServers parameter specifies the Edge Transport servers that are configured to support the hybrid deployment features. The Edge Transport server must be externally accessible from the Internet on port 25. The accepted values for the EdgeTransportServers parameter are either the full or short computer name of an Edge Transport server, for example, either edge.corp.contoso.com or EDGE. Separate server names with a comma if defining more than one Edge Transport server. +The EdgeTransportServers parameter specifies the Edge Transport servers that are configured to support the hybrid deployment features. The Edge Transport server must be accessible from the internet on port 25. Valid values are: + +- The Edge Transport server FQDN (for example, edge.corp.contoso.com). +- The Edge Transport server host name (for example, EDGE). + +You can specify multiple server separated by commas. -When configuring the EdgeTransportServers parameter, you must configure the ReceivingTransportServers and SendingTransportServers parameter values to $null. +If you use this parameter, don't use the the ReceivingTransportServers and SendingTransportServers parameters (their values must be blank or $null). ```yaml Type: MultiValuedProperty @@ -150,7 +164,9 @@ Accept wildcard characters: False ``` ### -ExternalIPAddresses -The ExternalIPAddresses parameter is a legacy parameter that specifies the publicly accessible inbound IP address of Microsoft Exchange Server 2010 Hub Transport servers. The only configuration change that should be made with this parameter is to change or clear the legacy Exchange 2010 Hub Transport server IP address value. The IP address must be Internet Protocol version 4 (IPv4) based only. +The ExternalIPAddresses parameter is a legacy parameter that specifies the publicly accessible inbound IP address of Microsoft Exchange Server 2010 Hub Transport servers. + +You should use this parameter to change or clear legacy Exchange 2010 Hub Transport server IP address values only. IPv6 addresses aren't supported. ```yaml Type: MultiValuedProperty @@ -166,16 +182,18 @@ Accept wildcard characters: False ``` ### -Features -The Features parameter specifies the features that are enabled for the hybrid configuration. One or more of the following values separated by commas can be entered. When using the Hybrid Configuration wizard, all features are enabled by default. +The Features parameter specifies the features that are enabled for the hybrid configuration. Valid values are: + +- OnlineArchive: Enables the Exchange Online archive for on-premises Exchange and Exchange Online users. +- FreeBusy: Enables calendar free/busy sharing between on-premises Exchange and Exchange Online users. +- MailTips: Enables MailTips between on-premises Exchange and Exchange Online users. +- MessageTracking: Enables message tracking between on-premises Exchange and Exchange Online. +- OWARedirection: Enables automatic Outlook on the web (formerly known as Outlook Web App or OWA) redirection to on-premises Exchange or Exchange Online, depending on where the user mailbox is located. +- SecureMail: Enables secure message transport via Transport Layer Security (TLS) between on-premises Exchange and Exchange Online. +- Centralized: Enables the on-premises Exchange servers to handle all message transport between on-premises Exchange and Exchange Online, including message delivery to the internet for both organizations. If you don't use this value, on-premises Exchange and Exchange Online are each responsible for their own internet message delivery. +- Photos: Enables the sharing of user photo data between the on-premises Exchange and Exchange Online. This feature works in tandem with the PhotosEnabled parameter in the OrganizationRelationship cmdlets in a hybrid deployment. If you use this value, the PhotosEnabled parameter is automatically set to $true. If you don't use this value, the PhotosEnabled parameter is automatically set to $false. -- OnlineArchive: Enables the Exchange Online archive for on-premises Exchange and Exchange Online organization users. -- FreeBusy: Enables free/busy calendar information to be shared between on-premises Exchange and Exchange Online organization users. -- MailTips: Enables MailTips information to be shared between on-premises Exchange and Exchange Online organization users. -- MessageTracking: Enables message tracking information to be shared between on-premises Exchange and Exchange Online organization users. -- OWARedirection: Enables automatic Microsoft Outlook on the web redirection to either the on-premises Exchange or Exchange Online organizations depending on where the user mailbox is located. -- SecureMail: Enables secure message transport via Transport Layer Security (TLS) between the on-premises Exchange and Exchange Online organizations. -- Centralized: Enables the on-premises servers to handle all message transport between the on-premises Exchange and Exchange Online organizations, including message delivering to the Internet for both organizations. If this value is $false, the on-premises server and Exchange Online organization are each responsible for their own Internet message delivery. -- Photos: Enables the sharing of user photo data between the on-premises Exchange and Exchange Online organizations. This feature works in tandem with the PhotosEnabled parameter in the OrganizationRelationship cmdlets in a hybrid deployment. If the Photos parameter is $true, the PhotosEnabled parameter is automatically set to $true. If the Photos parameter is $false, the PhotosEnabled parameter is automatically set to $false. When running the Hybrid Configuration wizard for the first time, the default value is $true. +You can specify multiple values separated by commas. When you use the Hybrid Configuration wizard, all features are enabled by default. ```yaml Type: MultiValuedProperty @@ -191,7 +209,7 @@ Accept wildcard characters: False ``` ### -OnPremisesSmartHost -The OnPremisesSmartHost parameter specifies the FQDN of the on-premises Mailbox server used for secure mail transport for messages sent between the on-premises Exchange and Exchange Online organizations. +The OnPremisesSmartHost parameter specifies the FQDN of the on-premises Exchange Mailbox server used for secure mail transport between on-premises Exchange and Exchange Online. ```yaml Type: SmtpDomain @@ -207,9 +225,16 @@ Accept wildcard characters: False ``` ### -ReceivingTransportServers -The ReceivingTransportServers parameter specifies the Mailbox servers that are defined in the outbound connector configuration of the Microsoft Exchange Online Protection (EOP) service included as part of the Microsoft 365 organization. The servers defined in the ReceivingTransportServers parameter are designated as the receiving servers for secure mail messages sent from the Exchange Online organization to the on-premises Exchange organization in a hybrid deployment. At least one Mailbox server must be defined and be externally accessible from the Internet for secure mail to be enabled between the on-premises Exchange and Exchange Online organizations. The accepted values for the ReceivingTransportServers parameter are either the full or short computer name of a Mailbox server, for example, either mbx.corp.contoso.com or MBX. Separate server names with a comma if defining more than one Mailbox server. +The ReceivingTransportServers parameter specifies the Mailbox servers defined in the outbound connector configuration in Exchange Online. Valid values are: + +- The Mailbox server FQDN (for example, mbx.corp.contoso.com). +- The Mailbox server host name (for example, MBX). + +You can specify multiple servers specified by commas. + +The specified servers receive secure email messages from Exchange Online to on-premises Exchange in a hybrid deployment. You need to specify at least one publicly accessible Mailbox server to enable secure mail. -If configuring the EdgeTransportServers parameter in the hybrid deployment, the ReceivingTransportServers parameter value must be $null. +Don't use this parameter with the EdgeTransportServers parameter. The value of this parameter must be blank ($null) when you use the EdgeTransportServers parameter. ```yaml Type: MultiValuedProperty @@ -227,7 +252,7 @@ Accept wildcard characters: False ### -SecureMailCertificateThumbprint This parameter is available only in Exchange Server 2010. -The SecureMailCertificateThumbprint parameter specifies the thumbprint of the X.509 certificate to be used as the certificate for hybrid deployment secure message transport. This certificate cannot be self-signed, must be obtained from a trusted certificate authority (CA) and must be installed on all Hub Transport servers defined in the TransportServers parameter. +The SecureMailCertificateThumbprint parameter specifies the thumbprint of the X.509 certificate to use as the certificate for hybrid deployment secure message transport. This certificate can't be self-signed, must be obtained from a trusted certification authority (CA), and must be installed on all Hub Transport servers specified in the TransportServers parameter. ```yaml Type: String @@ -243,9 +268,16 @@ Accept wildcard characters: False ``` ### -SendingTransportServers -The SendingTransportServers parameter specifies the Exchange Mailbox servers that are defined in the inbound connector configuration of the EOP service included as part of the Microsoft 365 organization. The servers defined in the SendingTransportServers parameter are designated as the receiving servers for secure mail messages sent from the on-premises Exchange organization to the Exchange Online organization in a hybrid deployment. At least one Mailbox server must be defined and be externally accessible from the Internet for secure mail to be enabled between the on-premises Exchange and Exchange Online organizations. The accepted values for the SendingTransportServers parameter are either the full or short computer name of a Mailbox server, for example, either mbx.corp.contoso.com or MBX. Separate server names with a comma if defining more than one Mailbox server. +The SendingTransportServers parameter specifies the Mailbox servers defined in the inbound connector configuration in Exchange Online. Valid values are: -If configuring the EdgeTransportServers parameter in the hybrid deployment, the SendingTransportServers parameter value must be $null. +- The Mailbox server FQDN (for example, mbx.corp.contoso.com). +- The Mailbox server host name (for example, MBX). + +You can specify multiple servers specified by commas. + +The specified servers send secure email messages from on-premises Exchange to Exchange Online in a hybrid deployment. You need to specify at least one publicly accessible Mailbox server to enable secure mail. + +Don't use this parameter with the EdgeTransportServers parameter. The value of this parameter must be blank ($null) when you use the EdgeTransportServers parameter. ```yaml Type: MultiValuedProperty @@ -261,7 +293,11 @@ Accept wildcard characters: False ``` ### -ServiceInstance -The ServiceInstance parameter should only be used by organizations manually configuring hybrid deployments with Office 365 operated by 21Vianet in China. All other organizations should use the Hybrid Configuration wizard to configure a hybrid deployment with Microsoft 365. The valid values for this parameter are 0 (null) or 1. The default value is 0 (null).For organizations connecting with Office 365 operated by 21Vianet in China, set this value to 1 when manually configuring your hybrid deployment. +This parameter is meaningful only in Office 365 operated by 21Vianet in China. + +To manually configure a hybrid deployment with Office 365 operated by 21Vianet in China, set the value of this parameter to 1. Otherwise, the default value is 0. + +All other Microsoft 365 organizations should use the Hybrid Configuration wizard to configure a hybrid deployment. ```yaml Type: Int32 @@ -277,7 +313,14 @@ Accept wildcard characters: False ``` ### -TlsCertificateName -The TlsCertificateName parameter specifies the X.509 certificate to use for TLS encryption. A valid value for this parameter is `"X.500IssuerX.500Subject"`. The X.500Issuer value is found in the certificate's Issuer field, and the X.500Subject value is found in the certificate's Subject field. You can find these values by running the Get-ExchangeCertificate cmdlet. Or, after you run Get-ExchangeCertificate to find the thumbprint value of the certificate, run the command `$TLSCert = Get-ExchangeCertificate -Thumbprint `, run the command `$TLSCertName = "$($TLSCert.Issuer)$($TLSCert.Subject)"`, and then use the value $TLSCertName for this parameter. +The TlsCertificateName parameter specifies the X.509 certificate to use for TLS encryption. Valid syntax for this parameter is `"X.500IssuerX.500Subject"`: + +- `X.500Issuer`: The value in the certificate's Issuer field. +- `X.500Subject`: The value in the certificate's Subject field. + +You can find these values by running the Get-ExchangeCertificate cmdlet. + +Or, after you run Get-ExchangeCertificate to find the thumbprint value of the certificate, use the thumbprint value in the command `$TLSCert = Get-ExchangeCertificate -Thumbprint `, run the command `$TLSCertName = "$($TLSCert.Issuer)$($TLSCert.Subject)"`, and then use the value `$TLSCertName` for this parameter. ```yaml Type: SmtpX509Identifier @@ -295,7 +338,11 @@ Accept wildcard characters: False ### -TransportServers This parameter is available only in Exchange Server 2010. -The TransportServers parameter specifies the Exchange Server 2010 SP2 servers with the Hub Transport server role installed that are configured to support the hybrid deployment features. At least one Hub Transport server must be defined and be externally accessible from the Internet for secure mail to be enabled between the on-premises and cloud-based organizations. +The TransportServers parameter specifies the Hub Transport servers in Exchange Server 2010 SP2 or later that are configured to support hybrid deployment features. + +You need to specify at least one Hub Transport server that's accessible from the internet for secure mail between on-premises Exchange and Exchange Online. + +You can specify multiple servers separated by commas. ```yaml Type: MultiValuedProperty diff --git a/exchange/exchange-ps/exchange/New-OnPremisesOrganization.md b/exchange/exchange-ps/exchange/New-OnPremisesOrganization.md index a8a5a4ed57..bca7a914de 100644 --- a/exchange/exchange-ps/exchange/New-OnPremisesOrganization.md +++ b/exchange/exchange-ps/exchange/New-OnPremisesOrganization.md @@ -79,7 +79,7 @@ Accept wildcard characters: False ``` ### -InboundConnector -The InboundConnector parameter specifies the name of the inbound connector configured on the Microsoft Exchange Online Protection (EOP) service for a hybrid deployment configured with an on-premises Exchange organization. +The InboundConnector parameter specifies the name of the inbound connector configured in Microsoft 365 for a hybrid deployment configured with an on-premises Exchange organization. ```yaml Type: InboundConnectorIdParameter diff --git a/exchange/exchange-ps/exchange/New-PhishSimOverridePolicy.md b/exchange/exchange-ps/exchange/New-PhishSimOverridePolicy.md index 4d6de2ee03..914ad097e8 100644 --- a/exchange/exchange-ps/exchange/New-PhishSimOverridePolicy.md +++ b/exchange/exchange-ps/exchange/New-PhishSimOverridePolicy.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the New-PhishSimOverridePolicy cmdlet to create third-party phishing simulation override policies to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the New-PhishSimOverridePolicy cmdlet to create third-party phishing simulation override policies that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/New-SecOpsOverridePolicy.md b/exchange/exchange-ps/exchange/New-SecOpsOverridePolicy.md index e24f5206c9..4f342228fe 100644 --- a/exchange/exchange-ps/exchange/New-SecOpsOverridePolicy.md +++ b/exchange/exchange-ps/exchange/New-SecOpsOverridePolicy.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the New-SecOpsOverridePolicy cmdlet to create SecOps mailbox override policies to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the New-SecOpsOverridePolicy cmdlet to create SecOps mailbox override policies that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/New-TenantAllowBlockListItems.md b/exchange/exchange-ps/exchange/New-TenantAllowBlockListItems.md index 6ef2975372..f44b9f9cc7 100644 --- a/exchange/exchange-ps/exchange/New-TenantAllowBlockListItems.md +++ b/exchange/exchange-ps/exchange/New-TenantAllowBlockListItems.md @@ -103,9 +103,9 @@ To enter multiple values, use the following syntax: `"Value1","Value2",..."Value Entry limits for each list subtype (sender, URL, file, or IP address): -- **Exchange Online Protection**: The maximum number of allow entries is 500, and the maximum number of block entries is 500. -- **Defender for Office 365 Plan 1**: The maximum number of allow entries is 1000, and the maximum number of block entries is 1000. -- **Defender for Office 365 Plan 2**: The maximum number of allow entries is 5000, and the maximum number of block entries is 10000. +- **Organizations without Microsoft Defender for Office 365**: The maximum number of allow entries is 500, and the maximum number of block entries is 500. +- **Organizations with Defender for Office 365 Plan 1**: The maximum number of allow entries is 1000, and the maximum number of block entries is 1000. +- **Organizations with Defender for Office 365 Plan 2**: The maximum number of allow entries is 5000, and the maximum number of block entries is 10000. The maximum number of characters in a file entry is 64 and the maximum number of characters in a URL entry is 250. diff --git a/exchange/exchange-ps/exchange/Remove-EOPProtectionPolicyRule.md b/exchange/exchange-ps/exchange/Remove-EOPProtectionPolicyRule.md index ba11d899b1..9aeaf4a0cd 100644 --- a/exchange/exchange-ps/exchange/Remove-EOPProtectionPolicyRule.md +++ b/exchange/exchange-ps/exchange/Remove-EOPProtectionPolicyRule.md @@ -14,9 +14,9 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Remove-EOPProtectionPolicyRule cmdlet to remove rules from Exchange Online Protection (EOP) protections in preset security policies. The rules specify recipient conditions and exceptions for the protection, and also allow you to turn on and turn off the associated preset security policies. +Use the Remove-EOPProtectionPolicyRule cmdlet to remove rules for default email protections for all cloud mailboxes in preset security policies. The rules specify recipient conditions and exceptions for the protection, and also allow you to turn on and turn off the associated preset security policies. -**Note**: Use this cmdlet to remove a rule only if you plan to immediately recreate the rule using the New-EOPProtectionPolicyRule cmdlet. The affected preset security policy won't function without a corresponding rule. +**Note**: Use this cmdlet to remove a rule only if you plan to immediately recreate the rule using the New-EOPProtectionPolicyRule cmdlet. The affected preset security policy can't function without a corresponding rule. For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Remove-ExoPhishSimOverrideRule.md b/exchange/exchange-ps/exchange/Remove-ExoPhishSimOverrideRule.md index 57130dbbe8..04f1581faa 100644 --- a/exchange/exchange-ps/exchange/Remove-ExoPhishSimOverrideRule.md +++ b/exchange/exchange-ps/exchange/Remove-ExoPhishSimOverrideRule.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Remove-ExoPhishSimOverrideRule cmdlet to remove third-party phishing simulation override rules to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Remove-ExoPhishSimOverrideRule cmdlet to remove third-party phishing simulation override rules that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Remove-ExoSecOpsOverrideRule.md b/exchange/exchange-ps/exchange/Remove-ExoSecOpsOverrideRule.md index b127bd5c6f..165993044f 100644 --- a/exchange/exchange-ps/exchange/Remove-ExoSecOpsOverrideRule.md +++ b/exchange/exchange-ps/exchange/Remove-ExoSecOpsOverrideRule.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Remove-ExoSecOpsOverrideRule cmdlet to remove SecOps mailbox override rules to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Remove-ExoSecOpsOverrideRule cmdlet to remove SecOps mailbox override rules that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Remove-PhishSimOverridePolicy.md b/exchange/exchange-ps/exchange/Remove-PhishSimOverridePolicy.md index 590d704a0c..d86bdfea10 100644 --- a/exchange/exchange-ps/exchange/Remove-PhishSimOverridePolicy.md +++ b/exchange/exchange-ps/exchange/Remove-PhishSimOverridePolicy.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Remove-PhishSimOverridePolicy cmdlet to remove third-party phishing simulation override policies to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Remove-PhishSimOverridePolicy cmdlet to remove third-party phishing simulation override policies that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Remove-SecOpsOverridePolicy.md b/exchange/exchange-ps/exchange/Remove-SecOpsOverridePolicy.md index 116c6c915a..cc84a95938 100644 --- a/exchange/exchange-ps/exchange/Remove-SecOpsOverridePolicy.md +++ b/exchange/exchange-ps/exchange/Remove-SecOpsOverridePolicy.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Remove-SecOpsOverridePolicy cmdlet to remove SecOps mailbox override policies to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Remove-SecOpsOverridePolicy cmdlet to remove SecOps mailbox override policies that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Set-AcceptedDomain.md b/exchange/exchange-ps/exchange/Set-AcceptedDomain.md index d8069d6995..cd7a31a975 100644 --- a/exchange/exchange-ps/exchange/Set-AcceptedDomain.md +++ b/exchange/exchange-ps/exchange/Set-AcceptedDomain.md @@ -253,7 +253,7 @@ This parameter is available only in the cloud-based service. The OutboundOnly parameter specifies whether this accepted domain is an internal relay domain for the on-premises deployment for organizations that have coexistence with a cloud-based organization. -The authoritative accepted domain for the on-premises deployment is configured as an internal relay accepted domain on the cloud side. If the on-premises deployment is using Exchange Online Protection, you need to set this parameter to $true for the accepted domain that represents your on-premises deployment. This parameter is used only if the DomainType parameter is set to Authoritative or InternalRelay. The default value is $false. +The authoritative accepted domain for the on-premises deployment is configured as an internal relay accepted domain on the cloud side. If the on-premises deployment is using cloud email protection, you need to set this parameter to $true for the accepted domain that represents your on-premises deployment. This parameter is used only if the DomainType parameter is set to Authoritative or InternalRelay. The default value is $false. ```yaml Type: Boolean diff --git a/exchange/exchange-ps/exchange/Set-EOPProtectionPolicyRule.md b/exchange/exchange-ps/exchange/Set-EOPProtectionPolicyRule.md index 2f487200f3..0f0aa7ab42 100644 --- a/exchange/exchange-ps/exchange/Set-EOPProtectionPolicyRule.md +++ b/exchange/exchange-ps/exchange/Set-EOPProtectionPolicyRule.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Set-EOPProtectionPolicyRule cmdlet to modify rules that are associated with Exchange Online Protection (EOP) protections in preset security policies. +Use the Set-EOPProtectionPolicyRule cmdlet to modify rules associated with default email protections for all cloud mailboxes in preset security policies. For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Set-ExoPhishSimOverrideRule.md b/exchange/exchange-ps/exchange/Set-ExoPhishSimOverrideRule.md index 2b5d969329..46a71bb770 100644 --- a/exchange/exchange-ps/exchange/Set-ExoPhishSimOverrideRule.md +++ b/exchange/exchange-ps/exchange/Set-ExoPhishSimOverrideRule.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Set-ExoPhishSimOverrideRule cmdlet to modify third-party phishing simulation override rules to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Set-ExoPhishSimOverrideRule cmdlet to modify third-party phishing simulation override rules that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Set-ExoSecOpsOverrideRule.md b/exchange/exchange-ps/exchange/Set-ExoSecOpsOverrideRule.md index b20f1787e3..a4023db3cc 100644 --- a/exchange/exchange-ps/exchange/Set-ExoSecOpsOverrideRule.md +++ b/exchange/exchange-ps/exchange/Set-ExoSecOpsOverrideRule.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Set-ExoSecOpsOverrideRule cmdlet to modify SecOps mailbox override rules to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Set-ExoSecOpsOverrideRule cmdlet to modify SecOps mailbox override rules that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). **Tip**: This cmdlet doesn't modify email addresses in the SecOps override rule. To modify the email addresses in the SecOps override rule, use the Set-SecOpsOverridePolicy cmdlet. diff --git a/exchange/exchange-ps/exchange/Set-HostedContentFilterPolicy.md b/exchange/exchange-ps/exchange/Set-HostedContentFilterPolicy.md index 64de11808a..d8cfd90e6b 100644 --- a/exchange/exchange-ps/exchange/Set-HostedContentFilterPolicy.md +++ b/exchange/exchange-ps/exchange/Set-HostedContentFilterPolicy.md @@ -286,7 +286,7 @@ The BulkSpamAction parameter specifies the action to take on messages that are m - AddXHeader: Add the AddXHeaderValue parameter value to the message header and deliver the message. - Delete: Delete the message during filtering. Use caution when selecting this value, because you can't recover the deleted message. - ModifySubject: Add the ModifySubject parameter value to the beginning of the subject line, deliver the message, and move the message to the Junk Email folder (same caveats as MoveToJmf). -- MoveToJmf: This is the default value. Deliver the message to the Junk Email folder in the recipient's mailbox. In standalone Exchange Online Protection environments, you need to configure mail flow rules in your on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). +- MoveToJmf: This is the default value. Deliver the message to the Junk Email folder in the recipient's mailbox. Hybrid environments need mail flow rules in the on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). - NoAction - Quarantine: Deliver the message to quarantine. By default, messages that are quarantined as bulk email are available to the intended recipients and admins. Or, you can use the BulkQuarantineTag parameter to specify what end-users are allowed to do on quarantined messages. - Redirect: Redirect the message to the recipients specified by the RedirectToRecipients parameter. @@ -557,7 +557,7 @@ The HighConfidenceSpamAction parameter specifies the action to take on messages - AddXHeader: Add the AddXHeaderValue parameter value to the message header, deliver the message, and move the message to the Junk Email folder (same caveats as MoveToJmf). - Delete: Delete the message during filtering. Use caution when selecting this value, because you can't recover the deleted message. - ModifySubject: Add the ModifySubject parameter value to the beginning of the subject line, deliver the message, and move the message to the Junk Email folder (same caveats as MoveToJmf). -- MoveToJmf: Deliver the message to the Junk Email folder in the recipient's mailbox. In standalone Exchange Online Protection environments, you need to configure mail flow rules in your on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). +- MoveToJmf: Deliver the message to the Junk Email folder in the recipient's mailbox. Hybrid environments need mail flow rules in the on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). - Quarantine: Deliver the message to quarantine. By default, messages that are quarantined as high confidence spam are available to the intended recipients and admins. Or, you can use the HighConfidenceSpamQuarantineTag parameter to specify what end-users are allowed to do on quarantined messages. - Redirect: Redirect the message to the recipients specified by the RedirectToRecipients parameter. @@ -1177,7 +1177,7 @@ The SpamAction parameter specifies the action to take on messages that are marke - AddXHeader: Add the AddXHeaderValue parameter value to the message header, deliver the message, and move the message to the Junk Email folder (same caveats as MoveToJmf). - Delete : Delete the message during filtering. Use caution when selecting this value, because you can't recover the deleted message. - ModifySubject: Add the ModifySubject parameter value to the beginning of the subject line, deliver the message, and move the message to the Junk Email folder (same caveats as MoveToJmf). -- MoveToJmf: This is the default value. Deliver the message to the Junk Email folder in the recipient's mailbox. In standalone Exchange Online Protection environments, you need to configure mail flow rules in your on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). +- MoveToJmf: This is the default value. Deliver the message to the Junk Email folder in the recipient's mailbox. Hybrid environments need mail flow rules in the on-premises Exchange organization. For instructions, see [Configure standalone EOP to deliver spam to the Junk Email folder in hybrid environments](https://learn.microsoft.com/exchange/standalone-eop/configure-eop-spam-protection-hybrid). - Quarantine: Deliver the message to quarantine. By default, messages that are quarantined as spam are available to the intended recipients and admins. Or, you can use the SpamQuarantineTag parameter to specify what end-users are allowed to do on quarantined messages. - Redirect: Redirect the message to the recipients specified by the RedirectToRecipients parameter. diff --git a/exchange/exchange-ps/exchange/Set-HybridConfiguration.md b/exchange/exchange-ps/exchange/Set-HybridConfiguration.md index 5811e49d7f..7b0b227234 100644 --- a/exchange/exchange-ps/exchange/Set-HybridConfiguration.md +++ b/exchange/exchange-ps/exchange/Set-HybridConfiguration.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in on-premises Exchange. -Use the Set-HybridConfiguration cmdlet to modify the hybrid deployment between your on-premises Exchange organization and Exchange Online in a Microsoft 365 for enterprises organization. +Use the Set-HybridConfiguration cmdlet to modify the hybrid deployment between your on-premises Exchange organization and Exchange Online in Microsoft 365 for enterprises. For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). @@ -42,7 +42,7 @@ Set-HybridConfiguration ``` ## DESCRIPTION -The Set-HybridConfiguration cmdlet modifies the hybrid configuration features, such as enabling secure mail, designating a specific Mailbox server for hybrid functionality, or enabling or disabling free/busy information sharing and message tracking between the on-premises Exchange and Exchange Online organizations. +The Set-HybridConfiguration cmdlet modifies the hybrid configuration features, such as enabling secure mail, designating a specific Mailbox server for hybrid functionality, or enabling or disabling free/busy sharing between on-premises Exchange and Exchange Online. You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see [Find the permissions required to run any Exchange cmdlet](https://learn.microsoft.com/powershell/exchange/find-exchange-cmdlet-permissions). @@ -72,13 +72,15 @@ This example specifies that the hybrid deployment uses a defined TLS certificate ## PARAMETERS ### -ClientAccessServers -This parameter is functional only in Exchange Server 2010. +This parameter is available only in Exchange Server 2010. + +The ClientAccessServers parameter specifies the Hub Transport servers in Exchange Server 2010 SP2 or later that are configured to support hybrid deployment features. You need to specify at least one Client Access server that's accessible from the internet on TCP ports 80 and 443. The servers are configured to enable the following features: -The ClientAccessServers parameter specifies the Exchange 2010 SP2 or later servers with the Client Access server role installed that will be configured to support the hybrid deployment features. At least one Client Access server must be defined and be externally accessible from the Internet on ports 80 and 443. The servers will be configured to enable the following: +- Mailbox Replication Service (MRS) Proxy: Enable the MRS Proxy service configuration. +- Virtual Directories: Host the default web sites for Exchange Web Services (EWS), offline address books, and ActiveSync services. +- Outlook Anywhere: Enabled. -- Mailbox Replication Service (MRS) Proxy The MRS Proxy service configuration on the Client Access servers will be enabled. -- Virtual Directories The Client Access servers will host the default Web sites for the Exchange Web Services (EWS), offline address books, and ActiveSync services. -- Outlook Anywhere The Client Access servers will have Outlook Anywhere enabled. +You can specify multiple servers separated by commas. ```yaml Type: MultiValuedProperty @@ -129,7 +131,9 @@ Accept wildcard characters: False ``` ### -Domains -The Domains parameter specifies the domain namespaces that will be used in the hybrid deployment. These domains must be configured as accepted domains in either the on-premises Exchange organization or the Exchange Online organization. The domains will be used in configuring the organization relationships and Send and Receive connectors used by the hybrid configuration. +The Domains parameter specifies the domain namespaces used in the hybrid deployment. These domains must be configured as accepted domains in either on-premises Exchange or Exchange Online. The domains are used in configuring the organization relationships and Send and Receive connectors used by the hybrid configuration. + +You can specify multiple domains separated by commas. ```yaml Type: MultiValuedProperty @@ -145,7 +149,9 @@ Accept wildcard characters: False ``` ### -ExternalIPAddresses -The ExternalIPAddresses parameter is a legacy parameter that specifies the publicly accessible inbound IP address of Microsoft Exchange Server 2010 Hub Transport servers. The only configuration change that should be made with this parameter is to change or clear the legacy Exchange 2010 Hub Transport server IP address value. The IP address must be Internet Protocol version 4 (IPv4) based only. +The ExternalIPAddresses parameter is a legacy parameter that specifies the publicly accessible inbound IP address of Microsoft Exchange Server 2010 Hub Transport servers. + +You should use this parameter to change or clear legacy Exchange 2010 Hub Transport server IP address values only. IPv6 addresses aren't supported. ```yaml Type: MultiValuedProperty @@ -161,16 +167,18 @@ Accept wildcard characters: False ``` ### -Features -The Features parameter specifies the features enabled for the hybrid configuration. One or more of the following values separated by commas can be entered. When using the Hybrid Configuration wizard, all features are enabled by default. +The Features parameter specifies the features that are enabled for the hybrid configuration. Valid values are: + +- OnlineArchive: Enables the Exchange Online archive for on-premises Exchange and Exchange Online users. +- FreeBusy: Enables calendar free/busy sharing between on-premises Exchange and Exchange Online users. +- MailTips: Enables MailTips between on-premises Exchange and Exchange Online users. +- MessageTracking: Enables message tracking between on-premises Exchange and Exchange Online. +- OWARedirection: Enables automatic Outlook on the web (formerly known as Outlook Web App or OWA) redirection to on-premises Exchange or Exchange Online, depending on where the user mailbox is located. +- SecureMail: Enables secure message transport via Transport Layer Security (TLS) between on-premises Exchange and Exchange Online. +- Centralized: Enables the on-premises Exchange servers to handle all message transport between on-premises Exchange and Exchange Online, including message delivery to the internet for both organizations. If you don't use this value, on-premises Exchange and Exchange Online are each responsible for their own internet message delivery. +- Photos: Enables the sharing of user photo data between the on-premises Exchange and Exchange Online. This feature works in tandem with the PhotosEnabled parameter in the OrganizationRelationship cmdlets in a hybrid deployment. If you use this value, the PhotosEnabled parameter is automatically set to $true. If you don't use this value, the PhotosEnabled parameter is automatically set to $false. -- Centralized: Enables transport servers to handle all message transport between the on-premises Exchange and Exchange Online organizations, including external message delivery to the Internet for both organizations. If this value is $false, the on-premises transport servers and Exchange Online organization are each responsible for their own Internet message delivery. -- FreeBusy: Enables free/busy calendar information to be shared between on-premises Exchange and Exchange Online organization users. -- MailTips: Enables MailTips information to be shared between on-premises Exchange and Exchange Online organization users. -- MessageTracking: Enables message tracking information to be shared between on-premises Exchange and Exchange Online organization users. -- OnlineArchive: Enables the Exchange Online archive feature so that Exchange Online supports hosting archive mailboxes for on-premises users. -- OWARedirection: Enables automatic Microsoft Outlook on the web redirection to either the on-premises Exchange or Exchange Online organizations depending on where the user mailbox is located. -- SecureMail: Enables secure message transport via Transport Layer Security (TLS) between the on-premises Exchange and Exchange Online organizations. -- Photos: Enables the sharing of user photo data between the on-premises Exchange and Exchange Online organizations. This feature works in tandem with the PhotosEnabled parameter in the OrganizationRelationship cmdlets in a hybrid deployment. If the Photos parameter is $true, the PhotosEnabled parameter is automatically set to $true. If the Photos parameter is $false, the PhotosEnabled parameter is automatically set to $false. When running the Hybrid Configuration wizard for the first time, the default value is $true. +You can specify multiple values separated by commas. When you use the Hybrid Configuration wizard, all features are enabled by default. ```yaml Type: MultiValuedProperty @@ -204,7 +212,7 @@ Accept wildcard characters: False ``` ### -OnPremisesSmartHost -The OnPremisesSmartHost parameter specifies the FQDN of the on-premises Mailbox servers used for secure mail transport for messages sent between the on-premises Exchange and Exchange Online organizations. +The OnPremisesSmartHost parameter specifies the FQDN of the on-premises Exchange Mailbox server used for secure mail transport between on-premises Exchange and Exchange Online. ```yaml Type: SmtpDomain @@ -220,9 +228,16 @@ Accept wildcard characters: False ``` ### -ReceivingTransportServers -The ReceivingTransportServers parameter specifies the Mailbox servers that are defined in the outbound connector configuration of the Microsoft Exchange Online Protection (EOP) service included as part of the Microsoft 365 tenant. The servers defined in the ReceivingTransportServers parameter are designated as the receiving servers for secure mail messages sent from the Exchange Online organization to the on-premises Exchange organization in a hybrid deployment. At least one Mailbox server must be defined and be externally accessible from the Internet for secure mail to be enabled between the on-premises Exchange and Exchange Online organizations. The accepted values for the ReceivingTransportServers parameter are either the full or short computer name of a Mailbox server, for example, either mbx.corp.contoso.com or MBX. Separate server names with a comma if defining more than one Mailbox server. +The ReceivingTransportServers parameter specifies the Mailbox servers defined in the outbound connector configuration in Exchange Online. Valid values are: -If configuring the EdgeTransportServers parameter in the hybrid deployment, the ReceivingTransportServers parameter value must be $null. +- The Mailbox server FQDN (for example, mbx.corp.contoso.com). +- The Mailbox server host name (for example, MBX). + +You can specify multiple servers specified by commas. + +The specified servers receive secure email messages from Exchange Online to on-premises Exchange in a hybrid deployment. You need to specify at least one publicly accessible Mailbox server to enable secure mail. + +The value of this parameter must be blank ($null) when you use the EdgeTransportServers parameter. ```yaml Type: MultiValuedProperty @@ -256,9 +271,16 @@ Accept wildcard characters: False ``` ### -SendingTransportServers -The SendingTransportServers parameter specifies the Mailbox servers that are defined in the inbound connector configuration of the EOP service included as part of the Microsoft 365 tenant. The servers defined in the SendingTransportServers parameter are designated as the receiving servers for secure mail messages sent from the on-premise organization to the Exchange Online organization in a hybrid deployment. At least one Mailbox server must be defined and be externally accessible from the Internet for secure mail to be enabled between the on-premises Exchange and Exchange Online organizations. The accepted values for the SendingTransportServers parameter are either the full or short computer name of a Mailbox server, for example, either mbx.corp.contoso.com or MBX. Separate server names with a comma if defining more than one Mailbox server. +The SendingTransportServers parameter specifies the Mailbox servers defined in the inbound connector configuration in Exchange Online. Valid values are: + +- The Mailbox server FQDN (for example, mbx.corp.contoso.com). +- The Mailbox server host name (for example, MBX). -If configuring the EdgeTransportServers parameter in the hybrid deployment, the SendingTransportServers parameter value must be $null. +You can specify multiple servers specified by commas. + +The specified servers send secure email messages from on-premises Exchange to Exchange Online in a hybrid deployment. You need to specify at least one publicly accessible Mailbox server to enable secure mail. + +The value of this parameter must be blank ($null) when you use the EdgeTransportServers parameter. ```yaml Type: MultiValuedProperty @@ -274,7 +296,11 @@ Accept wildcard characters: False ``` ### -ServiceInstance -The ServiceInstance parameter should only be used by organizations manually configuring hybrid deployments with Office 365 operated by 21Vianet in China. All other organizations should use the Hybrid Configuration wizard to configure a hybrid deployment with Microsoft 365. The valid values for this parameter are 0 (null) or 1. The default value is 0 (null). For organizations connecting with Office 365 operated by 21Vianet in China, set this value to 1 when manually configuring your hybrid deployment. +This parameter is meaningful only in Office 365 operated by 21Vianet in China. + +To manually configure a hybrid deployment with Office 365 operated by 21Vianet in China, set the value of this parameter to 1. Otherwise, the default value is 0. + +All other Microsoft 365 organizations should use the Hybrid Configuration wizard to configure a hybrid deployment. ```yaml Type: Int32 @@ -290,7 +316,14 @@ Accept wildcard characters: False ``` ### -TlsCertificateName -The TlsCertificateName parameter specifies the X.509 certificate to use for TLS encryption. A valid value for this parameter is `"X.500IssuerX.500Subject"`. The X.500Issuer value is found in the certificate's Issuer field, and the X.500Subject value is found in the certificate's Subject field. You can find these values by running the Get-ExchangeCertificate cmdlet. Or, after you run Get-ExchangeCertificate to find the thumbprint value of the certificate, run the command `$TLSCert = Get-ExchangeCertificate -Thumbprint `, run the command `$TLSCertName = "$($TLSCert.Issuer)$($TLSCert.Subject)"`, and then use the value $TLSCertName for this parameter. +The TlsCertificateName parameter specifies the X.509 certificate to use for TLS encryption. Valid syntax for this parameter is `"X.500IssuerX.500Subject"`: + +- `X.500Issuer`: The value in the certificate's Issuer field. +- `X.500Subject`: The value in the certificate's Subject field. + +You can find these values by running the Get-ExchangeCertificate cmdlet. + +Or, after you run Get-ExchangeCertificate to find the thumbprint value of the certificate, use the thumbprint value in the command `$TLSCert = Get-ExchangeCertificate -Thumbprint `, run the command `$TLSCertName = "$($TLSCert.Issuer)$($TLSCert.Subject)"`, and then use the value `$TLSCertName` for this parameter. ```yaml Type: SmtpX509Identifier @@ -308,7 +341,11 @@ Accept wildcard characters: False ### -TransportServers This parameter is available only in Exchange Server 2010. -The TransportServers parameter specifies the Exchange Server 2010 SP2 servers with the Hub Transport server role installed that will be configured to support the hybrid deployment features. At least one Hub Transport server must be defined and be externally accessible from the Internet for secure mail to be enabled between the on-premises and cloud-based organizations. +The TransportServers parameter specifies the Hub Transport servers in Exchange Server 2010 SP2 or later that are configured to support hybrid deployment features. + +You need to specify at least one Hub Transport server that's accessible from the internet for secure mail between on-premises Exchange and Exchange Online. + +You can specify multiple servers separated by commas. ```yaml Type: MultiValuedProperty diff --git a/exchange/exchange-ps/exchange/Set-MailboxJunkEmailConfiguration.md b/exchange/exchange-ps/exchange/Set-MailboxJunkEmailConfiguration.md index 7392f0f33e..5c32a37cd8 100644 --- a/exchange/exchange-ps/exchange/Set-MailboxJunkEmailConfiguration.md +++ b/exchange/exchange-ps/exchange/Set-MailboxJunkEmailConfiguration.md @@ -42,7 +42,7 @@ This cmdlet controls the following junk email settings on the mailbox: - Enable or disable the junk email rule: In on-premises Exchange, the junk email rule (a hidden Inbox rule named Junk E-mail Rule) controls the delivery of messages to the Junk Email folder or the Inbox based on the SCL Junk Email Folder threshold (for the organization or the mailbox) and the safelist collection on the mailbox. - In the cloud-based service, the junk email rule has no effect on mail flow. Exchange Online Protection delivers messages to the Junk Email folder based on the actions set in anti-spam policies. The junk email rule on the mailbox still controls what happens to messages after delivery based on the safelist collection of the mailbox. + In the cloud-based service, the junk email rule has no effect on mail flow. Messages are delivered to the Junk Email folder based on the actions set in anti-spam policies. The junk email rule on the mailbox still controls what happens to messages after delivery based on the safelist collection of the mailbox. Users can enable or disable the junk email rule in their own mailbox by using Outlook on the web. diff --git a/exchange/exchange-ps/exchange/Set-MalwareFilteringServer.md b/exchange/exchange-ps/exchange/Set-MalwareFilteringServer.md index 5766c7970f..b524b8fc9c 100644 --- a/exchange/exchange-ps/exchange/Set-MalwareFilteringServer.md +++ b/exchange/exchange-ps/exchange/Set-MalwareFilteringServer.md @@ -169,7 +169,10 @@ Accept wildcard characters: False ``` ### -ForceRescan -The ForceRescan parameter specifies that messages should be scanned by the malware agent, even if the message was already scanned by Exchange Online Protection. Valid input for this parameter is $true or $false. The default value is $false. +The ForceRescan parameter specifies that messages should be scanned by the malware agent, even if the message was already scanned by cloud-based protection. Valid values are: + +- $true: Messages from cloud-based organizations are scanned by the malware agent. +- $false: Messages from cloud-based organizations aren't scanned by the malware agent. This is the default value. ```yaml Type: Boolean diff --git a/exchange/exchange-ps/exchange/Set-OnPremisesOrganization.md b/exchange/exchange-ps/exchange/Set-OnPremisesOrganization.md index 666358469d..98e0bf8f30 100644 --- a/exchange/exchange-ps/exchange/Set-OnPremisesOrganization.md +++ b/exchange/exchange-ps/exchange/Set-OnPremisesOrganization.md @@ -121,7 +121,7 @@ Accept wildcard characters: False ``` ### -InboundConnector -The InboundConnector parameter specifies the name of the inbound connector configured on the Microsoft Exchange Online Protection (EOP) service for a hybrid deployment configured with an on-premises Exchange organization. +The InboundConnector parameter specifies the name of the inbound connector configured in Microsoft 365 for a hybrid deployment configured with an on-premises Exchange organization. ```yaml Type: InboundConnectorIdParameter diff --git a/exchange/exchange-ps/exchange/Set-PhishSimOverridePolicy.md b/exchange/exchange-ps/exchange/Set-PhishSimOverridePolicy.md index 95798fa9a6..eba42f2565 100644 --- a/exchange/exchange-ps/exchange/Set-PhishSimOverridePolicy.md +++ b/exchange/exchange-ps/exchange/Set-PhishSimOverridePolicy.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Set-PhishSimOverridePolicy cmdlet to modify third-party phishing simulation override policies to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Set-PhishSimOverridePolicy cmdlet to modify third-party phishing simulation override policies that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/Set-SecOpsOverridePolicy.md b/exchange/exchange-ps/exchange/Set-SecOpsOverridePolicy.md index 0c6e563991..85a77559d9 100644 --- a/exchange/exchange-ps/exchange/Set-SecOpsOverridePolicy.md +++ b/exchange/exchange-ps/exchange/Set-SecOpsOverridePolicy.md @@ -14,7 +14,7 @@ ms.reviewer: ## SYNOPSIS This cmdlet is available only in the cloud-based service. -Use the Set-SecOpsOverridePolicy cmdlet to modify SecOps mailbox override policies to bypass Exchange Online Protection filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). +Use the Set-SecOpsOverridePolicy cmdlet to modify SecOps mailbox override policies that bypass filtering. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](https://learn.microsoft.com/defender-office-365/advanced-delivery-policy-configure). For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax). diff --git a/exchange/exchange-ps/exchange/exchange.md b/exchange/exchange-ps/exchange/exchange.md index b65ce43828..7aab792266 100644 --- a/exchange/exchange-ps/exchange/exchange.md +++ b/exchange/exchange-ps/exchange/exchange.md @@ -6,19 +6,21 @@ title: exchange # Exchange PowerShell ## Description -Exchange PowerShell is built on Windows PowerShell technology and provides a powerful command-line interface that enables automation of administrative tasks. The following PowerShell environments are available in Exchange: +Exchange PowerShell is built on PowerShell technology to a powerful command-line interface for automation of administrative tasks. The following PowerShell environments are available in Exchange: - [Exchange Server PowerShell (Exchange Management Shell)](https://learn.microsoft.com/powershell/exchange/exchange-management-shell) - [Exchange Online PowerShell](https://learn.microsoft.com/powershell/exchange/exchange-online-powershell) - [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell) -- [Exchange Online Protection PowerShell](https://learn.microsoft.com/powershell/exchange/exchange-online-protection-powershell) +- [Exchange Online Protection PowerShell for cloud protection of on-premises email environments](https://learn.microsoft.com/powershell/exchange/exchange-online-protection-powershell) > [!NOTE] -> For Exchange Online, Security & Compliance, and Exchange Online Protection, the module from the PowerShell Gallery that you use to connect is [ExchangeOnlineManagement](https://www.powershellgallery.com/packages/ExchangeOnlineManagement/). For more information, see [About the Exchange Online PowerShell module](../../docs-conceptual/exchange-online-powershell-v2.md). +> For cloud environments, use the [ExchangeOnlineManagement](https://www.powershellgallery.com/packages/ExchangeOnlineManagement/) in the PowerShell Gallery. For more information, see [About the Exchange Online PowerShell module](../../docs-conceptual/exchange-online-powershell-v2.md). > -> For Exchange Server, there is no Microsoft-provided module in the PowerShell Gallery. Instead, to use PowerShell in Exchange, you have the following options: +> For Exchange Server, you have the following options: > -> - Use the Exchange Management Shell on an Exchange server or that you've installed locally on your own computer using a **Management tools** only installation of Exchange server. For more information, see [Install the Exchange Server Management Tools](/Exchange/plan-and-deploy/post-installation-tasks/install-management-tools) and [Open the Exchange Management Shell](../../docs-conceptual/open-the-exchange-management-shell.md). +> - Use the Exchange Management Shell: +> - On an Exchange server. For more information, see [Open the Exchange Management Shell](../../docs-conceptual/open-the-exchange-management-shell.md). +> - On a local computer where you did a **Management tools** only installation of Exchange server. For more information, see [Install the Exchange Server Management Tools](/Exchange/plan-and-deploy/post-installation-tasks/install-management-tools) > - Use remote PowerShell from a Windows PowerShell session. For more information, see [Connect to Exchange servers using remote PowerShell](../../docs-conceptual/connect-to-exchange-servers-using-remote-powershell.md). ## active-directory Cmdlets