View source for Information Systems:Exchange Online administration with PowerShell

==Overview==
Some settings of Exchange Online are still only manageable through PowerShell. Our Exchange Online instance can be managed by PowerShell through a remote connection.

==Pre-requisites==
''Note: These instructions may change as PowerShell and Exchange continues to be upgraded. Check with official docs if you encounter issues.''

* To connect to Exchange Online via PowerShell, the EXO V2 (as of 2021-03-29) PowerShell module is required. This module contains the cmdlets necessary for Exchange administration tasks. To install, issue this command in PowerShell <code>Install-Module -Name ExchangeOnlineManagement</code>
* EXO V2 is supported in PowerShell v7 (the docs say this, despite the min version saying PS 3.0). This is currently a few versions newer than the PowerShell built-in to Windows. Newer versions are available on the official [https://github.com/PowerShell/PowerShell/tree/v7.1.3 PowerShell GitHub]

==Documentation==
How to connect to Exchange Online in PowerShell and how to use it to manage Exchange are best learned through Microsoft's [https://docs.microsoft.com/en-us/powershell/exchange/exchange-online-powershell?view=exchange-ps Exchange Online PowerShell] docs. Specifically, the Reference section provides detailed info for all the "cmdlets" in both regular Exchange and the new EXO V2 modules.

==Useful PowerShell snippets==
Listed below are snippets I've actually used to accomplish a change. So they're both vetted for our environment, but also, were for a specific change being effected, so adapt them as necessary.
===Toggle hidden-from-GAL attribute of private contacts===
 <nowiki>
 # This assumes the contacts have been set up with the convention to prefix private/sensitive contacts with [Private]
 $AddressesToUpdate = Get-MailContact -Filter "DisplayName -like '[Private]*'"
 # Print them out first with this command
 $AddressesToUpdate | foreach{Write-Output $_.DisplayName} 
 # Change to $true if going the other way.
 $AddressesToUpdate | foreach{Set-MailContact -Identity $_.DisplayName -HiddenFromAddressListsEnabled $false}
 </nowiki>
===Forcing an update of address lists===
Sometimes modifying an address list's filter criteria does not effect the desired changes. That is, after modifying RecipientFilter, the address list members have not changed. Apparently, [https://docs.microsoft.com/en-us/exchange/troubleshoot/administration/new-address-lists-not-contains-all-recipients this is a known issue.]

The workaround:
 <nowiki>
 $contacts = Get-MailContact
 # Customer Attribute 14 is suggested here out of caution (because we might end up using 1-13)
 $contacts | Set-MailContact -CustomAttribute14 "t"
 $contacts | Set-MailContact -CustomeAttribute14 "`$null"
 </nowiki>

Yes the workaround is literally to set a dummy value for all contacts and then undo the change, just to nudge it into updating.
===Granting mailbox permissions to another user===
# Connect via PowerShell
# Issue the following command: <code>Add-MailboxPermission -Identity Mailboxname  -User Username -AccessRight FullAccess  -Automapping $false</code>. Automapping=false will prevent the mailbox from automatically loading in Outlook client.
# If send permissions are required: <code>Set-Mailbox -Identity Mailboxname -GrantSendOnBehalfTo Username</code>. Alternatively, the Set-RecipientPermission cmdlet can be used for ''Send as'' permission instead.

==Notes==
* After checking it out, PowerShell programming (e.g. using for loops, if/else constructs, exporting to file etc.) would be the real advantage to using PowerShell to do Exchange administration, especially when batch changes/exports are necessary. Otherwise, most of the Exchange cmdlets have GUI equivalents. Performance can be equally sluggish through PowerShell as well (experienced a connection timeout and slow return of query results).
* EAC has a web shell feature (Azure Cloud Shell), but to use this requires Azure Cloud Storage (and the small cost associated with creating a storage blob to store whatever Cloud Shell needs to store). For reference, its location in EAC is shown here:
:[[File:2021-03-29 11_44_27-Exchange admin center.png|200px]]
* The following is a good example of the kind of setting that is still only available in PowerShell. Both is (just Focused Inbox) and isn't (imagine doing for 5000 users) a big deal.
:[[File:2021-03-30 21_59_16-Configure Focused Inbox for everyone in your organization - Microsoft 365 admin .png|400px]]