Information Systems:Exchange Online administration with PowerShell

Overview

Some settings of Exchange Online are still only manageable through PowerShell. Our Exchange Online instance can be managed by PowerShell through a remote connection.

Pre-requisites

Note: These instructions may change as PowerShell and Exchange continues to be upgraded. Check with official docs if you encounter issues.

• To connect to Exchange Online via PowerShell, the EXO V2 (as of 2021-03-29) PowerShell module is required. This module contains the cmdlets necessary for Exchange administration tasks. To install, issue this command in PowerShell Install-Module -Name ExchangeOnlineManagement
• EXO V2 is supported in PowerShell v7 (the docs say this, despite the min version saying PS 3.0). This is currently a few versions newer than the PowerShell built-in to Windows. Newer versions are available on the official PowerShell GitHub

Documentation

How to connect to Exchange Online in PowerShell and how to use it to manage Exchange are best learned through Microsoft's Exchange Online PowerShell docs. Specifically, the Reference section provides detailed info for all the "cmdlets" in both regular Exchange and the new EXO V2 modules.

Useful PowerShell snippets

Listed below are snippets I've actually used to accomplish a change. So they're both vetted for our environment, but also, were for a specific change being effected, so adapt them as necessary.

Toggle hidden-from-GAL attribute of private contacts

 # This assumes the contacts have been set up with the convention to prefix private/sensitive contacts with [Private]
 $AddressesToUpdate = Get-MailContact -Filter "DisplayName -like '[Private]*'"
 # Print them out first with this command
 $AddressesToUpdate | foreach{Write-Output $_.DisplayName} 
 # Change to $true if going the other way.
 $AddressesToUpdate | foreach{Set-MailContact -Identity $_.DisplayName -HiddenFromAddressListsEnabled $false}
 

Forcing an update of address lists

Sometimes modifying an address list's filter criteria does not effect the desired changes. That is, after modifying RecipientFilter, the address list members have not changed. Apparently, this is a known issue.

The workaround:

 $contacts = Get-MailContact
 # Customer Attribute 14 is suggested here out of caution (because we might end up using 1-13)
 $contacts | Set-MailContact -CustomAttribute14 "t"
 $contacts | Set-MailContact -CustomeAttribute14 "`$null"
 

Yes the workaround is literally to set a dummy value for all contacts and then undo the change, just to nudge it into updating.

Granting mailbox permissions to another user

1. Connect via PowerShell
2. Issue the following command: Add-MailboxPermission -Identity Mailboxname -User Username -AccessRight FullAccess -Automapping $false. Automapping=false will prevent the mailbox from automatically loading in Outlook client.
3. If send permissions are required: Set-Mailbox -Identity Mailboxname -GrantSendOnBehalfTo Username. Alternatively, the Set-RecipientPermission cmdlet can be used for Send as permission instead.

Notes

• After checking it out, PowerShell programming (e.g. using for loops, if/else constructs, exporting to file etc.) would be the real advantage to using PowerShell to do Exchange administration, especially when batch changes/exports are necessary. Otherwise, most of the Exchange cmdlets have GUI equivalents. Performance can be equally sluggish through PowerShell as well (experienced a connection timeout and slow return of query results).
• EAC has a web shell feature (Azure Cloud Shell), but to use this requires Azure Cloud Storage (and the small cost associated with creating a storage blob to store whatever Cloud Shell needs to store). For reference, its location in EAC is shown here:

• The following is a good example of the kind of setting that is still only available in PowerShell. Both is (just Focused Inbox) and isn't (imagine doing for 5000 users) a big deal.