You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: exchange/docs-conceptual/disable-access-to-exchange-online-powershell.md
+9-6Lines changed: 9 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: "Enable or disable access to Exchange Online PowerShell"
3
3
ms.author: chrisda
4
4
author: chrisda
5
5
manager: deniseb
6
-
ms.date: 5/16/2024
6
+
ms.date: 12/11/2024
7
7
ms.audience: Admin
8
8
audience: Admin
9
9
ms.topic: article
@@ -18,7 +18,7 @@ description: "Admins can learn how to disable or enable access to Exchange Onlin
18
18
19
19
Exchange Online PowerShell is the administrative interface that enables admins to manage the Exchange Online part of a Microsoft 365 organization from the command line (including many security features in Exchange Online Protection and Microsoft Defender for Office 365).
20
20
21
-
By default, all accounts in Microsoft 365 are allowed to use Exchange Online PowerShell. This access doesn't give users administrative capabilities in an organization. They're still limited by [role based access control (RBAC)](/exchange/permissions-exo/permissions-exo) (for example, they can configure settings on their own mailbox or manage distribution groups that they own, but not much else).
21
+
By default, all accounts in Microsoft 365 are allowed to use Exchange Online PowerShell. This access doesn't give users administrative capabilities. They're still limited by [role based access control (RBAC)](/exchange/permissions-exo/permissions-exo). For example, they can configure some settings on their own mailbox and manage distribution groups that they own, but not much else.
22
22
23
23
Admins can use the procedures in this article to disable or enable a user's ability to connect to Exchange Online PowerShell.
24
24
@@ -33,7 +33,7 @@ Admins can use the procedures in this article to disable or enable a user's abil
33
33
-[Microsoft Entra RBAC](/microsoft-365/admin/add-users/about-admin-roles): Membership in the **Exchange Administrator** or **Global Administrator**<sup>\*</sup> roles gives users the required permissions *and* permissions for other features in Microsoft 365.
34
34
35
35
> [!IMPORTANT]
36
-
> In your haste to quickly and globally disable PowerShell access in your cloud-based organization, beware of commands like `Get-User | Set-User -EXOModuleEnabled $false` without considering admin accounts. Use the procedures in this article to selectively remove PowerShell access, or preserve access for those who need it by using the following syntax in your global removal command: `Get-User | Where-Object {$_.UserPrincipalName -ne '[email protected]' -and $_.UserPrincipalName -ne '[email protected]'...} | Set-User -EXOModuleEnabled $false`.
36
+
> In your haste to quickly and globally disable PowerShell access in your cloud-based organization, beware of commands like `Get-User | Set-User -EXOModuleEnabled $false` without considering admin accounts. Use the procedures in this article to **selectively** remove PowerShell access, or **preserve access for those who need it** by using the following syntax in your global removal command: `Get-User | Where-Object {$_.UserPrincipalName -ne '[email protected]' -and $_.UserPrincipalName -ne '[email protected]'...} | Set-User -EXOModuleEnabled $false`.
37
37
>
38
38
> If you accidentally lock yourself out of PowerShell access, create a new admin account in the Microsoft 365 admin center, and then use that account to give yourself PowerShell access using the procedures in this article.
To prevent access to Exchange Online PowerShell for a specific group of existing users, you have the following options:
64
64
65
-
-**Filter users based on an existing attribute**: This method assumes that the target user accounts all share a unique filterable attribute. Some attributes, such as Title, Department, address information, and telephone number, are available only from the **Get-User** cmdlet. Other attributes, such as CustomAttribute1 to CustomAttribute15, are available only from the **Get-Mailbox** cmdlet.
65
+
-**Filter users based on an existing attribute**: This method assumes that the target user accounts all share a unique filterable attribute. Some attributes (for example, Title, Department, address information, and telephone number) are available only from the **Get-User** cmdlet. Other attributes (for example, CustomAttribute1 to CustomAttribute15) are available only from the **Get-Mailbox** cmdlet.
66
66
-**Use a list of specific users**: After you generate the list of specific users, you can use that list to disable their access to Exchange Online PowerShell.
## View the Exchange Online PowerShell access status for users
109
109
110
+
> [!TIP]
111
+
> The newer `EXOModuleEnabled` property isn't available to use with the *Filter* parameter on the **Get-User** cmdlet, but the values of the `EXOModuleEnabled` property and the older `RemotePowerShellEnabled` property are always the same, so use the `RemotePowerShellEnabled` property with the *Filter* parameter on the **Get-User** cmdlet.
112
+
110
113
To view the PowerShell access status for a specific user, replace \<UserIdentity\> with the name or user principal name (UPN) of the user, and run the following command:
This example adds a policy for the `<cateogry_id>` category in Viva. The policy disables the category (effectively all features under the category) for all users in the organization.
112
+
This example adds a policy for the `<category_id>` category in Viva. The policy disables the category (effectively all features under the category) for all users in the organization.
This example adds a policy for the `<cateogry_id>` category in Viva. The policy disables the category (effectively all features under the category) for all users in the specified groups.
119
+
This example adds a policy for the `<category_id>` category in Viva. The policy disables the category (effectively all features under the category) for all users in the specified groups.
This example adds a policy for the `<cateogry_id>` category in Viva. The policy disables the category (effectively all features under the category) for the specified users.
126
+
This example adds a policy for the `<category_id>` category in Viva. The policy disables the category (effectively all features under the category) for the specified users.
This example adds a policy for the `<cateogry_id>` category in Viva. The policy disables the category (effectively all features under the category) for the specified users and group members.
133
+
This example adds a policy for the `<category_id>` category in Viva. The policy disables the category (effectively all features under the category) for the specified users and group members.
This example adds a policy for the `<cateogry_id>` category in Viva where the policy name is with spaces. The policy disables the category (effectively all features under the category) for all users in the organization.
140
+
This example adds a policy for the `<category_id>` category in Viva where the policy name is with spaces. The policy disables the category (effectively all features under the category) for all users in the organization.
This cmdlet is available only in the Exchange Online PowerShell module v3.7.0-Preview1 or later. For more information, see [About the Exchange Online PowerShell module](https://aka.ms/exov3-module).
16
+
17
+
Use the Add-VivaOrgInsightsDelegatedRole cmdlet to add delegate access to the specified account (the delegate) so they can view organizational insights like the leader (the delegator).
18
+
19
+
For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
To run this cmdlet, you need to be a member of one of the following role groups in Microsoft Entra ID in the destination organization:
31
+
32
+
- Global Administrator
33
+
- Insights Administrator
34
+
35
+
> [!IMPORTANT]
36
+
> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
This example adds the organization insights viewing capability of the specified delegator account to the specified delegate account.
46
+
47
+
## PARAMETERS
48
+
49
+
### -Delegate
50
+
The Delegate parameter specifies the account that can view organizational insights like the leader (the account specified by the Delegator account).
51
+
52
+
A valid value for this parameter is the Microsoft Entra ObjectId value of the delegate account. Use the [Get-MgUser](https://learn.microsoft.com/powershell/module/microsoft.graph.users/get-mguser) cmdlet in Microsoft Graph PowerShell to find this value.
53
+
54
+
```yaml
55
+
Type: Guid
56
+
Parameter Sets: (All)
57
+
Aliases:
58
+
Applicable: Exchange Online
59
+
60
+
Required: True
61
+
Position: Named
62
+
Default value: None
63
+
Accept pipeline input: False
64
+
Accept wildcard characters: False
65
+
```
66
+
67
+
### -Delegator
68
+
The Delegator parameter specifies the account of the leader that can view organizational insights. This capability is delegated to the account specified by the Delegate parameter.
69
+
70
+
A valid value for this parameter is the ObjectID value of the delegator account. Use the [Get-MgUser](https://learn.microsoft.com/powershell/module/microsoft.graph.users/get-mguser) cmdlet in Microsoft Graph PowerShell to find this value.
71
+
72
+
```yaml
73
+
Type: Guid
74
+
Parameter Sets: (All)
75
+
Aliases:
76
+
Applicable: Exchange Online
77
+
78
+
Required: True
79
+
Position: Named
80
+
Default value: None
81
+
Accept pipeline input: False
82
+
Accept wildcard characters: False
83
+
```
84
+
85
+
### -ResultSize
86
+
This parameter is reserved for internal Microsoft use.
87
+
88
+
```yaml
89
+
Type: Unlimited
90
+
Parameter Sets: (All)
91
+
Aliases:
92
+
Applicable: Exchange Online
93
+
94
+
Required: False
95
+
Position: Named
96
+
Default value: None
97
+
Accept pipeline input: False
98
+
Accept wildcard characters: False
99
+
```
100
+
101
+
### CommonParameters
102
+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/p/?LinkID=113216).
Copy file name to clipboardExpand all lines: exchange/exchange-ps/exchange/Connect-ExchangeOnline.md
+28-3Lines changed: 28 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,6 +44,7 @@ Connect-ExchangeOnline
44
44
[-Device]
45
45
[-EnableErrorReporting]
46
46
[-InlineCredential]
47
+
[-LoadCmdletHelp]
47
48
[-LogDirectoryPath <String>]
48
49
[-LogLevel <LogLevel>]
49
50
[-ManagedIdentity]
@@ -496,6 +497,28 @@ Accept pipeline input: False
496
497
Accept wildcard characters: False
497
498
```
498
499
500
+
### -LoadCmdletHelp
501
+
**Note**: This parameter is available in version 3.7.0-Preview1 or later of the module.
502
+
503
+
The LoadCmdletHelp switch downloads cmdlet help files for the Get-Help cmdlet in REST API connections. You don't need to specify a value with this switch.
504
+
505
+
Starting in v3.7.0-Preview1, help files for the command line aren't downloaded by default. Use this switch to download the files for cmdlet help at the command line.
506
+
507
+
**Tip**: This parameter replaces the SkipLoadingCmdletHelp parameter. The SkipLoadingCmdletHelp parameter is no longer required and no longer works, because cmdlet help files are no longer downloaded by default.
508
+
509
+
```yaml
510
+
Type: SwitchParameter
511
+
Parameter Sets: (All)
512
+
Aliases:
513
+
Applicable: Exchange Online
514
+
515
+
Required: False
516
+
Position: Named
517
+
Default value: None
518
+
Accept pipeline input: False
519
+
Accept wildcard characters: False
520
+
```
521
+
499
522
### -LogDirectoryPath
500
523
The LogDirectoryPath parameter specifies the location of the log files. The default location is `%TMP%\EXOCmdletTelemetry\EXOCmdletTelemetry-yyyymmdd-hhmmss.csv`.
**Note**: This parameter is available in version 3.3.0 or later of the module.
680
703
681
-
The SkipLoadingCmdletHelp switch avoids downloading the cmdlet help files for REST API connections. You don't need to specify a value with this switch.
704
+
In version 3.7.0-Preview1 or later, this parameter is replaced by the LoadCmdletHelp parameter. The SkipLoadingCmdletHelp parameter is no longer required and no longer does anything, because cmdlet help files are no longer downloaded by default. Eventually, this parameter will be retired, so remove it from any scripts.
705
+
706
+
The SkipLoadingCmdletHelp switch prevents downloading the cmdlet help files for the Get-Help cmdlet in REST API connections. You don't need to specify a value with this switch.
682
707
683
-
When you use this switch, you don't get local help files for any cmdlet.
708
+
When you use this switch, you don't get local help files for any cmdlet at the command line.
684
709
685
710
This switch doesn't work with the UseRPSSession switch.
0 commit comments