Easily Connect to Exchange Online with PowerShell

In a previous article, I explained how to connect to Office 365 with PowerShell. In this article, we explore how to use PowerShell to connect to Exchange Online. This can vary based on what authentication method you have configured for your admin account. The sections below cover each authentication method.

1. If your admin account has MFA enabled
2. If your admin account has MFA disabled
3. If you are using ADFS (SSO)
4. Prereqs for older operating systems
5. Let’s script this instead

Let’s get started!

If your admin account has MFA enabled

If your administrator account has multi-factor authentication enabled you won’t be able to use the built-in PowerShell. Instead, you will need to download the Exchange Online PowerShell Module.

To do this, log into the Office 365 Admin Center, navigate to the Exchange Admin Center, and click the Hybrid tab.

From the hybrid tab, click the second Configure button (under the text that states The Exchange Online PowerShell Module supports multi-factor authentication).

Note: You can only download this with Internet Explorer. This module will error out if you use Chrome or Firefox.

This will create a new icon on your desktop named Microsoft Exchange Online Powershell Module. Double-click Microsoft Exchange Online Powershell Module.

This will launch PowerShell with the Exchange Online Module preloaded. To connect we will use the Connect-EXOPSSession cmdlet. In this cmdlet swap the -UserPrincipleName parameter for your administrator’s login name.

 C:\> Connect-EXOPSSession -UserPrincipalName globaladmin@contoso.com

This command should launch a web pop-up. Enter your Password and click Sign in.

MFA will then give you a challenge response. In the example below, the MFA settings are configured to send a push notification to the Microsoft Authenticator app. Other examples include inputting a code received via text message or verifying a phone call. What you see here depends on how you have configured MFA for your admin account.

Continuing with our Microsoft Authenticator app example, we will click Approve on our mobile device.

You will then be connected to Exchange Online. Be sure to close your session once you are done (Get-PSSession | Remove-PSSession).

If your admin account has MFA disabled

If your admin account does not have MFA enabled you can use regular PowerShell. Right-click on the PowerShell icon and select Run As Administrator from the context menu.

First, we need to set the execution policy.

 C:\> Set-ExecutionPolicy RemoteSigned

Next, we need to store our Office 365 credentials in a variable. Type the command below and hit enter.

 C:\> $UserCredential = Get-Credential

A dialog box will appear. Type in your Office 365 credentials and click Ok.

Now let’s connect. In the command below we put our connection info into a variable. This results in less typing later.

 C:\> $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

Finally, let’s use that variable to connect to Exchange Online and import all Exchange cmdlets into our session.

 C:\> Import-PSSession $Session

You are now connected. To test your connection try running an Exchange command like Get-Mailbox.

When you are done, be sure to end your remote session with Remove-PSSession $Session.

If you have ADFS (Single Sign-On)

If you have Active Directory Federation Services (SSO) in your environment you can skip the credential prompt. To connect to Exchange Online from a domain-joined computer, open PowerShell as an administrator and, issue the following commands.

 C:\> Set-ExecutionPolicy RemoteSigned

Be sure to switch the -Authentication parameter to a value of Kerberos and drop the -Credential parameter.

 C:\> $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Authentication Kerberos -AllowRedirection

Finally, import the session using the variable.

 C:\> Import-PSSession $Session

If you are connecting from an older OS

If you are connecting from Windows 10 you can safely skip this section. If you are using Windows 8 or older, this section is for you.

Minimally your computer needs to be running:

• Windows 7 Service Pack 1 or newer.
• Server 2008 R2 Service Pack 1 or newer.

If running Windows 7, you will need to install .NET Framework 4.5. This comes included with Windows 8+ and Server 2012+. For Windows 7, it can be downloaded from here.

If running Windows 7 or 8, you will also need the Windows Management Framework 4.0. This comes included with Windows 8.1+ and Server 2012 R2+. For Windows 7 and 8, it can be downloaded from here.

Connect to Exchange Online with a script

It is also possible to drop all these commands into your PowerShell profile as a function. To locate your profile open PowerShell and type $profile. This should come back with the location.

 C:\> $profile
C:\Users\SuperTekBoy\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Navigate to the folder and edit the profile script. If the PS1 file does not exist you can create a blank one.

In this example, we create a function named Connect-EXO. You can name this function whatever you like. But shorter is sweeter. Copy the script below into your Powershell profile. When you launch PowerShell simple type the name of your function to initiate the connection process.

Note: If you would rather just download the PowerShell profile with the included function you can get it here. Always scrutinize scripts you download from the internet, even those from trusted sources. Be sure to validate scripts in a test environment first.

Function Connect-EXO {
Set-ExecutionPolicy RemoteSigned
$UserCredential = Get-Credential
$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Authentication Basic -AllowRedirection -Credential $UserCredential
Import-PSSession $session
}

Provided you have all the prerequisites you can also throw in the connection command to Azure Active Directory by simply adding this extra line (or call it out in its own function).

Connect-MsolService –Credential $UserCredential

How has your experience been with connecting PowerShell to Exchange Online? Or perhaps, connecting to Azure Active Directory? Join the conversation on Twitter @SuperTekBoy.