Connect to Exchange Online and Do Stuff

This quick article explains how to connect to Exchange Online using PowerShell, and then how to do some stuff that I've had to do frequently. I'll update it as Microsoft changes commands, or when I have new stuff I gotta do.

First you gotta install some stuff. I assume you already have PowerShell itself, so we'll skip that. Search on PowerShellGallery.com for the latest version. I like to throw the required version on there in case something goes goofy and it tries to install an old deprecated version. Obviously you only need to do the install portion the first time, after that you can just import the module to do your work.

Install-Module -Name ExchangeOnlineManagement -RequiredVersion 3.2.0

Once that's in place, import the module.

Import-Module ExchangeOnlineManagement

Now you need to connect to Exchange Online. It's really easy...

Connect-ExchangeOnline

It will display your typical Microsoft Modern Auth login page. Log in and confirm MFA on an account with Global Admin or Exchange Admin privileges.

If it pukes, you might need to change your execution policy, but if it connected you can skip the Set-ExecutionPolicy commands. I assume you know what you're doing, and you know what these commands do, and what can happen if you install other PS modules all willy-nilly.

Set-ExecutionPolicy RemoteSigned

and if that doesn't work,

Set-ExecutionPolicy UnSigned

Now for some example commands I've used in the past.

Mailbox Size

Get-EXOMailboxStatistics -Identity ""

This will show the overall size of user@email's mailbox. Output looks like this:

DisplayName          : User's Name
MailboxGuid          : aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
DeletedItemCount     : 40672
ItemCount            : 65624
TotalDeletedItemSize : 1.839 GB (1,974,531,829 bytes)
TotalItemSize        : 6.136 GB (6,588,478,477 bytes)

Litigation Hold

Set-Mailbox "" -LitigationHoldEnabled $false

That turns off LitHold for the user's mailbox. WARNING: If the target mailbox does not have an Exchange license attached to the account, and hasn't for like 60-90 days, turning off LitHold will straight up delete the mailbox. You've got it backed up. somewhere, right? RIGHT?

Set-Mailbox "" -LitigationHoldEnabled $true -LitigationHoldDuration NumOfDays

Turns on LitHold for that many days.

E-Mail Address Management

Get-Mailbox "" | select -ExpandProperty emailaddresses | Select-String "smtp"

This shows the existing email addresses for the user. The upper-case SMTP indicates the default address.

Set-Mailbox "" -EmailAddresses @{Add=''}

Adds the indicated alias. Make sure you have admin permission, otherwise you get an error like A parameter cannot be found that matches parameter name 'EmailAddress'

Set-Mailbox "" -EmailAddresses @{Remove=''}

Pulls the alias from the user. Again, be an admin to do this.

This searches for anyone with the alias that begins with "dude" and if you have multiple, it gives a little more info to see which one is which.

Get-EXORecipient -Filter {EmailAddresses -like 'smtp:dude*') | -Properties Name,EmailAddresses | Select Name, EmailAddresses

Distribution Groups

Get-DistributionGroupMember -Identity "GroupName"

Lists all the members of the Distro. If you get no errors and no output, there's nobody in it. Remember that an "owner" isn't necessarily a member of the group.

Add-DistributionGroupMember -Identity "GroupName" -Member ""

This adds your user email to that Distro. Re-run the above "Get" command and you should see someone in there now.

New-DistributionGroup -Name "GroupName" -Type Distribution -ManagedBy "" -Members "","","" -RequireSenderAuthentication $false

Creates a new Distro. ManagedBy can be omitted, it will default to whoever you're creating it as. Members don't have to be entered right then either, but you generally know at least one when you're doing it. The RequireSenderAuthentication being set to FALSE allows randos from the internet to be able to email the group. Think external-facing DLs.

Read up on Microsoft's documentation if you need more options.

Remove-DistributionGroupMember -Identity "GroupName" -Member "" -Confirm $false

Pulls the user from the Distro. You don't need the -Confirm $false bit, but if you omit it you'll get prompted before it does anything.

That's all for now.

Regarding Scripting vs Individual Commands

You'll notice I don't write many, if any, true scripts. I prefer to work with lists in Excel/Numbers, use CONCATENATE operations to build my PowerShell commands, and then paste those into the CLI. This is because I like to know EXACTLY which objects I'm messing with. All too often I've seen a script do mostly good work, but also mess with a user or mailbox object it shouldn't, and cause headache for everyone.

I know in huge environments this can be a bit time consuming, but it's saved my bacon a few times.