Exchange Online PowerShell Cheat Sheet: Ultimate Admin Guide

by

An Exchange Online PowerShell Cheat Sheet is the fastest way to turn a 40-click admin center task into one repeatable line. If you run Microsoft 365 tenants, you know the Exchange admin center (EAC) works for one-off changes but breaks down for bulk work, audits, and incident response. PowerShell gives you speed, consistency, and a paper trail.

This Exchange Online PowerShell Cheat Sheet follows how admins actually work: connect, manage mailboxes, control permissions, handle groups, troubleshoot mail flow, harden security, and report. Every command uses the modern ExchangeOnlineManagement (V3) module. Nothing here depends on the retired basic-auth remote PowerShell.

Prerequisites and Connecting Securely

Before you use any Exchange Online PowerShell Cheat Sheet, get the foundation right. You need PowerShell 7 (5.1 also works), the ExchangeOnlineManagement module, and an appropriate role such as Exchange Administrator or a scoped RBAC role group.

# Install or update the module
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Update-Module ExchangeOnlineManagement

# Interactive connection (supports MFA)
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com -ShowBanner:$false

# Unattended automation with certificate-based, app-only auth
Connect-ExchangeOnline -CertificateThumbprint "<thumbprint>" -AppId "<app-id>" -Organization "contoso.onmicrosoft.com"

# Verify and disconnect
Get-ConnectionInformation
Disconnect-ExchangeOnline -Confirm:$false

For scheduled scripts, use certificate-based authentication or a managed identity instead of stored passwords. It is the single biggest security upgrade you can make to your automation.

Mailbox Management Commands

Mailbox commands are the core of any Exchange Online PowerShell Cheat Sheet, because most tickets start here.

# List mailboxes by type
Get-Mailbox -ResultSize Unlimited
Get-Mailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited

# Create a shared mailbox
New-Mailbox -Shared -Name "Support" -DisplayName "Support Team" -Alias support

# Convert a user mailbox to shared (for offboarding)
Set-Mailbox -Identity user@contoso.com -Type Shared

# Check size and last logon
Get-MailboxStatistics user@contoso.com | Select DisplayName, TotalItemSize, ItemCount, LastLogonTime

# Set quotas
Set-Mailbox user@contoso.com -IssueWarningQuota 45GB -ProhibitSendQuota 49GB -ProhibitSendReceiveQuota 50GB

# Enable the online archive
Enable-Mailbox user@contoso.com -Archive

# Enable Auto expanding online archive
Enable-Mailbox -Identity user@contoso.com -AutoExpandingArchive


# Litigation hold for 7 years (requires an eligible license)
Set-Mailbox user@contoso.com -LitigationHoldEnabled $true -LitigationHoldDuration 2555

# Automatic replies
Set-MailboxAutoReplyConfiguration -Identity user@contoso.com -AutoReplyState Enabled -InternalMessage "I'm out of office." -ExternalMessage "I'm out of office."

# Hide from the address list
Set-Mailbox user@contoso.com -HiddenFromAddressListsEnabled $true

Shared mailboxes under 50 GB need no license, but a litigation hold or an archive over that size does. Confirm licensing before you convert or hold.

Permission Commands: Full Access, Send As, Send on Behalf

No Exchange Online PowerShell Cheat Sheet is complete without permissions, which are the most common source of “I can’t see the mailbox” tickets.

# Full Access (disable auto-mapping if you don't want it in Outlook)
Add-MailboxPermission -Identity support@contoso.com -User jane@contoso.com -AccessRights FullAccess -AutoMapping $false

# Send As
Add-RecipientPermission -Identity support@contoso.com -Trustee jane@contoso.com -AccessRights SendAs -Confirm:$false

# Send on Behalf
Set-Mailbox support@contoso.com -GrantSendOnBehalfTo @{Add="jane@contoso.com"}

# Audit who has access
Get-MailboxPermission -Identity support@contoso.com | Where-Object { $_.User -ne "NT AUTHORITY\SELF" }

# Remove access
Remove-MailboxPermission -Identity support@contoso.com -User jane@contoso.com -AccessRights FullAccess -Confirm:$false

# Calendar sharing
Add-MailboxFolderPermission -Identity "boss@contoso.com:\Calendar" -User assistant@contoso.com -AccessRights Editor
Set-MailboxFolderPermission -Identity "boss@contoso.com:\Calendar" -User Default -AccessRights LimitedDetails

Note: If your tenant uses a non-English language, the calendar folder name may differ, so check with Get-MailboxFolderStatistics.

Distribution Lists and Microsoft 365 Groups

# Distribution group
New-DistributionGroup -Name "Sales" -PrimarySmtpAddress sales@contoso.com -Type Distribution
Add-DistributionGroupMember -Identity "Sales" -Member jane@contoso.com
Get-DistributionGroupMember -Identity "Sales" -ResultSize Unlimited

# Microsoft 365 Group
New-UnifiedGroup -DisplayName "Project Atlas" -Alias projectatlas
Add-UnifiedGroupLinks -Identity "Project Atlas" -LinkType Members -Links jane@contoso.com

Mail Flow and Message Trace Troubleshooting

Mail flow questions dominate helpdesk queues, so this Exchange Online PowerShell Cheat Sheet puts the essentials in one place.

# Message trace (Microsoft is moving from Get-MessageTrace to the V2 cmdlets)
Get-MessageTraceV2 -SenderAddress jane@contoso.com -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date)

# Review quarantined mail and release it
Get-QuarantineMessage -RecipientAddress user@contoso.com
Release-QuarantineMessage -Identity "<identity>" -ReleaseToAll

# Mail flow (transport) rules
Get-TransportRule | Select Name, State, Priority
New-TransportRule -Name "Tag External Mail" -FromScope NotInOrganization -PrependSubject "[EXTERNAL] "

# Accepted domains
Get-AcceptedDomain

Check the current Microsoft Learn documentation for message trace date-range and retention limits, since they have changed as the V2 cmdlets roll out.

Exchange Online Mail Flow Troubleshooting: Step-by-Step Complete Guide

How Message Trace Works in Exchange Online: The Ultimate Positive Guide for Admins

Security Hardening Commands

Security is where an Exchange Online PowerShell Cheat Sheet earns its keep during a compromised-account investigation.

# Hunt for suspicious inbox rules (a classic account-takeover sign)
Get-InboxRule -Mailbox user@contoso.com | Select Name, Enabled, ForwardTo, ForwardAsAttachmentTo, RedirectTo, DeleteMessage

# Find mailboxes forwarding externally
Get-EXOMailbox -ResultSize Unlimited -Properties ForwardingSmtpAddress, ForwardingAddress |
  Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
  Select DisplayName, ForwardingSmtpAddress, ForwardingAddress

# Disable legacy protocols per mailbox
Set-CASMailbox user@contoso.com -ImapEnabled $false -PopEnabled $false -SmtpClientAuthenticationDisabled $true

# Disable SMTP AUTH tenant-wide
Set-TransportConfig -SmtpClientAuthenticationDisabled $true

# Confirm auditing is on
Set-OrganizationConfig -AuditDisabled $false
Get-Mailbox user@contoso.com | Select AuditEnabled

# Unified audit log search
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -UserIds user@contoso.com -ResultSize 500

Run the forwarding and inbox-rule checks monthly. Attackers often persist through a hidden forwarding rule long after a password reset.

Reporting and Bulk Operations

Use the Get-EXO cmdlets for reporting. They use REST-based calls and are much faster than the older cmdlets on large tenants.

# Mailbox size report exported to CSV
Get-EXOMailbox -ResultSize Unlimited | ForEach-Object {
  $s = Get-EXOMailboxStatistics $_.UserPrincipalName
  [PSCustomObject]@{
    Name      = $_.DisplayName
    SizeGB    = [math]::Round(([long]($s.TotalItemSize.ToString() -replace '.*\(|\sbytes\).*|,','') / 1GB), 2)
    Items     = $s.ItemCount
    LastLogon = $s.LastLogonTime
  }
} | Sort-Object SizeGB -Descending | Export-Csv .\MailboxSizes.csv -NoTypeInformation

# Bulk change from a CSV
Import-Csv .\users.csv | ForEach-Object {
  Set-Mailbox -Identity $_.UserPrincipalName -LitigationHoldEnabled $true
}

Pro Tips That Separate Experts from Beginners

The best Exchange Online PowerShell Cheat Sheet habits are about safety and performance, not just syntax.

  • Test first. Add -WhatIf to any Set-, Remove-, or New- command before running it against production.
  • Filter server-side. Use -Filter or -RecipientTypeDetails instead of piping everything to Where-Object. It cuts runtime dramatically on large tenants.
  • Prefer Get-EXO cmdlets for large queries, and always set -ResultSize Unlimited when you need complete data.
  • Log your work. Use Start-Transcript so every change is documented for audits.
  • Apply least privilege. Create custom RBAC role groups instead of handing out Global Administrator.
  • Use -Confirm:$false deliberately. Only add it in scripts you have already tested.

Exchange Online PowerShell Cheat Sheet: Quick Reference Table

TaskCmdlet
ConnectConnect-ExchangeOnline
List mailboxesGet-EXOMailbox
Convert to sharedSet-Mailbox -Type Shared
Grant Full AccessAdd-MailboxPermission
Grant Send AsAdd-RecipientPermission
Message traceGet-MessageTraceV2
Inbox rulesGet-InboxRule
Disable SMTP AUTHSet-TransportConfig
Litigation holdSet-Mailbox -LitigationHoldEnabled
Audit searchSearch-UnifiedAuditLog

Frequently Asked Questions

What is an Exchange Online PowerShell Cheat Sheet used for?
It is a quick reference of the cmdlets admins use most often to manage mailboxes, permissions, mail flow, and security in Microsoft 365, so they don’t have to look up syntax each time.

Do I still need basic authentication for Exchange Online PowerShell?
No. Basic authentication and the old remote PowerShell method are retired. Use the ExchangeOnlineManagement module with modern authentication, and certificate-based auth for automation.

Is PowerShell faster than the Exchange admin center?
For anything beyond a handful of objects, yes. Bulk changes, audits, and reports that take hours in the EAC take minutes in a script.

Final Thoughts

Mastering the commands in this Exchange Online PowerShell Cheat Sheet will save you hours every week and shrink your response time during security incidents. Start with the connection and permission commands, add the security checks to a monthly routine, and build reusable scripts around the reporting examples. Bookmark this Exchange Online PowerShell Cheat Sheet and revisit it whenever a ticket lands that you would otherwise handle by clicking through the portal.

Test every command in a non-production tenant or with -WhatIf first, and confirm cmdlet details against current Microsoft documentation, since Exchange Online changes frequently.

Conditional Access Interview Questions: Proven Answers 2026

Microsoft 365 Tenant Admin: Ultimate Security & Roles Guide

Powerful Fix: Purview Content Search Returns 0 Items in PowerShell While Portal Shows Results

Vishal Prajapati is a Microsoft 365 administrator and technology enthusiast with hands-on experience managing and supporting modern cloud-based environments. He works extensively with Microsoft 365 services and focuses on helping administrators understand complex concepts through clear, practical, and real-world guidance.

Leave a Comment