Microsoft Office PowerShell Documentation and Tools

The Exchange Online PowerShell module (also known as the EXO V3 module) provides a way to connect to all Exchange cloud-related PowerShell environments using modern authentication. It supports both standard authentication and Multi-Factor Authentication (MFA).

Supported environments include:

• Exchange Online PowerShell
• Security & Compliance PowerShell
• PowerShell for the Built-in security add-on for on-premises mailboxes

Use the Set-AuthConfig cmdlet to modify the authorization configuration for your Exchange organization. This is primarily used to define Microsoft Exchange as a partner application for server-to-server authentication with applications like Microsoft SharePoint 2013 or Skype for Business Server 2015.

This cmdlet is used to manage the certificate used for signing tokens, typically when you need to replace a self-signed certificate or update an expired one.

Note: This cmdlet is available only in on-premises Exchange (Exchange Server 2013, 2016, 2019, and SE).

Set-AuthConfig -NewCertificateThumbprint DB821B4FCA2A5DA9593B9DE00C86BC5EA35D0FC0 -NewCertificateEffectiveDate 4/17/2014

The New-ExchangeCertificate cmdlet is used in on-premises Exchange environments to:

• Create and renew self-signed certificates.
• Create certificate requests (Certificate Signing Requests or CSRs) for new certificates or renewals from a Certification Authority (CA).

Note: This cmdlet is only available in on-premises Exchange (Exchange Server 2010, 2013, 2016, 2019, and SE).

App-only authentication (also known as Certificate Based Authentication or CBA) allows unattended scripts to connect to Exchange Online and Security & Compliance PowerShell without storing user credentials.

Mechanism:

1. The PowerShell module uses the Active Directory Authentication Library to fetch an app-only token using the Application ID, Tenant ID (passed via the -Organization parameter), and a Certificate.
2. The Microsoft Entra application object must have a Directory Role assigned to it.
3. The access token contains the directory role information, which the session uses to configure Role Based Access Control (RBAC).

When using New-EcpVirtualDirectory, you can define the connectivity URLs and the specific service role for the directory.

Connectivity URLs

• -ExternalUrl: The URL used to connect to the virtual directory from outside the firewall. This is critical for TLS encryption and allows the Autodiscover service to return the correct URL.
• -InternalUrl: The URL used to connect from inside the firewall. Also critical for TLS and Autodiscover.

Virtual Directory Roles

Use the -Role parameter to specify the configuration type:

• ClientAccess: Configures the directory for Client Access (frontend) services on the Mailbox server.
• Mailbox: Configures the directory for backend services on the Mailbox server. Note: Clients connect to Client Access services, which then proxy requests to the backend services.

Applicable Versions: Exchange Server 2013, 2016, 2019, and SE.

Cmdlet extension agents are used by Exchange cmdlets in Exchange Server 2010 and later. They allow cmdlets to perform additional operations by running logic on every Exchange server in the organization.

Note that cmdlets provided by other Microsoft or non-Microsoft products cannot use these agents. Before enabling an agent, ensure you understand its function and the potential impact on your organization.

The -InMemory switch creates an object reference without committing the changes permanently to the server.

Workflow:

1. Call New-CsUserReplicatorConfiguration with the -InMemory flag and assign the output to a variable.
2. Modify the properties of that variable in your session.
3. Commit the changes by calling the matching Set-CsUserReplicatorConfiguration cmdlet.

# Example workflow pattern
$config = New-CsUserReplicatorConfiguration -Identity "service:Registrar:example.com" -InMemory
# ... modify $config properties ...
Set-CsUserReplicatorConfiguration -Identity "service:Registrar:example.com" -Configuration $config

You can control how message classifications appear to users and interact with transport rules using the following parameters:

• -DisplayPrecedence: Sets the relative importance of the classification. If multiple classifications are applied (e.g., via transport rules), the one with the highest precedence is shown first. Valid values: Highest, Higher, High, MediumHigh, Medium (default), MediumLow, Low, Lower, Lowest.
• -PermissionMenuVisible: Controls whether users can assign the classification while composing a message.
  • $true (default): Users can assign the classification in Outlook.
  • $false: Users cannot assign it, but received messages will still display the classification info.
• -RetainClassificationEnabled: Determines if the classification persists when a message is forwarded or replied to. Default is $true.