Connect to Office 365 – PowerShell

Office 365 Design and Integration

Office 365 is a service oriented infrastructure and you will have multiple management interfaces based on the services you choose to activate and use.

In this post we will focus on user and mailbox management.

Understanding the Office 365 Structure

Before going into details make sure you have the proper understanding of the Office 365 components and how they integrate with your on-premises environment:

Office 365 Design and Integration

Your Office 365 mailboxes reside in Exchange Online and the corresponding user accounts reside in Azure Active Directory (Exchange Online is dependent on Azure Active Directory – understand why).

On top of that there are multiple user attributes affecting the Exchange Online mailbox, which are still managed in your on-premises Active Directory.

Therefore, managing your users and mailboxes will involve interactions with both your on-premises Active Directory, the Azure Active Directory and Exchange Online!

Connect to Azure AD With PowerShell

You have two options to manage Azure AD using Powershell:

  • Azure AD PowerShell for Graph (all commands have AzureAD in the name)
  • Azure Active Directory Module for Windows PowerShell (all commands have Msol in the name)

Question is, should you use one or the other? The answer, of course, depends. The AzureAD module is expected to replace the MSOL module in the long term but currently the MSOL module offers the best support for managing your Azure AD. Personally I favor the MSOL module but it’s mostly out of a habit.

Connect to Azure via MSOL (MSOnline)

To connect to Azure AD using the MSOL module use the following commands:

  1. # Install the MSOnline module if this is first use
  2. Install-Module MSOnline
  3. # Add the MSOnline module to the PowerShell session
  4. Import-Module MSOnline
  5. # Get credentials of Azure admin
  6. $Credentials = Get-Credential
  7. # Connect to Azure AD
  8. Connect-MsolService -Credential $Credentials

With all pre-req’s in place you can simply run Connect-MsolService.

Notice that PowerShell is able to automatically download the MSOL (MSOnline) module from the PowerShell Gallery. Downloading modules requires the NuGet package provider which is itself installed automatically when needed (but you need PowerShell v. 5.1 or later).

Connect to Azure via Azure AD

To connect to Azure AD PowerShell for Graph use the following commands:

  1. # Install the AzureAD module if this is first use
  2. Install-Module AzureAD
  3. # Add the AzureAD module to the PowerShell session
  4. Import-Module AzureAD
  5. # Get credentials of Azure admin
  6. $Credentials = Get-Credential
  7. # Connect to Azure AD
  8. Connect-AzureAD -Credential $Credentials

If you already have the Azure AD module installed and imported you can simply run Connect-AzureAD.

Connect to Exchange Online

A lot of the mailbox configurations take place in Exchange Online. That’s why you’ll also need to connect to the Exchange Online service using PowerShell.

There are two ways to connect to Exchange Online.

Option 1: Remote Session

The first option doesn’t require you to install anything as it utilizes a remote session. It doesn’t however support multi-factor authentication (MFA).

Use the following commands to create a remote session to Exchange Online:

  1. $Credentials = Get-Credential
  2. $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri -Credential $Credentials -Authentication Basic -AllowRedirection
  3. Import-PSSession $Session -DisableNameChecking

This gives you access to run all the Exchange management cmdlets.

Always keep in mind to close the remote session when you’re done. This is done using the following command:

  1. Remove-PSSession $Session

If you don’t close your session and create more sessions at a later time you risk using up the number of allowed connections. This will generate the following error:

New-PSSession : [] Processing data from remote server failed with the following error message: [AuthZRequestId=68f35d6d-77b9-4119-b9d2-2e79f55bd1dc][FailureCategory=AuthZ-AuthorizationException] Fail to create a runspace because you have exceeded the maximum number of connections allowed : 3 for the policy party : MaxConcurrency. Please close existing runspace and try again. Policy: CN=GlobalThrottlingPolicy_e4f3120d-20ce-4ce9-ba82-ed2eef7f9607,CN=Global Settings,CN=ExchangeLabs,CN=Microsoft Exchange,CN=Services, CN=Configuration,DC=EURP189,DC=PROD,DC=OUTLOOK,DC=COM;

Option 2: The Exchange Online V2 Module

The second option is to use the Exchange Online V2 (EXO V2) module. This allows you to connect with a MFA enabled account. Also, this module has some better performing commands to retrieve a large number of mailboxes.

On first use you must install the Exchange Online V2 module:

  1. Install-Module ExchangeOnlineManagement

Once the module is installed you can import it and connect to Exchange Online:

  1. Import-Module ExchangeOnlineManagement
  2. Connect-ExchangeOnline -UserPrincipalName

You’re then ready to execute PowerShell commands against Exchange Online.

Don’t Forget Your Local Active Directory

Keep in mind that lot’s of mailbox related attributes (like proxyAddresses, mailNickname, mxExchHideFromAddressLists, etc.) are managed in your local Active Directory (and synchronized to Azure via Azure AD Connect). So you will also need to manage your on-premises user accounts to complete your Office 365 mailbox management.

PowerShell can of course be used but requires the Active Directory module. This module is available by default on your Domain Controllers and can be installed as a feature on non-DC’s. To use the Active Directory PowerShell module on Windows 10 you need to install the RSAT (Remote Server Administration Tools) which can be downloaded here.

Tying It All Up

We now covered connecting with the following Office 365 management interfaces for PowerShell:

  • Azure user management using the MSOL and Azure AD modules
  • Exchange Online management using PowerShell remoting
  • On-premises Active Directory management using the ActiveDirectory module

The combination of all three interfaces (Azure/Exchange Online/Active Directory) are needed for full Office 365 user and mailbox management.

If you want a GUI approach to manage all these interfaces in a single combined tool take a look at Easy365Manager: Download 14 day unlimited free trial.

Did you like this post? Maybe your friends will too!