EXO V3 – PowerShell Module With REST

EXO V3 REST API that is not really ready for production.

The EXO V3 PowerShell module (ExchangeOnlineManagment) was released on September 19th, 2022.

The EXO V3 is the general availability release of the REST-based PowerShell API to manage Exchange Online.

Let’s have a closer look at what’s new with this update. And what sucks…

Exchange Online REST API

The most important feature of EXO V3 is that EXO PowerShell CmdLets are now running as REST API calls instead of running via a remote PowerShell session.

The most obvious benefit is that you can now finally disable basic authentication on WinRM.

The remote PowerShell session used by previous versions of the EXO PowerShell module required basic authentication of WinRM.

You can check the status of WinRM authentication using the following command:

PS C:\> & winrm get winrm/config/client/auth
Auth
    Basic = true
    Digest = true
    Kerberos = true
    Negotiate = true
    Certificate = true
    CredSSP = false

To disable basic authentication on WinRM use the following command:

PS C:\> & winrm set winrm/config/client/auth '@{Basic="false"}'
Auth
    Basic = false
    Digest = true
    Kerberos = true
    Negotiate = true
    Certificate = true
    CredSSP = false

EXO V3 Smells Like a Beta

Great news that EXO PowerShell is now using production-ready REST API calls.

Or is it…?

If we take a closer look, we’ll find that the REST API used by the EXO V3 general availability release is STILL IN BETA:

PS C:\> Get-Mailbox Lene.Hau -Verbose
VERBOSE: Computed version info: 3.0.0
VERBOSE: POST https://outlook.office365.com/adminapi/beta/8a35f394-855d-4d13-9f6f-86d8eb24dc6b/InvokeCommand with -1-byte payload
VERBOSE: received 4947-byte response of content type application/json;charset=utf-8
Name                      Alias           Database                       ProhibitSendQuota    ExternalDirectoryObjectId
----                      -----           --------                       -----------------    -------------------------
Lene Hau                  lene.hau        EURPR09DG188-db035             99 GB (106,300,44... 97d3bc7f-8ee6-4974-9115-c33087ad5600

EXO V3 is calling a BETA API – a huge disappointment…

This raises a suspicion that someone ordered the Exchange Online PowerShell team to release EXO V3 even though the Exchange Online REST API is still not production ready.

Another fact that supports this concern is that the Connect-ExchangeOnline CmdLet triggers a download of a PowerShell module with all the basic Exchange Online CmdLets:

PS C:\> Connect-ExchangeOnline
----------------------------------------------------------------------------------------
This V3 EXO PowerShell module contains new REST API backed Exchange Online cmdlets which
doesn't require WinRM for Client-Server communication. You can now run these cmdlets after
turning off WinRM Basic Auth in your client machine thus making it more secure.
Unlike the EXO* prefixed cmdlets, the cmdlets in this module support full functional
parity with the RPS (V1) cmdlets.
V3 cmdlets in the downloaded module are resilient to transient failures, handling retries
and throttling errors inherently.
However, REST backed EOP and SCC cmdlets are not available yet. To use those, you will
need to enable WinRM Basic Auth.
For more information check https://aka.ms/exov3-module
----------------------------------------------------------------------------------------
PS C:\> Get-Command Get-Mailbox | ft -AutoSize
CommandType Name        Version Source
----------- ----        ------- ------
Function    Get-Mailbox 1.0     tmpEXO_ws2oodie.yfi

PS C:\> Get-Module tmpEXO_ws2oodie.yfi | fl

Name              : tmpEXO_ws2oodie.yfi
Path              : C:\Users\Admin\AppData\Local\Temp\tmpEXO_ws2oodie.yfi\tmpEXO_ws2oodie.yfi.psm1
Description       : This is a Powershell module generated by using the AutoGEN infra.
ModuleType        : Script
Version           : 1.0
NestedModules     : {}
ExportedFunctions : {Add-AvailabilityAddressSpace, Add-DistributionGroupMember, Add-MailboxFolderPermission, Add-MailboxLocation...}
ExportedCmdlets   :
ExportedVariables : HelpFileNames
ExportedAliases   :

As seen in the above output, the module “tmpEXO_ws2oodie.yfi” (almost 30 MB!) has been downloaded to the temp folder and contains all the standard ExchangeOnline CmdLets (except Connect-ExchangeOnline).

You will download a new temp module every time you connect to Exchange Online.

When you disconnect from ExchangeOnline, the temp module is deleted again. But if you don’t explicitly disconnect, then your temp folder will build up with these 30 MB modules.

Why not include everything in the ExchangeOnlineManagement module? It’s not very good for performance to download a 27.8 MB module every time you start an Exchange Online PowerShell session!

The reason behind this crazy design is most likely that Microsoft is still planning breaking changes for the Exchange Online REST API. The only way for the EXO V3 module to handle this is to download a new module package on every session in case some CmdLets need to be updated.

We’re not impressed…

EXO V3 is a Huge Disappointment

The conclusion from the above findings is that the EXO V3 is a terrible workaround to make a premature release of an API wrapper (EXO V3) built on an API (Exchange Online REST API) that is still not production ready.

The EXO V3 commands have the same syntax as the EXO V2 CmdLets, so there’s not much reason to hold back if you’re dying to get rid of basic WinRM authentication.

But for application developers, EXO V3 and the Exchange Online REST API are a huge disappointment.