Quickstart
Open PowerShell and run these two commands, using your own admin address. The -Scope CurrentUser switch means you don't need to run PowerShell as an administrator.
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com
PowerShell may ask to install the NuGet provider and to confirm the PSGallery repository, which is where the module comes from. Answer Yes to both.
Sign in when prompted. Multi-factor authentication works as usual, so leave it on. To confirm the connection, run:
Get-AcceptedDomain
If that lists your domains, you're connected. If you hit an error, the install errors and the connection errors have the fixes.
To install for every user on the machine instead, open PowerShell as an administrator and drop the -Scope switch.
Update to 3.10.1 before March 2027
Check which version you have:
Get-Module ExchangeOnlineManagement -ListAvailable
In Message Center post MC1483974, published September 30, 2026, Microsoft tells admins to move to version 3.10.1 or later by March 26, 2027. Strict logon enforcement starts on March 31, and older versions may then fail at some interactive sign-ins. Microsoft names PowerShell 7 with Web Account Manager (WAM) disabled as a case to watch, and lists version 3.10.1 and later, certificate authentication, WAM authentication and Windows PowerShell 5.x as unaffected.
Message Center is only visible to admins, so this summary comes from a public copy of the post. Check it in your own Microsoft 365 admin center before you plan around the dates.
Update with the same scope you installed with:
Update-Module -Name ExchangeOnlineManagement -Scope CurrentUser
If you aren't sure which scope that was, this shows where the module lives:
Get-InstalledModule ExchangeOnlineManagement | Format-List Name,Version,InstalledLocation
A path under Program Files means all users, and you'll need an administrator window and no -Scope switch. A path in your user folder means current user.
Windows PowerShell 5.1 or PowerShell 7?
On Windows, start with Windows PowerShell 5.1. It's already installed, and Microsoft supports every version of the module in it. Module 3.10.0 and later need PowerShell 7.6.0 or later, so an older PowerShell 7 is the one setup likely to get in your way.
| Windows PowerShell 5.1 | PowerShell 7 | |
|---|---|---|
| Runs on | Windows | Windows, macOS, Linux |
| Current module needs | .NET Framework 4.7.2, included in Windows 11, Windows 10 1803 and later, and Server 2019 and later | PowerShell 7.6.0 or later |
| Modules 3.5.0 to 3.9.2 need | The same | PowerShell 7.4.0 or later |
| Sign-in opens | A sign-in window | Your default browser |
| Sign-in with a code on another device | Not available | -Device |
Windows 10 consumer editions don't support the .NET versions behind PowerShell 7.4 and later, so module 3.5.0 and later only run in PowerShell 7 on the Enterprise and IoT LTSC releases of Windows 10. Everyone else on Windows 10 should stay on 5.1.
A current-user install is separate for each version of PowerShell. If you installed in 5.1 and then open PowerShell 7, run the install again there.
Installing on Mac or Linux
Install PowerShell 7.6.0 or later, start it with pwsh, and run the same two commands from the quickstart.
The current module runs on macOS 14 Sonoma or later, and on Ubuntu 24.04 and 22.04. On macOS 13 and earlier, or Ubuntu 20.04 and 18.04, the last supported version is 3.9.2. That's below 3.10.1, so plan to move those machines before March 2027.
Connect-IPPSSession, which connects to Security & Compliance PowerShell, isn't available on macOS or Linux. Run that work from Windows.
On a machine with no browser, use Connect-ExchangeOnline -Device, then open https://microsoft.com/devicelogin on another device and enter the code it shows.
Why can't I install the module?
Multi-factor authentication has nothing to do with installing, so don't turn it off. The install only talks to the PowerShell Gallery, and these are the failures Microsoft documents.
"Files cannot be loaded because running scripts is disabled on this system." Your execution policy blocks scripts. Open PowerShell as an administrator and run:
Set-ExecutionPolicy RemoteSigned
"No match was found for the specified search criteria and module name." PowerShell doesn't know about the PowerShell Gallery. Register it, then try the install again:
Register-PSRepository -Default
"Unable to download from URI", "Unable to download the list of available providers", or a "PowerShellGetFormatVersion" error. PowerShellGet is out of date. Update it, close the window and open a new one:
Install-Module PowerShellGet -Force
If those errors continue in 5.1 on older Windows, the cause may be TLS, because the PowerShell Gallery requires TLS 1.2. Turn it on for the session, then retry:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
"The term 'Update-ModuleManifest' is not recognized" or "Cannot find a cmdlet Update-Manifest". PowerShellGet is missing, and Install-Module PowerShellGet -Force fixes it. If it still fails, a preview version of PackageManagement or PowerShellGet may be the cause, and this lists what you have:
Get-InstalledModule PackageManagement -AllVersions
Get-InstalledModule PowerShellGet -AllVersions
Why won't Connect-ExchangeOnline work?
"Connect-ExchangeOnline is not recognized." PowerShell can't find the module in this shell. Check for it:
Get-Module ExchangeOnlineManagement -ListAvailable
If that returns nothing, install the module in this shell. If it lists the module, load it by hand:
Import-Module ExchangeOnlineManagement
"Could not load file or assembly 'System.IdentityModel.Tokens.Jwt'". Another imported module conflicts with this one. Open a new window and connect before you import anything else.
Sign-in errors that mention WAM. On version 3.7.2 or later, add -DisableWAM to the connect command. Update to 3.10.1 first, because WAM turned off on an older version is the case Microsoft warns about in the March 2027 notice.
The password is right but the connection still fails. Your account may be blocked from Exchange Online PowerShell. Accounts federated through an identity provider that isn't reachable from the public internet can't connect either, and TCP port 80 must be open between your computer and Microsoft 365.
The connection fails on one Windows account only. Check the profile path for characters PowerShell treats as special, such as $. Microsoft's advice is to use a different account.
A cmdlet is missing after you connect. Your Exchange roles decide which cmdlets appear, so ask an admin to check your role assignments.
Get-Help shows nothing useful. From version 3.7.0, cmdlet help isn't loaded by default. Connect with -LoadCmdletHelp.
Connecting without a person at the keyboard
Scheduled scripts can't answer a sign-in prompt. Use certificate-based app-only authentication, or a managed identity when the script runs in Azure:
Connect-ExchangeOnline -ManagedIdentity -Organization "contoso.onmicrosoft.com"
For government and regional clouds, add -ExchangeEnvironmentName with O365USGovGCCHigh, O365USGovDoD, O365GermanyCloud or O365China. Connecting after basic authentication was deprecated covers why these older sign-ins moved.
Commands to try first
| Command | What it does |
|---|---|
| Get-Mailbox | Shows mailbox settings. |
| Get-EXOMailbox | Does the same with fewer parameters, built for speed on bulk queries. |
| Get-MailboxStatistics | Shows item counts and mailbox size. |
| Set-Mailbox | Changes an existing mailbox. |
| New-Mailbox | Creates a mailbox. |
If you manage meeting rooms, Set-Place writes room details such as capacity and floor. Microsoft Graph cmdlets need their own connection, which Connect-MgGraph opens.
Disconnecting
Run this when you finish. If you close the window without it, you can use up your available sessions and have to wait for them to expire.
Disconnect-ExchangeOnline -Confirm:$false
Get-ConnectionInformation shows any connections still open.
