Since version 3.7.0 of the ExchangeOnlineManagement module, Connect-ExchangeOnline stops in Windows PowerShell ISE with the error below. No sign-in window appears. The same command works in a normal PowerShell window. This guide explains why, and how to fix it.
PS C:\> Connect-ExchangeOnline -UserPrincipalName [email protected]
A window handle must be configured. See https://aka.ms/msal-net-wam#parent-window-handlesShort answer. Install PowerShell 7 and connect from PowerShell 7 instead of ISE. Open ISE or PowerShell as administrator and run: winget install --id Microsoft.PowerShell --source winget. If PowerShell 7 is already on your computer, just start PowerShell 7. If you have to stay in ISE, use Connect-ExchangeOnline -DisableWAM (module 3.7.2 or later).
Why the error happens
From version 3.7.0 the module signs you in through WAM (Web Account Manager), the sign-in broker built into Windows. Microsoft turned this on by default. The WAM sign-in window must be attached to a parent window, so it does not disappear behind other windows. To find one, the module looks up the PowerShell console window.
ISE is not a console but a Windows program of its own. There is no console window to find, so the sign-in library (MSAL) refuses with A window handle must be configured. You get the same error from Connect-IPPSSession for Microsoft Purview, because it is part of the same module.
| Where you connect | Module 3.7.0 or later |
|---|---|
| Where you connectWindows PowerShell ISE (5.1) | Module 3.7.0 or laterError: A window handle must be configured |
Where you connectPowerShell 7 (pwsh) in its own window or Windows Terminal |
Module 3.7.0 or laterWorks: the sign-in window appears |
Where you connectISE with -DisableWAM (module 3.7.2 or later) |
Module 3.7.0 or laterWorks: sign-in without WAM |
| Where you connectScript without a user (Task Scheduler, Azure Automation) | Module 3.7.0 or laterNo interactive sign-in: use a certificate or managed identity |
Check where you are
These three lines tell you which program you are in, which PowerShell version runs and which versions of the module are installed:
$Host.Name
$PSVersionTable.PSVersion
Get-Module ExchangeOnlineManagement -ListAvailable | Select-Object Name, Version, ModuleBaseIf you see Windows PowerShell ISE Host, version 5.1 and a module of 3.7.0 or later, this is your error.
Fix 1: PowerShell 7 (recommended)
This is the fix we use ourselves. Open Windows PowerShell ISE or Windows PowerShell with Run as administrator and install PowerShell 7 with winget:
winget install --id Microsoft.PowerShell --source wingetIf PowerShell 7 is already on your computer, skip this step. Then start PowerShell 7 from the Start menu, or type pwsh in Windows Terminal. Do not type pwsh in the ISE console: that console cannot host another interactive program.
PowerShell 7 has its own module folder. A module you installed in Windows PowerShell 5.1 is not always visible to PowerShell 7. So install the module in the new window and connect:
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline -UserPrincipalName [email protected]The sign-in window appears, including MFA. Want an editor like ISE, with the script on top and the console below? Use Visual Studio Code with the PowerShell extension. See Visual Studio Code for PowerShell and PowerShell 7 in ISE: why it cannot.
Fix 2: stay in ISE with -DisableWAM
From version 3.7.2, Connect-ExchangeOnline has the -DisableWAM switch. It turns WAM off, so you sign in the way you did before version 3.7.0. Update the module first if you run an older version:
Update-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName [email protected] -DisableWAMThe same works for Microsoft Purview: Connect-IPPSSession -UserPrincipalName [email protected] -DisableWAM. Treat this as a stopgap. Microsoft no longer develops ISE, and new module features come to PowerShell 7 first, or only. If the old version stays behind after an update, see Cleaning up PowerShell modules.
Fix 3: no browser or no window
On a server without a browser you can sign in with a device code in PowerShell 7. You get a code that you enter on another device. This switch only works in PowerShell 7:
Connect-ExchangeOnline -DeviceIf the script runs without a user, for example in Task Scheduler or Azure Automation, there should be no sign-in window at all. Use app-only with a certificate, or a managed identity. How to set that up is in Connecting to Exchange Online: authentication.
Which fix fits you?
| Situation | Fix |
|---|---|
| SituationYou work with Exchange Online PowerShell every day | FixPowerShell 7, with VS Code as the editor |
| SituationYou need a connection from ISE right now | Fix-DisableWAM (module 3.7.2 or later) |
| SituationServer or session without a browser | Fix-Device in PowerShell 7 |
| SituationScheduled or unattended scripts | FixCertificate (app-only) or managed identity |
Installing an older module, such as version 3.6.0, also makes the error go away. We advise against it: you miss every fix and new cmdlet released since, and the error returns with the next update.
See also
- Install Exchange Online PowerShell (ISE and PowerShell 7)
- Connect-ExchangeOnline: fix Error Acquiring Token (NullReferenceException, 0x80070520)
- Install PowerShell 7
- ExchangeOnlineManagement release notes: which version changed what
Sources: Connect-ExchangeOnline on Microsoft Learn (the -DisableWAM and -Device parameters) and MSAL.NET and WAM: parent window handles.
Frequent errors and how to fix them
These are the messages people type into search when the module will not start. The exact wording is here so this page can be found.
The term 'Connect-ExchangeOnline' is not recognized- Module not installed, or the wrong host. Install-Module ExchangeOnlineManagement, then open a new window.
A window handle must be configured / MsalClientException- MSAL/WAM handler bug: no window for sign-in. As administrator:
winget install --id Microsoft.PowerShell --source winget, thenpwsh. ISE still hosts 5.1; the Exchange module does run there. Staying in ISE:Connect-ExchangeOnline -DisableWAM. Headless scripts: certificate or managed identity. Full explanation. Error Acquiring Token: System.NullReferenceException / 0x80070520- WAM sign-in (module 3.7.0+) failed. NullReferenceException: another module in the same window (usually Microsoft Graph) loaded a different MSAL version; new window, Connect-ExchangeOnline first, or
-DisableWAM. 0x80070520 "A specified logon session does not exist": PowerShell runs as another account or in Task Scheduler; start as yourself, or use a certificate. Full explanation. WinRM cannot process the request / CreateExoPSSession- Legacy V1/V2 remoting. Use module V3+ and Connect-ExchangeOnline (no separate WinRM session).
AADSTS50076 / MFA required- Interactive: complete MFA. For scripts: certificate (app-only), not a user password.
Unauthorized / Access Denied- The account or app registration has no Exchange role (for example Exchange Administrator). App-only: Exchange.ManageAsApp plus that role.
Could not create SSL/TLS secure channel- [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 — or use PowerShell 7.
Fail to create a runspace / connecting to outlook.office365.com- Legacy remote PowerShell. Update to ExchangeOnlineManagement V3; REST is the default. Disconnect-ExchangeOnline -Confirm:$false between jobs.
The term 'Get-Mailbox' is not recognized- You are not connected, or the REST session expired. Connect-ExchangeOnline again; do not mix with a leftover MSOnline session.
Questions about this, or need help setting it up? We are happy to think along.
Message on LinkedIn →