The Exchange Online module supports several authentication methods. Unlike PnP PowerShell, ordinary interactive use does not require your own app registration; you only need one for unattended scripts.
Interactive
Connect-ExchangeOnline -UserPrincipalName [email protected]A sign-in window opens, including MFA. Omit the user name and you will simply be prompted for it.
Device code
On a machine without a browser — a server, or a remote session:
Connect-ExchangeOnline -DeviceApp-only with a certificate
For scheduled tasks. Here you do register your own app in Entra ID, grant it the Exchange permissions your script needs, and attach a certificate.
Connect-ExchangeOnline -AppId <client id> -CertificateThumbprint <thumbprint> -Organization contoso.onmicrosoft.comOr with a certificate file instead of the thumbprint:
Connect-ExchangeOnline -AppId <client id> -CertificateFilePath "C:certsexo.pfx" -CertificatePassword (Get-Credential).Password -Organization contoso.onmicrosoft.comManaged identity
If your script runs in Azure this is both the simplest and the safest option: no certificate to expire.
Connect-ExchangeOnline -ManagedIdentity -Organization contoso.onmicrosoft.comSecurity & Compliance
Retention policies, labels and eDiscovery are not part of the Exchange connection but of a separate session:
Connect-IPPSSession -UserPrincipalName [email protected]Always disconnect cleanly
Otherwise sessions stay open and you will run into connection limits:
Disconnect-ExchangeOnline -Confirm:$falseGetting A window handle must be configured? Connect-ExchangeOnline no longer works in ISE since module 3.7.0. Cause and fix: A window handle must be configured: fix Connect-ExchangeOnline in ISE.
Frequent errors and how to fix them
These are the messages people type into search when the module will not start. The exact wording is here so this page can be found.
The term 'Connect-ExchangeOnline' is not recognized- Module not installed, or the wrong host. Install-Module ExchangeOnlineManagement, then open a new window.
A window handle must be configured / MsalClientException- MSAL/WAM handler bug: no window for sign-in. As administrator:
winget install --id Microsoft.PowerShell --source winget, thenpwsh. ISE still hosts 5.1; the Exchange module does run there. Staying in ISE:Connect-ExchangeOnline -DisableWAM. Headless scripts: certificate or managed identity. Full explanation. Error Acquiring Token: System.NullReferenceException / 0x80070520- WAM sign-in (module 3.7.0+) failed. NullReferenceException: another module in the same window (usually Microsoft Graph) loaded a different MSAL version; new window, Connect-ExchangeOnline first, or
-DisableWAM. 0x80070520 "A specified logon session does not exist": PowerShell runs as another account or in Task Scheduler; start as yourself, or use a certificate. Full explanation. WinRM cannot process the request / CreateExoPSSession- Legacy V1/V2 remoting. Use module V3+ and Connect-ExchangeOnline (no separate WinRM session).
AADSTS50076 / MFA required- Interactive: complete MFA. For scripts: certificate (app-only), not a user password.
Unauthorized / Access Denied- The account or app registration has no Exchange role (for example Exchange Administrator). App-only: Exchange.ManageAsApp plus that role.
Could not create SSL/TLS secure channel- [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 — or use PowerShell 7.
Fail to create a runspace / connecting to outlook.office365.com- Legacy remote PowerShell. Update to ExchangeOnlineManagement V3; REST is the default. Disconnect-ExchangeOnline -Confirm:$false between jobs.
The term 'Get-Mailbox' is not recognized- You are not connected, or the REST session expired. Connect-ExchangeOnline again; do not mix with a leftover MSOnline session.
Questions about this, or need help setting it up? We are happy to think along.
Message on LinkedIn →