As an Exchange Online or Office 365 Administrator, you might do a lot of work within PowerShell. This document is a cheat sheet of Exchange Online PowerShell Commands that might come in useful. This document will be updated often.
Connect to Exchange Online Powershell
The first thing you need to do is to connect to Exchange Online PowerShell. You have two options here:
- Go to https://outlook.office365.com/ecp/
- Navigate to Hybrid
- Click Configure under Exchange Online PowerShell Module
You might need to do this from Internet Explorer if you receive an error - Open Exchange Online PowerShell Module
RunConnect-EXOPSSession -UserPrincipalName [email protected]to connect
You can also follow the instructions for Office 365: Connect to Exchange Online Powershell if you don’t want to install the module.
Move Requests
If you need to force a database move in Exchange Online, you can use this command. This will also force a re-index of the mailbox.
NewMoveRequest [email protected]
To view the status of the move, you can run this:
Get-MoveRequestStatistics -Identity "username"
Once your Move Request is complete, it is a good idea to remove the request to keep things tidy:
Remove-MoveRequest DisplayName
Empty Recoverable Items aka Dumpster or Recycle Bin
If you need to completely empty a user’s mailbox dumpster (the recoverable items), you can run this command:
Search-Mailbox username -SearchQuery size>0 -SearchDumpsterOnly -DeleteContent
You can also use this method:
Get-Mailbox "username" | Search-Mailbox –SearchQuery "Subject:'*'" –DeleteContent -SearchDumpsterOnly
Note #1: You need to be a member of either the Mailbox Import Export role or the Mailbox Search role to use this command.
Note #2: This command will only delete 10,000 emails at a time, so it may need to be run multiple times.
Empty Recoverable Items Purges Folder
If you run this command, you can see the sizes of all the Recoverable Items folder and subfolders:
Get-MailboxFolderStatistics "username" -FolderScope RecoverableItems | Format-List Name,FolderAndSubfolderSize
If you run into an issue where the Purges folder is large, you have to:
Disable Single Item Recovery:
Set-Mailbox -Identity 'username' -SingleItemRecoveryEnabled $false
and set RetainDeletedItemsFor to 0:
Set-Mailbox -Identity 'username' -RetainDeletedItemsFor 0
You can also manually run the Retention Policy on a single mailbox:
Start-ManagedFolderAssistant -Identity "[email protected]"
Mass Delete Emails
If you get hit by a large spam or phishing campaign, you might need to mass delete emails at some point. The best way to do this is still with the Search-Mailbox function even though it says it is being depreciated.
Note #1: You need to be a member of either the Mailbox Import Export role or the Mailbox Search role to use these commands.
Note #2: You can mix these queries to search for specific subjects or senders. Just be careful!
To delete emails from a specific mailbox and a specific subject:
Search-Mailbox -Identity "username" -SearchQuery "Subject:subject_line" -DeleteContent
To delete all emails from all mailboxes that match a specific subject:
Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery subject:"subject" -DeleteContent
To delete all emails from all mailboxes that match a specific subject and sender:
Get-Mailbox | Search-Mailbox -SearchQuery subject:"'Spam_Subject'",from:"[email protected]" -DeleteContent
Deleting Emails From Compliance Search
If you do a search in the Security and Compliance Center, you can delete emails from that search.
If you use the Exchange Online PowerShell, you’ll need to connect using Connect-IPPSSession -UserPrincipalName username.
Note #1: Using PowerShell to delete the results of a Compliance Search will only delete 100 emails at a time.
In PowerShell, run this command using the name you gave your Compliance Search:
New-ComplianceSearchAction -SearchName "RuleName" -Purge -PurgeType SoftDelete
You can view the status by using:
Get-ComplianceSearchAction
Then you can view more details of the individual job by using:
Get-ComplianceSearchAction -Identity "RuleName_Purge" | Format-List
Junk Mail Configuration
To view the status of a users Junk Mail options, use:
Get-MailboxJunkEmailConfiguration "FirstName LastName"
You can set the parameters using a command like this:
Set-MailboxJunkEmailConfiguration "FirstName LastName" -Enabled $true
If you need to clear out someone’s safe/blocked senders, you can use this:
Set-MailboxJunkEmailConfiguration “FirstName LastName” -TrustedSendersAndDomains $null
Convert a Regular Mailbox to a Shared Mailbox
Get-Mailbox -Identity [email protected] | Set-Mailbox -Type "Shared"
Disable the Clutter Folder
To disable the clutter folder for one user:
Set-Clutter -Identity [email protected] -Enable $false
To disable the clutter folder for all users
Get-Mailbox | Set-Clutter -Enable $false
Splitting up Commands for Large Tenants
Unfortunately, Microsoft doesn’t have a good way to set timeout limits on Remote PowerShell sessions, so there might be a time when you need to run a script against all of your mailboxes and it fails because the session times out. You can use the -Skip and -First flags to get around this. For example:
Get-Mailbox -ResultSize Unlimited | Select -First 1000 | Get-MailboxStatistics ...
Get-Mailbox -ResultSize Unlimited | Select -Skip 1000 -First 1000 | Get-MailboxStatistics ...
Get-Mailbox -ResultSize Unlimited | Select -Skip 2000 -First 1000 | Get-MailboxStatistics ...
Add User to Delivery Restrictions for a Distribution Group
If you need to add a new user to existing Delivery Restrictions for a Distribution Group, you have to call the existing list, then add the new user to the end of the list. You can do so with this PowerShell command:
Set-DistributionGroup "GROUP-NAME-HERE" -AcceptMessagesOnlyFromSendersOrMembers((Get-DistributionGroup "GROUP-NAME-HERE").AcceptMessagesOnlyFromSendersOrMembers + "IDENTITY-OF-USER-OR-GROUP-HERE")
Block an IP Address
Set-OrganizationConfig -IPListBlocked @{add="114.230.24.98"}
Final Thoughts
Do you have Exchange Online commands that you find helpful? Feel free to leave them in the comments below.
