PowerShell Microsoft 365

Cmdlets of the current modules (Exchange Online, Microsoft Graph PowerShell, Teams, SharePoint Online). MSOnline and AzureAD are deprecated: use Microsoft Graph PowerShell.

Getting started

Connecting

Install the modules first (once) with Install-Module -Scope CurrentUser, then connect at each session.

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

Exchange Online (ExchangeOnlineManagement module). Add -ShowBanner:$false for shorter output. Disconnect: Disconnect-ExchangeOnline -Confirm:$false.

Connect-MgGraph -Scopes 'User.Read.All','Group.ReadWrite.All','Directory.Read.All'

Microsoft Graph PowerShell: request only the scopes you need (least privilege). Check with Get-MgContext. Common scopes: User.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All, Policy.Read.All, DeviceManagementManagedDevices.Read.All, AuditLog.Read.All.

Connect-MicrosoftTeams

Teams (MicrosoftTeams module). Teams Administrator role or higher.

Connect-SPOService -Url https://contoso-admin.sharepoint.com

SharePoint Online (Microsoft.Online.SharePoint.PowerShell module), admin center URL. Alternative: PnP.PowerShell.

Connect-IPPSSession -UserPrincipalName admin@contoso.com

Security & Compliance (Defender, Purview): same module as Exchange Online.

Filter by category

MSOnline and AzureAD (Msol* and *-AzureAD* cmdlets) are deprecated and no longer receive fixes: migrate to Microsoft Graph PowerShell (Mg*). Test with -WhatIf first when it exists.

Full list

Show all 51 entries

`Get-Mailbox`

Get-Mailbox [-Identity <id>] [-ResultSize Unlimited]

Lists mailboxes or shows a mailbox's properties.

Get-Mailbox -Identity user@contoso.com | Format-List DisplayName,PrimarySmtpAddress,ArchiveStatus,LitigationHoldEnabled
Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails SharedMailbox

`Set-Mailbox`

Set-Mailbox -Identity <id> [properties]

Changes a mailbox (quota, address, forwarding, archive, retention).

Set-Mailbox -Identity user@contoso.com -ForwardingSmtpAddress ext@example.com -DeliverToMailboxAndForward $true
Set-Mailbox -Identity user@contoso.com -LitigationHoldEnabled $true

`Set-MailboxAutoReplyConfiguration`

Set-MailboxAutoReplyConfiguration -Identity <id> -AutoReplyState Enabled|Disabled|Scheduled

Enables, schedules or turns off a mailbox's out-of-office automatic reply (internal and external message).

Set-MailboxAutoReplyConfiguration -Identity user@contoso.com -AutoReplyState Enabled -InternalMessage 'Absent jusqu''au 5 janvier.' -ExternalMessage 'Absent jusqu''au 5 janvier.'
Set-MailboxAutoReplyConfiguration -Identity user@contoso.com -AutoReplyState Scheduled -StartTime '2026-12-22 18:00' -EndTime '2027-01-05 08:00' -InternalMessage 'Congés'
Set-MailboxAutoReplyConfiguration -Identity user@contoso.com -AutoReplyState Disabled

New-Mailbox
New-Mailbox -Shared -Name <name> -DisplayName <name>
Creates a shared mailbox (or room/equipment with -Room, -Equipment).
```
New-Mailbox -Shared -Name 'Support' -DisplayName 'Support' -PrimarySmtpAddress support@contoso.com
```
Add-MailboxPermission
Add-MailboxPermission -Identity <mailbox> -User <user> -AccessRights FullAccess
Gives full access to a mailbox (read/write delegation).
```
Add-MailboxPermission -Identity shared@contoso.com -User user@contoso.com -AccessRights FullAccess -AutoMapping $true
```
Add-RecipientPermission
Add-RecipientPermission -Identity <mailbox> -Trustee <user> -AccessRights SendAs
Allows 'Send as' on a mailbox or group.
```
Add-RecipientPermission -Identity shared@contoso.com -Trustee user@contoso.com -AccessRights SendAs -Confirm:$false
```
Get-MailboxStatistics
Get-MailboxStatistics -Identity <id>
A mailbox's size, item count and last logon.
```
Get-MailboxStatistics user@contoso.com | Select DisplayName,TotalItemSize,ItemCount,LastLogonTime
```
Get-MessageTraceV2
Get-MessageTraceV2 -SenderAddress <sender> -StartDate <date> -EndDate <date>
Traces a message (delivered, delayed, rejected) over the last 10 days. Replaces Get-MessageTrace.
```
Get-MessageTraceV2 -RecipientAddress user@contoso.com -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date)
```

`Start-HistoricalSearch`

Start-HistoricalSearch -ReportTitle <title> -ReportType MessageTrace ...

Starts a message trace search beyond 10 days (up to 90 days), delivered by email.

Start-HistoricalSearch -ReportTitle 'Trace' -ReportType MessageTrace -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -SenderAddress a@example.com -NotifyAddress admin@contoso.com

New-TransportRule
New-TransportRule -Name <name> -Conditions... -Actions...
Creates a mail flow rule (disclaimer, block, redirect).
```
New-TransportRule -Name 'Étiquette externe' -FromScope NotInOrganization -PrependSubject '[EXTERNE] '
```

`Get-DistributionGroupMember`

Get-DistributionGroupMember -Identity <group>

Lists the members of a distribution list.

Get-DistributionGroupMember -Identity team@contoso.com -ResultSize Unlimited | Select DisplayName,PrimarySmtpAddress

Add-DistributionGroupMember
Add-DistributionGroupMember -Identity <group> -Member <user>
Adds a member to a distribution list.
```
Add-DistributionGroupMember -Identity team@contoso.com -Member user@contoso.com
```
Set-CalendarProcessing
Set-CalendarProcessing -Identity <room> -AutomateProcessing AutoAccept
Sets automatic meeting acceptance for a room or equipment.
```
Set-CalendarProcessing -Identity salle1@contoso.com -AutomateProcessing AutoAccept -AllowConflicts $false
```
Add-MailboxFolderPermission
Add-MailboxFolderPermission -Identity <mailbox>:\Calendar -User <user> -AccessRights Reviewer
Shares a folder (calendar, inbox) with a user.
```
Add-MailboxFolderPermission -Identity user@contoso.com:\Calendar -User collegue@contoso.com -AccessRights Editor
```
Get-EXOMailbox
Get-EXOMailbox -Identity <id> -Properties <list>
Fast, lightweight version of Get-Mailbox for large volumes.
```
Get-EXOMailbox -ResultSize Unlimited -Properties ProhibitSendQuota | Select DisplayName,ProhibitSendQuota
```
Enable-Mailbox (archive)
Enable-Mailbox -Identity <id> -Archive
Enables a mailbox's online archive.
```
Enable-Mailbox -Identity user@contoso.com -Archive
```
Connect-MgGraph
Connect-MgGraph -Scopes <scopes> [-TenantId <id>] [-NoWelcome]
Opens a Microsoft Graph PowerShell session with the requested scopes.
```
Connect-MgGraph -Scopes 'User.ReadWrite.All' -NoWelcome
Get-MgContext | Select Account,TenantId,Scopes
```

`Get-MgUser`

Get-MgUser [-UserId <id>] [-Filter <odata>] [-Property <list>] [-All]

Reads a user or lists Entra ID accounts. Replaces Get-MsolUser / Get-AzureADUser.

Get-MgUser -UserId user@contoso.com -Property DisplayName,AccountEnabled,SignInActivity
Get-MgUser -All -Filter "accountEnabled eq false" | Select DisplayName,UserPrincipalName

`New-MgUser`

New-MgUser -DisplayName <name> -UserPrincipalName <upn> -MailNickname <alias> -AccountEnabled -PasswordProfile <hash>

Creates an Entra ID user.

New-MgUser -DisplayName 'Jean Dupont' -UserPrincipalName jean@contoso.com -MailNickname jean -AccountEnabled -PasswordProfile @{ Password = '<mot de passe>'; ForceChangePasswordNextSignIn = $true }

Update-MgUser
Update-MgUser -UserId <id> [-property value]
Changes a user (department, title, enablement, usage location).
```
Update-MgUser -UserId user@contoso.com -AccountEnabled:$false
Update-MgUser -UserId user@contoso.com -UsageLocation FR
```
Revoke-MgUserSignInSession
Revoke-MgUserSignInSession -UserId <id>
Revokes a user's refresh tokens and sessions (compromised account).
```
Revoke-MgUserSignInSession -UserId user@contoso.com
```

`Set-MgUserLicense`

Set-MgUserLicense -UserId <id> -AddLicenses @{SkuId=...} -RemoveLicenses @()

Assigns or removes Microsoft 365 licences.

Get-MgSubscribedSku | Select SkuPartNumber,SkuId,ConsumedUnits
Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{SkuId='<SkuId>'} -RemoveLicenses @()

Get-MgGroup
Get-MgGroup [-GroupId <id>] [-Filter <odata>] [-All]
Lists Entra ID groups (Microsoft 365, security).
```
Get-MgGroup -All -Filter "startsWith(displayName,'Ventes')"
```
New-MgGroupMember
New-MgGroupMember -GroupId <id> -DirectoryObjectId <id>
Adds a member to an Entra ID group.
```
New-MgGroupMember -GroupId $groupId -DirectoryObjectId (Get-MgUser -UserId user@contoso.com).Id
```
Get-MgUserAuthenticationMethod
Get-MgUserAuthenticationMethod -UserId <id>
Lists a user's authentication methods (MFA).
```
Get-MgUserAuthenticationMethod -UserId user@contoso.com | Select Id,AdditionalProperties
```

`Get-MgAuditLogSignIn`

Get-MgAuditLogSignIn -Filter <odata> -Top <n>

Entra ID sign-in log (failures, location, conditional access).

Get-MgAuditLogSignIn -Filter "userPrincipalName eq 'user@contoso.com'" -Top 20 | Select CreatedDateTime,AppDisplayName,IPAddress,Status

Get-MgDirectoryRole
Get-MgDirectoryRole / Get-MgDirectoryRoleMember
Lists the activated administrator roles and their members.
```
$r = Get-MgDirectoryRole -Filter "displayName eq 'Global Administrator'"; Get-MgDirectoryRoleMember -DirectoryRoleId $r.Id
```

`Get-MgSubscribedSku`

Get-MgSubscribedSku

The tenant's purchased, consumed and available licences.

Get-MgSubscribedSku | Select SkuPartNumber,ConsumedUnits,@{n='Total';e={$_.PrepaidUnits.Enabled}}

Get-MgIdentityConditionalAccessPolicy
Get-MgIdentityConditionalAccessPolicy
Lists conditional access policies.
```
Get-MgIdentityConditionalAccessPolicy | Select DisplayName,State
```

`Get-Team`

Get-Team [-DisplayName <name>] [-User <upn>]

Lists Teams teams.

Get-Team -DisplayName 'Projet' | Select GroupId,DisplayName,Visibility,Archived

New-Team
New-Team -DisplayName <name> -Visibility Private
Creates a team (and its Microsoft 365 group).
```
New-Team -DisplayName 'Projet Alpha' -Visibility Private -Owner admin@contoso.com
```
Add-TeamUser
Add-TeamUser -GroupId <id> -User <upn> -Role Member
Adds a member or owner to a team.
```
Add-TeamUser -GroupId $groupId -User user@contoso.com -Role Member
```

`Get-CsOnlineUser`

Get-CsOnlineUser -Identity <upn>

Shows a user's Teams configuration (telephony, policies).

Get-CsOnlineUser -Identity user@contoso.com | Select DisplayName,TeamsMeetingPolicy,LineUri,InterpretedUserType

Grant-CsTeamsMeetingPolicy
Grant-CsTeamsMeetingPolicy -Identity <upn> -PolicyName <policy>
Assigns a Teams meeting policy to a user.
```
Grant-CsTeamsMeetingPolicy -Identity user@contoso.com -PolicyName 'RestrictedAnonymous'
```
Get-SPOSite
Get-SPOSite [-Identity <url>] [-Limit All]
Lists SharePoint site collections.
```
Get-SPOSite -Limit All | Select Url,StorageUsageCurrent,SharingCapability
```

`Set-SPOSite`

Set-SPOSite -Identity <url> [-SharingCapability ...] [-StorageQuota ...]

Changes a site (external sharing, quota, lock).

Set-SPOSite -Identity https://contoso.sharepoint.com/sites/rh -SharingCapability Disabled
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/rh -LockState ReadOnly

Get-SPOTenant
Get-SPOTenant
Global SharePoint and OneDrive tenant settings (sharing, sync).
```
Get-SPOTenant | Select SharingCapability,DefaultSharingLinkType,OneDriveStorageQuota
```

`Get-SPOUser / Add-SPOUser`

Get-SPOUser -Site <url> / Add-SPOUser -Site <url> -LoginName <upn> -Group <group>

Views or adds users in a site.

Get-SPOUser -Site https://contoso.sharepoint.com/sites/rh -Limit All
Add-SPOUser -Site https://contoso.sharepoint.com/sites/rh -LoginName user@contoso.com -Group 'RH Members'

`Restore-SPODeletedSite`

Restore-SPODeletedSite -Identity <url>

Restores a deleted site (tenant recycle bin, 93 days).

Get-SPODeletedSite | Select Url,DeletionTime
Restore-SPODeletedSite -Identity https://contoso.sharepoint.com/sites/rh

Get-MgDeviceManagementManagedDevice
Get-MgDeviceManagementManagedDevice [-Filter <odata>] [-All]
Lists devices managed by Intune (compliance, OS, last contact).
```
Get-MgDeviceManagementManagedDevice -All -Filter "operatingSystem eq 'Windows'" | Select DeviceName,UserPrincipalName,ComplianceState,LastSyncDateTime
```
Sync-MgDeviceManagementManagedDevice
Sync-MgDeviceManagementManagedDevice -ManagedDeviceId <id>
Requests an immediate sync of an Intune device.
```
Sync-MgDeviceManagementManagedDevice -ManagedDeviceId $id
```
Invoke-MgRetireDeviceManagementManagedDevice
Invoke-MgRetireDeviceManagementManagedDevice -ManagedDeviceId <id>
Retires a device from management (removes company data, keeps personal data).
```
Invoke-MgRetireDeviceManagementManagedDevice -ManagedDeviceId $id
```

`Get-QuarantineMessage`

Get-QuarantineMessage -StartReceivedDate <date> -EndReceivedDate <date>

Lists messages in Defender for Office 365 quarantine.

Get-QuarantineMessage -RecipientAddress user@contoso.com -StartReceivedDate (Get-Date).AddDays(-7) -EndReceivedDate (Get-Date) | Select ReceivedTime,SenderAddress,Subject,Type

Get-MalwareFilterPolicy
Get-MalwareFilterPolicy / Set-MalwareFilterPolicy
Views or sets the anti-malware policy.
```
Get-MalwareFilterPolicy | Select Name,EnableFileFilter,FileTypes
```

`Get-SafeLinksPolicy`

Get-SafeLinksPolicy

Defender for Office 365 Safe Links policies.

Get-SafeLinksPolicy | Select Name,EnableSafeLinksForEmail,ScanUrls,DoNotRewriteUrls

Search-UnifiedAuditLog
Search-UnifiedAuditLog -StartDate <date> -EndDate <date> -UserIds <upn> -Operations <list>
Queries the unified audit log (sign-ins, file access, mailbox rules).
```
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -UserIds user@contoso.com -Operations New-InboxRule,Set-InboxRule -ResultSize 500
```
New-ComplianceSearch
New-ComplianceSearch -Name <name> -ExchangeLocation All -ContentMatchQuery <KQL>
Creates a Purview eDiscovery content search (then Start-ComplianceSearch).
```
New-ComplianceSearch -Name 'Facture-X' -ExchangeLocation All -ContentMatchQuery 'subject:"Facture X"'
Start-ComplianceSearch -Identity 'Facture-X'
```
Get-DlpCompliancePolicy
Get-DlpCompliancePolicy
Lists data loss prevention (DLP) policies.
```
Get-DlpCompliancePolicy | Select Name,Mode,Enabled
```

`Connect-MsolService`

Connect-MsolService

Sign-in for the MSOnline module, deprecated. Replace with Connect-MgGraph.

# Ancien : Connect-MsolService ; Get-MsolUser -UserPrincipalName user@contoso.com
# Nouveau : Connect-MgGraph -Scopes 'User.Read.All' ; Get-MgUser -UserId user@contoso.com

Connect-AzureAD
Connect-AzureAD
Sign-in for the AzureAD module, deprecated. Replace with Connect-MgGraph.
```
# Ancien : Get-AzureADGroupMember -ObjectId $id
# Nouveau : Get-MgGroupMember -GroupId $id
```
Set-MsolUserPassword
Set-MsolUserPassword -UserPrincipalName <upn> -NewPassword <password>
Resets a password (MSOnline, deprecated). Graph equivalent: Update-MgUser with -PasswordProfile.
```
Update-MgUser -UserId user@contoso.com -PasswordProfile @{ Password = '<mot de passe>'; ForceChangePasswordNextSignIn = $true }
```

Getting started

Connecting

Results

Full list

Get-Mailbox

Set-Mailbox

Set-MailboxAutoReplyConfiguration

New-Mailbox

Add-MailboxPermission

Add-RecipientPermission

Get-MailboxStatistics

Get-MessageTraceV2

Start-HistoricalSearch

New-TransportRule

Get-DistributionGroupMember

Add-DistributionGroupMember

Set-CalendarProcessing

Add-MailboxFolderPermission

Get-EXOMailbox

Enable-Mailbox (archive)

Connect-MgGraph

Get-MgUser

New-MgUser

Update-MgUser

Revoke-MgUserSignInSession

Set-MgUserLicense

Get-MgGroup

New-MgGroupMember

Get-MgUserAuthenticationMethod

Get-MgAuditLogSignIn

Get-MgDirectoryRole

Get-MgSubscribedSku

Get-MgIdentityConditionalAccessPolicy

Get-Team

New-Team

Add-TeamUser

Get-CsOnlineUser

Grant-CsTeamsMeetingPolicy

Get-SPOSite

Set-SPOSite

Get-SPOTenant

Get-SPOUser / Add-SPOUser

Restore-SPODeletedSite

Get-MgDeviceManagementManagedDevice

Sync-MgDeviceManagementManagedDevice

Invoke-MgRetireDeviceManagementManagedDevice

Get-QuarantineMessage

Get-MalwareFilterPolicy

Get-SafeLinksPolicy

Search-UnifiedAuditLog

New-ComplianceSearch

Get-DlpCompliancePolicy

Connect-MsolService

Connect-AzureAD

Set-MsolUserPassword

Going further

Articles

Tools

More cheatsheets

Related projects

`Get-Mailbox`

`Set-Mailbox`

`Set-MailboxAutoReplyConfiguration`

`New-Mailbox`

`Add-MailboxPermission`

`Add-RecipientPermission`

`Get-MailboxStatistics`

`Get-MessageTraceV2`

`Start-HistoricalSearch`

`New-TransportRule`

`Get-DistributionGroupMember`

`Add-DistributionGroupMember`

`Set-CalendarProcessing`

`Add-MailboxFolderPermission`

`Get-EXOMailbox`

`Enable-Mailbox (archive)`

`Connect-MgGraph`

`Get-MgUser`

`New-MgUser`

`Update-MgUser`

`Revoke-MgUserSignInSession`

`Set-MgUserLicense`

`Get-MgGroup`

`New-MgGroupMember`

`Get-MgUserAuthenticationMethod`

`Get-MgAuditLogSignIn`

`Get-MgDirectoryRole`

`Get-MgSubscribedSku`

`Get-MgIdentityConditionalAccessPolicy`

`Get-Team`

`New-Team`

`Add-TeamUser`

`Get-CsOnlineUser`

`Grant-CsTeamsMeetingPolicy`

`Get-SPOSite`

`Set-SPOSite`

`Get-SPOTenant`

`Get-SPOUser / Add-SPOUser`

`Restore-SPODeletedSite`

`Get-MgDeviceManagementManagedDevice`

`Sync-MgDeviceManagementManagedDevice`

`Invoke-MgRetireDeviceManagementManagedDevice`

`Get-QuarantineMessage`

`Get-MalwareFilterPolicy`

`Get-SafeLinksPolicy`

`Search-UnifiedAuditLog`

`New-ComplianceSearch`

`Get-DlpCompliancePolicy`

`Connect-MsolService`

`Connect-AzureAD`

`Set-MsolUserPassword`