Changes in Exchange Online PowerShell

Microsoft recently released a blogpost about deprecating Remote PowerShell in Exchange Online. It’s a small blog, but the impact can be serious. Exchange Online PowerShell is (was) available in three different versions and I will discuss these briefly.

Version 1

We have been using Remote PowerShell (RPS) for years to connect to Exchange Online using the New-PSSession command. This version 1 of Exchange Online PowerShell interacted with a PowerShell host session on the server, and used Basic Authentication. Later, V1 became available as an installable module, which added support for Modern Authentication including Multi-Factor Authentication. With the deprecation of Basic Authentication in Exchange Online, V1 of Exchange Online PowerShell will no longer work. If you still depend on it, support will retire anytime soon, as announced in Message Center bulletin MC407050.

Please be aware that we are talking about Exchange Online. For Exchange server on-premises, this does not change, and you can still use the New-PSSession command to setup a PowerShell connection to Exchange server. 

More information about the deprecation of V1 can be found in the Moving from the Exchange PowerShell v1 Module to the v2 Preview Microsoft blog from May 2022.

Version 2

Version 2 of Exchange Online PowerShell module supported Modern Authentication, and is easily recognizable by the Connect-ExchangeOnline command (simply put). Except for authentication, there are not many changes in the underlying protocol, but 9 REST-based commands were added, such as Get-EXOMailbox, Get-EXORecipient, Get-EXOCASMailbox etc. Besides these 9 REST-based cmdlets and Modern Authentication, version 2 of Exchange Online PowerShell also supports Multi-Factor Authentication and received Certificate-based authentication to enable running unattended scripts for example. Latest versions of v2 have been in Preview for a substantial period. This caused issues with organizations having a non-Preview in Production policy, as the functionality gap between General Availability (GA) and Preview became significant.

Version 3

When it comes to this underlying protocol, Microsoft is making changes here as well, changing from Remote PowerShell to REST (REpresentational State Transfer, an architectural style for building distributed systems). REST-based PowerShell cmdlets offers better performance, better reliability and more security compared to RPS, as they do not depend on Basic Authentication in the WinRM client. They are also built to be more robust and resilient to disconnects and timeouts. This REST-based PowerShell module has been in preview for quite some time but moved to GA in September 2022 with the release of Exchange Online Management Powershell module version 3.

Deprecation of Remote PowerShell

Deprecation of RPS as announced in the Microsoft blogpost is something that was expected, but the timing is too soon in my opinion. V1 will stop working anytime soon, but the plan right now is to stop V2 in July 2023.

How do you know what version you are running? The easiest method is to check your (management) server by executing the Get-InstalledModule command. This will return the Exchange Online Management version as shown in the following screenshot:

To upgrade from version 2.x to version 3.x, you must uninstall the 2.x version using the Uninstall-Module command:
PS C:\> Uninstall-Module ExchangeOnlineManagement

Followed by the installation of the new version by executing the following command:
PS C:\> Install-Module -Name ExchangeOnlineManagement -RequiredVersion 3.0.0

Version 3.0 was released in September 2022, there are newer preview versions available (3.1.0-Preview2 by the time of writing) but the name implies, these are preview versions.

So far so good and changing a management module on your server or workstation is not really a big thing. The problem is with automation. If you have a larger environment, and manage your environment using PowerShell, then you must go through all your scripts (again!) and see if they continue to work with the new Exchange Online Management module.

To make matters worse, the AzureAD Graph API will be turned off after June 30, 2023 and also the deprecation date for 3 other PowerShell modules (Azure AD, Azure AD Preview, and MS Online) are set on June 30, 2023. Let’s hope Microsoft will allow for some additional breathing space with regards to these scheduling dates. For sure, more information from Microsoft will be released as we move closer to these days.

To get more information about PowerShell modules, (un)installing, deprecation and dates I have gathered some links which you can find here:

• Announcing Deprecation of Remote PowerShell (RPS) Protocol in Exchange Online PowerShell - https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-deprecation-of-remote-powershell-rps-protocol-in/ba-p/3695597
• Moving from the Exchange PowerShell v1 Module to the v2 Preview - Moving from the Exchange PowerShell v1 Module to the v2 Preview - Microsoft Community Hub
• Analyzing Exchange Online scripts - https://eightwone.com/2022/05/25/analyzing-exchange-online-scripts/
• About the Exchange Online PowerShell module - https://learn.microsoft.com/en-gb/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps#how-the-exo-v2-module-works
• Understanding the Different Versions of Exchange Online PowerShell Modules and Basic Auth - https://techcommunity.microsoft.com/t5/exchange-team-blog/understanding-the-different-versions-of-exchange-online/ba-p/3394487
• Microsoft Entra change announcements – September 2022 train - https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/microsoft-entra-change-announcements-september-2022-train/ba-p/2967454?WT.mc_id=M365-MVP-9501 

Exchange Hybrid and Office 365 Monitoring and Reporting

On-premises components, such as AD FS, PTA, and Exchange Hybrid are critical for Office 365 end user experience. In addition, something as trivial as expiring Exchange or AD FS certificates can certainly lead to unexpected outages. By proactively monitoring hybrid components, ENow gives you early warnings where hybrid components are reaching a critical state, or even for an upcoming expiring certificate. Knowing immediately when a problem happens, where the fault lies, and why the issue has occurred, ensures that any outages are detected and solved as quickly as possible.

Access your free 14-day trial of ENow’s Exchange Hybrid and Office 365 Monitoring and Reporting today!