Free Exchange Online PowerShell Command Builder

This tool builds ready-to-run Exchange Online PowerShell commands from a form. Pick a task — grant Full Access to a shared mailbox, audit tenant-wide mail forwarding, run a message trace, create a distribution group, report on mailbox sizes — fill in the mailbox address or username, and the correct cmdlet syntax is generated with the connection preamble already attached. Around forty tasks are covered across nine categories. Everything is generated in your browser; nothing you type is sent anywhere, and the tool never connects to your tenant.

It is aimed at the Microsoft 365 administrator who knows exactly what needs to happen but not the exact parameter names — which is most of us, most of the time. Is it -User or -Trustee? Does Send As use Add-MailboxPermission or Add-RecipientPermission? Is Get-MessageTrace still a thing? The builder answers those questions by producing correct syntax rather than by making you look each one up.

Prerequisites: Install the Module and Connect

Every task except the install itself assumes you are connected. Install the module once:

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force
Later, update it with:
Update-Module -Name ExchangeOnlineManagement

Then connect. Interactive sign-in handles MFA through a browser prompt:

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com -ShowBanner:$false

And always disconnect when you are done, so you do not leave a session holding a token:

Disconnect-ExchangeOnline -Confirm:$false

The builder also covers certificate-based authentication (Connect-ExchangeOnline -CertificateThumbprint with an app ID and organisation, for unattended scripts), app-only authentication with a managed identity (Connect-ExchangeOnline -ManagedIdentity), and the -DisableWAM switch that resolves the Web Account Manager broker sign-in failures some workstations hit. For a full walkthrough of installing the module, dealing with execution policy and troubleshooting first-connection errors, see our guide on how to install and connect to Exchange Online PowerShell.

The Nine Task Categories

• Connect & Setup — install the module, connect interactively or with MFA, certificate-based and managed-identity authentication, WAM troubleshooting, disconnect.
• Mailbox Permissions — grant and remove Full Access, Send As and Send on Behalf; list who currently has access to a mailbox.
• Mail Forwarding — set forwarding to an internal or external address, remove it, and audit forwarding across the entire tenant.
• Shared Mailboxes — create a shared mailbox, convert a user mailbox to shared, add members and control auto-mapping.
• Groups — create distribution groups, add and remove members, bulk-add from a CSV, list membership, allow external senders.
• Message Trace — trace by sender, by recipient, or by delivery status over a chosen number of days.
• Calendar Permissions — view, grant and change calendar access at every permission level from AvailabilityOnly to PublishingEditor.
• Transport Rules — list rules, disable a rule, and create a rule blocking external auto-forwarding.
• Reporting — mailbox size reports, last logon reports, mailboxes near quota, inactive mailboxes and recipient-type breakdowns, exported to CSV.

Each task also shows the underlying cmdlet and the role or permission you need to run it — Exchange Administrator for most changes, View-Only Recipients or Global Reader for the read-only reports.

Worked Example: The Three Kinds of Mailbox Permission

This is the area where the wrong cmdlet gets used most often, because the three permissions look similar and behave completely differently.

Full Access lets someone open the mailbox and read everything in it. It does not let them send as the mailbox:

Add-MailboxPermission -Identity "shared@contoso.com" `
    -User "jdoe@contoso.com" `
    -AccessRights FullAccess -InheritanceType All -AutoMapping $true

Send As makes mail appear to come from the mailbox itself, with no trace of the actual sender in the From line. It is a different cmdlet entirely — Add-RecipientPermission, with -Trustee rather than -User:

Add-RecipientPermission -Identity "shared@contoso.com" `
    -Trustee "jdoe@contoso.com" `
    -AccessRights SendAs -Confirm:$false

Send on Behalf shows recipients “jdoe on behalf of shared”, and is set as a property of the mailbox:

Set-Mailbox -Identity "shared@contoso.com" `
    -GrantSendOnBehalfTo @{Add="jdoe@contoso.com"}

Two practical notes. The @{Add=…} hashtable syntax on -GrantSendOnBehalfTo appends to the existing list; assigning a plain value replaces it, silently removing everyone else. And -AutoMapping $true makes the shared mailbox appear automatically in Outlook, which is usually what people want — but for a mailbox with tens of thousands of items it can slow Outlook noticeably, so set it to $false and have users add the mailbox manually in that case.

Worked Example: Auditing Mail Forwarding

Attacker-configured mail forwarding is one of the most durable post-compromise persistence techniques in Microsoft 365, and it hides in two separate places. Server-side forwarding is a mailbox property; user-created inbox rules are separate objects. A complete audit checks both:

# Every mailbox with server-side forwarding configured
Get-EXOMailbox -ResultSize Unlimited -PropertySets Delivery |
    Where-Object { $_.ForwardingAddress -or $_.ForwardingSmtpAddress } |
    Select-Object DisplayName, PrimarySmtpAddress, ForwardingAddress,
        ForwardingSmtpAddress, DeliverToMailboxAndForward |
    Export-Csv -Path "C:\Reports\forwarding.csv" -NoTypeInformation
User-created inbox rules that forward or redirect
Get-EXOMailbox -ResultSize Unlimited |
ForEach-Object { Get-InboxRule -Mailbox $.PrimarySmtpAddress |
Where-Object { $.ForwardTo -or $.ForwardAsAttachmentTo -or $.RedirectTo } }

Run the audit, then close the gap with a transport rule that blocks external auto-forwarding outright — the builder generates that rule too. Note the Get-EXO* cmdlets used here: the REST-backed V3 cmdlets such as Get-EXOMailbox are substantially faster than their classic equivalents on large tenants, and -PropertySets keeps the payload small by fetching only the property group you need.

Worked Example: Message Trace

When a user reports a missing message, trace it:

Get-MessageTraceV2 -SenderAddress "sender@contoso.com" `
    -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
    Format-Table Received, SenderAddress, RecipientAddress, Subject, Status -AutoSize

Get-MessageTraceV2 covers up to 90 days and replaces the retired Get-MessageTrace. If you have older scripts still calling the original cmdlet, that is why they stopped working. You can also filter by delivery status — Failed, Delivered, Pending, Quarantined or FilteredAsSpam — which is usually the fastest route to a deliverability answer.

Before You Run Anything

These commands change production mail flow and access. Read the generated command before running it, run reporting tasks before change tasks, and test permission and forwarding changes on a single test mailbox first. Bulk operations built from a CSV in particular deserve a dry run — pipe to Select-Object and inspect the list before you pipe it to a cmdlet that writes.

Related Tools

Mail-flow problems that turn out to be DNS problems are common: check the domain’s records with the DNS lookup tool, and build or repair authentication records with the SPF generator and DMARC generator. For CSV and report output you need to reshape, the JSON formatter is a useful companion.

Frequently Asked Questions

How do I install the Exchange Online PowerShell module?

Run Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force. Drop -Scope CurrentUser and run PowerShell as administrator if you want it installed for all users on the machine.

How do I connect to Exchange Online PowerShell with MFA?

Use Connect-ExchangeOnline -UserPrincipalName admin@contoso.com. The V3 module handles multi-factor authentication through an interactive browser prompt by default — there is no separate MFA module any more.

Does this tool connect to my tenant?

No. It generates command text only. Nothing you enter — mailbox addresses, tenant names, app IDs, thumbprints — leaves your browser, and no credentials are ever requested.

What is the difference between Full Access and Send As?

Full Access lets someone open and read a mailbox. Send As lets them send mail that appears to originate from it. They are separate permissions set by different cmdlets, and delegating a shared mailbox usually requires both.

Why can my delegate open the mailbox but not send from it?

Because Full Access was granted and Send As was not. Add the Send As permission with Add-RecipientPermission. Also allow time for the change to replicate — permission changes in Exchange Online are not always instant.

What replaced Get-MessageTrace?

Get-MessageTraceV2. It supports a 90-day window and is the supported cmdlet going forward; the original has been retired.

What are the Get-EXO cmdlets?

REST-backed V3 cmdlets such as Get-EXOMailbox and Get-EXOMailboxStatistics, designed for bulk and reporting work. They are considerably faster on large tenants and support -PropertySets to limit which properties are retrieved.

How do I run Exchange Online PowerShell unattended?

Use certificate-based app-only authentication: register an Entra ID application, grant it the Exchange.ManageAsApp permission, upload a certificate, and connect with Connect-ExchangeOnline -CertificateThumbprint <thumbprint> -AppId <app-id> -Organization contoso.onmicrosoft.com. On an Azure-hosted runner, a managed identity avoids handling a certificate at all.

What roles do I need?

Exchange Administrator covers most changes. Read-only reporting and message trace generally need only View-Only Recipients or Global Reader. Each task in the builder states its own requirement, so you can request the minimum rather than defaulting to Global Administrator.

Why does my connection fail with a broker or WAM error?

Some workstations hit failures in the Web Account Manager sign-in broker. Add -DisableWAM to Connect-ExchangeOnline to fall back to the browser-based flow. The builder includes this as a dedicated task.