Practical Exchange Administration with PowerShell

Exchange administration usually starts with a simple request: give someone access to a mailbox, investigate a delivery problem, change a transport rule, prepare a migration, or find out why a setting is not behaving as expected.

The difficult part is rarely the first command.

The difficult part is knowing where the object is managed, what its current state is, how wide the change should be, and how you will prove that the result is correct.

This article brings those decisions together into one practical operating model. You will move from everyday recipient and mailbox administration into mail flow, security, compliance, hybrid operations, migration, public folders, monitoring, and troubleshooting.

View larger

Image detail

−100%+Reset✕

1. Start with the management plane

Exchange administration becomes complicated when a property is visible in one place but authoritative somewhere else.

Exchange Online, Exchange Server, Microsoft Purview, and hybrid Exchange expose different command families and different boundaries. A syntactically correct command can still be the wrong operational choice if it is run against the wrong system.

View larger

Image detail

−100%+Reset✕

Before we start changing recipients and mailboxes, keep one idea in mind: good Exchange administration is a sequence of decisions, not a race to the first working cmdlet.

2. Recipient administration: identify before you modify

Most Exchange requests begin with a recipient, mailbox, group, contact, or resource. Identify the actual recipient class before changing it.

$Identity = 'alex@contoso.com'

Get-EXORecipient -Identity $Identity |
    Select-Object DisplayName,
                  PrimarySmtpAddress,
                  RecipientType,
                  RecipientTypeDetails,
                  ExternalDirectoryObjectId,
                  Guid

Get-EXOMailbox -Identity $Identity `
    -Properties ArchiveStatus,RetentionPolicy,CustomAttribute1 |
    Select-Object DisplayName,
                  PrimarySmtpAddress,
                  RecipientTypeDetails,
                  ArchiveStatus,
                  RetentionPolicy,
                  CustomAttribute1

On Exchange Server:

Get-Recipient -Identity 'alex@contoso.com' |
    Format-List Name,
                PrimarySmtpAddress,
                RecipientType,
                RecipientTypeDetails,
                Guid

Establish a baseline

For recurring administration, make discovery produce evidence rather than disappearing into the terminal.

$RunId = Get-Date -Format 'yyyyMMdd-HHmmss'
$Out   = ".\RecipientBaseline-$RunId.csv"

Get-EXORecipient -ResultSize Unlimited |
    Select-Object DisplayName,
                  PrimarySmtpAddress,
                  RecipientTypeDetails,
                  Guid,
                  ExternalDirectoryObjectId |
    Sort-Object RecipientTypeDetails,DisplayName |
    Export-Csv $Out -NoTypeInformation

Write-Host "Baseline exported to $Out"

3. Mailbox administration is service administration

Common mailbox changes include archives, forwarding, quotas, mailbox features, automatic replies, client access, regional settings, and resource booking.

Controlled forwarding

Forwarding deserves additional scrutiny because it can be both a legitimate business requirement and a security signal.

$Identity = 'alex@contoso.com'
$RunId    = Get-Date -Format 'yyyyMMdd-HHmmss'

$Before = Get-EXOMailbox -Identity $Identity `
    -Properties ForwardingAddress,
                ForwardingSmtpAddress,
                DeliverToMailboxAndForward

$Before |
    Select-Object DisplayName,
                  PrimarySmtpAddress,
                  ForwardingAddress,
                  ForwardingSmtpAddress,
                  DeliverToMailboxAndForward |
    Export-Csv ".\Forwarding-Before-$RunId.csv" -NoTypeInformation

Set-Mailbox -Identity $Identity `
    -ForwardingSmtpAddress 'smtp:destination@contoso.com' `
    -DeliverToMailboxAndForward $true

Get-EXOMailbox -Identity $Identity `
    -Properties ForwardingAddress,
                ForwardingSmtpAddress,
                DeliverToMailboxAndForward |
    Select-Object DisplayName,
                  PrimarySmtpAddress,
                  ForwardingAddress,
                  ForwardingSmtpAddress,
                  DeliverToMailboxAndForward

Bulk changes

CSV-driven work should separate input validation, target resolution, execution, and result reporting.

# CSV columns: Identity, Office, CustomAttribute1
$InputPath = '.\MailboxUpdates.csv'
$RunId     = Get-Date -Format 'yyyyMMdd-HHmmss'
$LogPath   = ".\MailboxUpdateLog-$RunId.csv"
$Rows      = Import-Csv $InputPath

$Results = foreach ($Row in $Rows) {
    $Result = [ordered]@{
        Identity         = $Row.Identity
        Office           = $Row.Office
        CustomAttribute1 = $Row.CustomAttribute1
        Status           = 'NotStarted'
        Error            = $null
    }

    try {
        if ([string]::IsNullOrWhiteSpace($Row.Identity)) {
            throw 'Identity is blank.'
        }

        $Mailbox = Get-EXOMailbox -Identity $Row.Identity -ErrorAction Stop

        $Params = @{
            Identity         = $Mailbox.PrimarySmtpAddress
            Office           = $Row.Office
            CustomAttribute1 = $Row.CustomAttribute1
            ErrorAction      = 'Stop'
        }

        Set-Mailbox @Params
        $Result.Status = 'Updated'
    }
    catch {
        $Result.Status = 'Failed'
        $Result.Error  = $_.Exception.Message
    }

    [pscustomobject]$Result
}

$Results | Export-Csv $LogPath -NoTypeInformation
$Results | Group-Object Status | Select-Object Name,Count

Common failures include using display names as identities, confusing configuration with mailbox statistics, replacing an entire multivalued address collection when only one value should change, assuming shared mailboxes never require licensing, and changing client-access protocols without understanding the affected population.

4. Delegation: configure the exact right

Treat each delegation permission as a separate capability.

$Mailbox  = 'shared-helpdesk@contoso.com'
$Delegate = 'alex@contoso.com'

Add-MailboxPermission -Identity $Mailbox -User $Delegate `
    -AccessRights FullAccess `
    -InheritanceType All `
    -AutoMapping $false

Add-RecipientPermission -Identity $Mailbox -Trustee $Delegate `
    -AccessRights SendAs `
    -Confirm:$false

Set-Mailbox -Identity $Mailbox `
    -GrantSendOnBehalfTo @{Add=$Delegate}

Add-MailboxFolderPermission -Identity "$Mailbox`:\Calendar" `
    -User $Delegate `
    -AccessRights Reviewer

Verify each right with the matching retrieval command:

Get-EXOMailboxPermission -Identity $Mailbox |
    Where-Object {
        $_.User -like '*alex*' -and
        $_.AccessRights -contains 'FullAccess'
    }

Get-EXORecipientPermission -Identity $Mailbox -Trustee $Delegate

Get-Mailbox -Identity $Mailbox |
    Format-List GrantSendOnBehalfTo

Get-MailboxFolderPermission -Identity "$Mailbox`:\Calendar"

5. Mail flow rules: broad power requires narrow changes

Transport rules operate at organization scale. Evaluate five interacting dimensions:

conditions → exceptions → actions → priority → mode

StopRuleProcessing adds another important control because it determines whether lower-priority rules continue to evaluate the message.

Baseline the existing configuration first.

$RunId = Get-Date -Format 'yyyyMMdd-HHmmss'

Get-TransportRule |
    Select-Object Name,
                  State,
                  Mode,
                  Priority,
                  Comments,
                  Description |
    Export-Csv ".\TransportRules-Before-$RunId.csv" -NoTypeInformation

For a new change, prefer a narrow test or audit mode where the workload supports it.

New-TransportRule -Name 'Mark External Project Aurora Mail' `
    -FromScope NotInOrganization `
    -SubjectOrBodyContainsWords 'Project Aurora' `
    -PrependSubject '[EXTERNAL-PROJECT] ' `
    -Mode Audit `
    -Comments 'Change CHG000000; owner Messaging Operations'

Get-TransportRule -Identity 'Mark External Project Aurora Mail' |
    Format-List Name,
                State,
                Mode,
                Priority,
                Comments,
                Description

Use message-trace evidence to prove Exchange Online behavior rather than relying only on the rule object’s configuration.

6. Connectors, domains, and routing

Start connector administration with the routing question: What path should the message take, and why? Exchange Online uses inbound/outbound connectors; Exchange Server uses Send/Receive connectors.

# Exchange Online
Get-InboundConnector |
    Select-Object Name,Enabled,ConnectorType,SenderDomains,
                  SenderIPAddresses,RequireTls

Get-OutboundConnector |
    Select-Object Name,Enabled,ConnectorType,RecipientDomains,
                  SmartHosts,TLSSettings

Get-AcceptedDomain |
    Select-Object Name,DomainName,DomainType,Default

Get-RemoteDomain |
    Select-Object DomainName,AutoReplyEnabled,
                  AllowedOOFType,AutoForwardEnabled

# Exchange Server
Get-SendConnector |
    Select-Object Name,Enabled,AddressSpaces,
                  SmartHosts,DNSRoutingEnabled,SourceTransportServers

Get-ReceiveConnector |
    Select-Object Identity,Enabled,Bindings,
                  RemoteIPRanges,PermissionGroups,AuthMechanism

7. Message trace: diagnose the path, not just the symptom

Use the evidence source appropriate to the transport boundary: Exchange Online message trace; Exchange Server message tracking and queues.

$Start = (Get-Date).AddHours(-4)
$End   = Get-Date

$Trace = Get-MessageTraceV2 `
    -SenderAddress sender@contoso.com `
    -RecipientAddress recipient@fabrikam.com `
    -StartDate $Start `
    -EndDate $End `
    -ResultSize 5000

$Trace |
    Select-Object Received,
                  SenderAddress,
                  RecipientAddress,
                  Subject,
                  Status,
                  MessageTraceId |
    Export-Csv '.\MessageTraceV2.csv' -NoTypeInformation

$Trace |
    Get-MessageTraceDetailV2 |
    Export-Csv '.\MessageTraceDetailV2.csv' -NoTypeInformation

On Exchange Server:

Get-MessageTrackingLog `
    -Sender sender@contoso.com `
    -Recipients recipient@fabrikam.com `
    -Start (Get-Date).AddHours(-4) `
    -End (Get-Date) |
    Select-Object Timestamp,
                  EventId,
                  Source,
                  Sender,
                  Recipients,
                  MessageSubject,
                  RecipientStatus

Get-Queue |
    Format-Table Identity,Status,MessageCount,NextHopDomain

Get-QueueDigest

8. Security and protection policies

Protection administration follows a policy-and-rule model: the policy defines behavior; the rule controls scope, priority, and state.

Get-HostedContentFilterPolicy |
    Select-Object Name,IsDefault,
                  SpamAction,HighConfidenceSpamAction

Get-HostedContentFilterRule |
    Select-Object Name,State,Priority,
                  HostedContentFilterPolicy,RecipientDomainIs

Get-MalwareFilterPolicy |
    Select-Object Name,IsDefault,Action,EnableFileFilter

Get-MalwareFilterRule |
    Select-Object Name,State,Priority,
                  MalwareFilterPolicy,SentTo

Get-DkimSigningConfig |
    Select-Object Domain,Enabled,Status,
                  Selector1CNAME,Selector2CNAME

9. Retention, compliance, eDiscovery, and audit

Compliance work requires precise terminology. Exchange MRM and Microsoft Purview retention are related but not interchangeable: MRM remains relevant to mailbox/archive lifecycle, while Purview provides the broader Microsoft 365 governance model.

For compliance-search scenarios that require it, establish the Purview session explicitly.

Connect-IPPSSession -EnableSearchOnlySession

New-ComplianceSearch -Name 'Incident-Project-Aurora' `
    -ExchangeLocation alex@contoso.com `
    -ContentMatchQuery 'subject:"Project Aurora"'

Start-ComplianceSearch -Identity 'Incident-Project-Aurora'

Get-ComplianceSearch -Identity 'Incident-Project-Aurora'

For an audit investigation:

$Start = (Get-Date).AddDays(-7)
$End   = Get-Date

Search-UnifiedAuditLog `
    -StartDate $Start `
    -EndDate $End `
    -Operations SoftDelete,HardDelete,MoveToDeletedItems `
    -UserIds alex@contoso.com `
    -ResultSize 5000 |
    Export-Csv '.\Audit-MailDeletion.csv' -NoTypeInformation

10. Hybrid administration: determine the source of authority

Hybrid Exchange is where administrative syntax meets architecture. A recipient can exist across directory, cloud, and on-premises systems without those systems sharing authority over every property.

Before changing a hybrid recipient, answer five questions:

1. Is the object directory-synchronized?
2. Where is identity authoritative?
3. Where are Exchange attributes authoritative?
4. Is cloud-managed Exchange attribute management enabled for this object or tenant?
5. Is the task recipient management, service configuration, mail flow, or migration?

Get-HybridConfiguration | Format-List *

Get-OnPremisesOrganization |
    Format-List Name,OrganizationGuid,HybridDomains,OutboundConnector

Get-IntraOrganizationConnector |
    Format-List Name,DiscoveryEndpoint,TargetAddressDomains,Enabled

Get-OrganizationRelationship |
    Format-List Name,DomainNames,
                FreeBusyAccessEnabled,
                TargetAutodiscoverEpr

Get-RemoteMailbox -Identity 'alex@contoso.com' |
    Format-List Name,
                PrimarySmtpAddress,
                RemoteRoutingAddress,
                RemoteRecipientType,
                ExchangeGuid,
                ArchiveGuid

11. Migration: make every phase observable

Mailbox migration depends on endpoint readiness, authentication, directory and mailbox state, throttling, data consistency, cutover timing, and post-move validation.

$Endpoint = Get-MigrationEndpoint |
    Where-Object { $_.Identity -like '*Hybrid*' } |
    Select-Object -First 1

$Batch = New-MigrationBatch -Name 'Wave-01' `
    -SourceEndpoint $Endpoint.Identity `
    -TargetDeliveryDomain 'contoso.mail.onmicrosoft.com' `
    -CSVData ([System.IO.File]::ReadAllBytes('.\Wave-01.csv'))

Start-MigrationBatch -Identity $Batch.Identity

Get-MigrationBatch -Identity 'Wave-01'

Get-MigrationUser -BatchId 'Wave-01' |
    Get-MigrationUserStatistics |
    Select-Object Identity,
                  Status,
                  PercentComplete,
                  DataConsistencyScore,
                  SkippedItemCount

12. Public folders: treat them as an architecture

Public-folder administration combines hierarchy, content, permissions, mail enablement, mailboxes, capacity, migration, and client behavior, so treat it as a structured project rather than isolated commands.

Get-PublicFolder -Recurse -ResultSize Unlimited |
    Select-Object Identity,
                  Name,
                  ParentPath,
                  MailEnabled |
    Export-Csv '.\PublicFolder-Hierarchy.csv' -NoTypeInformation

Get-PublicFolderStatistics -ResultSize Unlimited |
    Select-Object Name,
                  FolderPath,
                  ItemCount,
                  TotalItemSize,
                  LastModificationTime |
    Export-Csv '.\PublicFolder-Statistics.csv' -NoTypeInformation

Get-MailPublicFolder -ResultSize Unlimited |
    Select-Object Name,
                  PrimarySmtpAddress,
                  EmailAddresses |
    Export-Csv '.\MailEnabledPublicFolders.csv' -NoTypeInformation

13. Monitoring and operational reporting

A useful operational report identifies the affected scope, fault domain, severity, and evidence. Exchange Server adds database, DAG, queue, and server-health data to the cloud-side configuration and trace data used in Exchange Online.

Exchange Server health snapshot

Get-ServerHealth -Identity EX01 |
    Where-Object AlertValue -ne 'Healthy' |
    Select-Object Server,
                  HealthSet,
                  Name,
                  AlertValue,
                  TargetResource

Get-MailboxDatabaseCopyStatus * |
    Select-Object Name,
                  Status,
                  CopyQueueLength,
                  ReplayQueueLength,
                  ContentIndexState

Test-ReplicationHealth -Identity EX01

Get-QueueDigest

Exchange Online operational reports

$RunId = Get-Date -Format 'yyyyMMdd-HHmmss'

Get-EXOMailbox -ResultSize Unlimited `
    -Properties ArchiveStatus,RetentionPolicy |
    Select-Object DisplayName,
                  PrimarySmtpAddress,
                  RecipientTypeDetails,
                  ArchiveStatus,
                  RetentionPolicy |
    Export-Csv ".\EXO-MailboxInventory-$RunId.csv" -NoTypeInformation

Get-EXOMailbox -ResultSize Unlimited `
    -Properties ForwardingSmtpAddress,
                ForwardingAddress,
                DeliverToMailboxAndForward |
    Where-Object {
        $_.ForwardingSmtpAddress -or
        $_.ForwardingAddress
    } |
    Select-Object DisplayName,
                  PrimarySmtpAddress,
                  ForwardingSmtpAddress,
                  ForwardingAddress,
                  DeliverToMailboxAndForward |
    Export-Csv ".\EXO-ForwardingInventory-$RunId.csv" -NoTypeInformation

14. Troubleshooting: collect evidence before changing things

Troubleshooting should be hypothesis-driven: collect evidence, isolate the fault domain, remediate deliberately, and verify the outcome.

A useful troubleshooting sequence is:

Confirm scope → choose management plane → collect evidence → test the hypothesis → isolate the fault domain → remediate → verify → preserve evidence

View larger

Image detail

−100%+Reset✕

Reusable evidence folder

$CaseId = 'INC000000'
$RunId  = Get-Date -Format 'yyyyMMdd-HHmmss'
$Path   = ".\$CaseId-$RunId"

New-Item -ItemType Directory -Path $Path | Out-Null

Start-Transcript -Path "$Path\Transcript.txt"

Get-TransportRule |
    Export-Clixml "$Path\TransportRules.xml"

Get-AcceptedDomain |
    Export-Clixml "$Path\AcceptedDomains.xml"

Get-RemoteDomain |
    Export-Clixml "$Path\RemoteDomains.xml"

Stop-Transcript

15. A production runbook pattern

For repeatable administration, make the operational stages explicit.

param(
    [Parameter(Mandatory)]
    [string]$ChangeId,

    [Parameter(Mandatory)]
    [string]$InputCsv,

    [switch]$WhatIf
)

$RunId = Get-Date -Format 'yyyyMMdd-HHmmss'
$Root  = ".\$ChangeId-$RunId"

New-Item -ItemType Directory -Path $Root -Force | Out-Null

Start-Transcript -Path "$Root\Transcript.txt"

try {
    $Rows = Import-Csv $InputCsv
    $Rows | Export-Csv "$Root\InputSnapshot.csv" -NoTypeInformation

    # 1. Validate input
    # 2. Discover and export before-state
    # 3. Apply scoped change with ShouldProcess or -WhatIf
    # 4. Verify and export after-state
    # 5. Emit structured result objects
}
catch {
    $_ | Out-File "$Root\FatalError.txt"
    throw
}
finally {
    Stop-Transcript
}

16. The production checklist

Use the following as the final muscle memory for Exchange PowerShell changes.

Conclusion

Practical Exchange administration is less about memorizing commands and more about learning to ask the right questions before you run them.

Where is this object actually managed? What is its current state? Who will be affected? What evidence will show that the change worked? What will let you recover if it did not?

Once those questions become part of your normal workflow, PowerShell becomes much more than a collection of Exchange commands. It becomes a dependable way to investigate, change, verify, and support the service.