We have introduced security enhancements to Exchange Online PowerShell authentication in ExchangeOnlineManagement module version 3.10.1 and newer. These enhancements strengthen the authentication flow and provide additional protection against emerging threats.
- Customers using a version earlier than 3.10.1 should upgrade to version 3.10.1 or later. Exchange Online authentication will increasingly rely on the security enhancements available in these versions, and older module versions may not support future authentication requirements.
- Customers already using version 3.10.1 or later do not need to take any additional action beyond keeping the module up to date.
Microsoft recommends upgrading as soon as possible to benefit from the latest security, reliability, and performance improvements and to prevent any future PowerShell connectivity issues.
What is Changing
Microsoft plans to begin enforcement of more strict logon requirements for Exchange Online PowerShell module on 31st March 2027.
After the enforcement:
- ExchangeOnlineManagement versions older than 3.10.1 may experience authentication failures in certain interactive authentication scenarios.
- ExchangeOnlineManagement version 3.10.1 and later will continue to function normally.
Upgrading the ExchangeOnlineManagement module to versions 3.10.1 (or newer) is the only thing you need to do. No other changes are required.
Who May Be Affected
You may be affected if you are:
- Running ExchangeOnlineManagement versions earlier than 3.10.1.
- Using PowerShell 7.
- Using interactive authentication with Web Account Manager (WAM) disabled.
You may not be affected if you are using:
- ExchangeOnlineManagement version 3.10.1 or later.
- Certificate-Based Authentication (CBA).
- WAM-based authentication.
- Windows PowerShell 5.x.
Regardless of your current scenario, Microsoft recommends upgrading to ExchangeOnlineManagement version 3.10.1 or later to stay aligned with current and future Exchange Online requirements.
To verify the currently installed version:
Get-Module ExchangeOnlineManagement -ListAvailableThe latest version of the ExchangeOnlineManagement module is available from the PowerShell Gallery: ExchangeOnlineManagement PowerShell Module
Frequently Asked Questions
We are already using ExchangeOnlineManagement version 3.10.1 or later. Do we need to do anything?
No additional action is required for this change if you are already running ExchangeOnlineManagement version 3.10.1 or later. Continue keeping the module up to date to receive the latest security, reliability, and performance improvements.
Will our existing scripts be affected if I use Certificate-Based Authentication (CBA)?
No. Scripts and automation that use CBA are not expected to be affected by this enforcement because they do not use interactive authentication. However, Microsoft recommends upgrading to ExchangeOnlineManagement version 3.10.1 or later to stay current with the latest security and reliability improvements.
Does this change require us to enable WAM?
No. This change does not require customers to enable WAM.
Do we need to upgrade to the newer module if our current authentication scenario is not affected?
Yes. Microsoft recommends that all customers upgrade to ExchangeOnlineManagement version 3.10.1 or later, regardless of their current authentication scenario. While some scenarios may not be affected by the initial enforcement, upgrading helps ensure compatibility with current and future Exchange Online authentication requirements.
Exchange Online Manageability Team
