As part of our continued commitment to strengthening security across Exchange Online, we want to inform our customers about an important change coming to the Exchange Online PowerShell module.
What’s changing and why
Microsoft is progressively moving all services toward more secure, modern authentication experiences. As part of this shift, multi-factor authentication (MFA) is being made a mandatory security requirement across Microsoft cloud services. Because the legacy Resource Owner Password Credentials (ROPC) authentication flow does not support MFA, it is on the path toward deprecation as Microsoft strengthens its security baselines. Additionally, the Microsoft Authentication Library (MSAL) that supports authentication across Microsoft services has deprecated ROPC starting with version 4.74.0.
The -Credential parameter in Exchange Online PowerShell relies on ROPC, and therefore cannot meet MFA or Conditional Access requirements. To align with MFA enforcement, modern authentication principles, and Microsoft’s broader security standards, support for the -Credential parameter will be removed from new Exchange Online PowerShell versions released after June 2026.
While our published timeline extends to June 2026, we strongly recommend that all customers transition away from the -Credential parameter as soon as possible and not wait until the deadline.
Alternatives for the -Credential parameter
Below is a list of supported alternatives for the -Credential parameter that you should adopt depending on their scenario:
|
Scenario / Use Case |
Recommended Authentication Method |
Description |
Documentation |
|
Admins connecting interactively |
Interactive Sign‑In (Modern Auth + MFA) |
Secure sign-in for human administrators; supports MFA and Conditional Access. | |
|
Automation running outside Azure |
App‑Only Authentication |
Certificate‑based or secret‑based app registration for non‑interactive automation. | |
|
Automation running in Azure services |
Managed Identity Authentication |
Ideal for Functions, Automation Accounts, and cloud-native tasks. Eliminates secrets entirely. |
Use Azure managed identities to connect to Exchange Online PowerShell | Microsoft Learn |
Timeline
- Current state: the -Credential parameter continues to function today and will continue to function in all modules released till end of June 2026.
- Recommended action (effective immediately): you should begin migrating away from the -Credential parameter use while connecting to Exchange Online using the Connect-ExchangeOnline cmdlet
- After June 2026: new versions of the Exchange Online PowerShell modules released post 2026 will no longer include support for the -Credential parameter.
If you encounter any gaps or unsupported scenarios with the alternative authentication flows, please share them in the Comments section so we can prioritize addressing them in future updates.
Exchange Online Management Team
