inkybuck : I guess you can use the Graph API for most Exchange tasks. But it is quite a hassle to manually do all the authentication stuff (get a token, renew the token in time before it expires and so on) - I did this once when I didn't know about the other option. Instead of this, you can use the https://docs.microsoft.com/en-us/powershell/microsoftgraph/get-started?view=graph-powershell-1.0 which does all the authentication complexities for you. But then you still need to authenticate against it, the same as you would for the ExO PS module (or for calling the Graph REST API directly). From my experience, using a certificate is a lot less complicated then you would think. This runs very smoothly for automated scripts in our environment now.
What do you think is hindering you from using that? It doesn't need to be a PKI-managed certificate, it's just a local "object" with a private key that has the public key configured in an Azure app that you then use as service principal for authentication. And the Azure app also gets the appropriate permissions configured. I did go through that learning curve last week - maybe I can help :-).