JeremyTBradshaw ...and, under psexec -s <path-to-powershell>:
PS C:\Windows\system32> PS C:\Windows\system32> dir cert:\CurrentUser\my
PS C:\Windows\system32> PS C:\Windows\system32> dir cert:\LocalMachine\my
PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\my
Thumbprint Subject
---------- -------
D2FC8B18A0F25752979903E4F94F793D9985E1D5 CN=Azure, O="XXX..
I didn't expect to see anything under cert:\CurrentUser\My, as that would be empty for LocalSystem, but just wondering. Clearly the cert is there in LocalMachine, and of course, the Connect-ExchangeOnline still fails as before. I'm not sure if I can import the cert to LocalSystem's CurrentUser\My store, but I may try that - if it works, it's no solution, as the CmdLet should be looking in LocalMachine, but it at least would clarify the situation.