Disabling EXO PowerShell Access via Scheduled Task

Question

We have a security initiative to disable the default Exchnage Online (EXO) PowerShell access for users, while retaining access for Admins. I would like to implement this using a scheduled task inside Adaxes and have the scope target the OUs of our normal user accounts. Ideally, we would like to use a PS script to return a true/false condition (i.e.: is it already disabled?) before the change is made, but I am not sure what would be the best approach for this would be in terms of the code used in the script(s).

This is the article that we've been referencing from Microsoft: https://learn.microsoft.com/en-us/powershell/exchange/disable-access-to-exchange-online-powershell?view=exchange-ps

Answer 1

Hello Mark,

According to the article you referenced, you can disable the access by just using the below script.

try
{
    # Get the object ID in Microsoft 365
    $objectId = [Guid]$Context.TargetObject.Get("adm-AzureId")
}
catch
{
    return # The user doesn't have a Microsoft 365 account
}

# Connect to Exchange Online
$Context.CloudServices.ConnectExchangeOnline() 

# Disable Exchange Online PowerShell access
Set-User -Identity $objectId -EXOModuleEnabled $false

Unfortunately, there does not seem to be an easy way to check the status for a single user. The command provided in the article returns a bunch of formatted text and trying to parse it in the script is nearly impossible.

As for the OUs you want to target, they should just be added to the Activity Scope of the scheduled task. For details on how to create those in Adaxes, see https://www.adaxes.com/help/ScheduleTasksForDirectoryManagement.

Comments

Thank you. I will give this script a shot and will let you know if I run into any issues.

---

So, the first issue that I ran into is that the last line of the script had a specific user account called out in it and was set to enable EXO PowerShell (not disable). Therefore, I swapped that line out to: Set-User -Identity %userPrincipalName% -EXOModuleEnabled $false.

However, I now have the following error when testing it out:

---

Hello Mark,

Sorry for the mistake in the script. Please, try using the below one. We also updated the script accordingly in the previous post.

try
{
    # Get the object ID in Microsoft 365
    $objectId = [Guid]$Context.TargetObject.Get("adm-AzureId")
}
catch
{
    return # The user doesn't have a Microsoft 365 account
}

# Connect to Exchange Online
$Context.CloudServices.ConnectExchangeOnline() 

# Disable Exchange Online PowerShell access
Set-User -Identity $objectId -EXOModuleEnabled $false

---

So, the error message (from my previous screenshot) appears to be generated as a result of the command wanting a confirmation. Therefore, the last line would need to be modified to: Set-User -Identity $objectId -EXOModuleEnabled $false -Confirm:$false