Most Exchange Online PowerShell problems happen in one of three places: installing or loading the ExchangeOnlineManagement module, signing in with Connect-ExchangeOnline, or running a cmdlet once you're connected. This quick reference lists the documented messages from each stage, plus the legacy remote PowerShell errors that old scripts still produce, with the meaning, the usual cause and the first thing to check.
Codes in this quick reference
Files cannot be loaded because running scripts is disabled on this system. Provide a valid certificate with which to sign the files.Connect-ExchangeOnlineCannot find a cmdlet Update-Manifest: PowerShellGet isn't installedConnect-ExchangeOnlineThe specified module 'ExchangeOnlineManagement' with PowerShellGetFormatVersion '<version>' isn't supported (old PowerShellGet)Install-Module / Update-ModuleWARNING: Unable to download from URI 'https://go.microsoft.com/fwlink/?LinkID=627338&clcid=0x409' to ''.Install-Module / Update-ModuleWARNING: Unable to download the list of available providers. Check your internet connection.Install-Module / Update-ModuleNo match was found for the specified search criteria and module name 'ExchangeOnlineManagement'.Install-ModuleThe term 'Update-ModuleManifest' is not recognized as a name of a cmdlet, function, script file, or executable program.Connect-ExchangeOnline (PowerShell SDK)The term 'Connect-ExchangeOnline' is not recognized as the name of a cmdlet, function, script file, or operable program.PowerShell console
+ 7 more codes in the tables below.
How to read these errors#
- Install and load: messages from
Install-Module,Update-Moduleor PowerShell itself, before any connection exists. - Sign-in: a sign-in window error is a Microsoft Entra code (AADSTS). Those are covered in the MFA errors, Conditional Access blocks and, for app-only connections, app sign-in errors articles.
- Cmdlets: since version 3.0.0, every cmdlet uses REST API connections. Errors include the exception type, and the global variable
$EXO_LastExecutionStatus(3.3.0 and later) shows whether the last cmdlet succeeded.
Start every investigation with the module version, the connection and, if needed, a log:
PowerShell
Get-InstalledModule ExchangeOnlineManagement | Format-List Name, Version, InstalledLocation
Get-InstalledModule PackageManagement -AllVersions; Get-InstalledModule PowerShellGet -AllVersions
Get-ConnectionInformation | Format-List
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com -EnableErrorReporting -LogDirectoryPath C:\Temp\EXOLogs -LogLevel AllVersion rules that explain many "it worked yesterday" failures: module 3.10.0 and later need PowerShell 7.6 or later, versions 3.5.0 to 3.9.2 need 7.4 or later, and Windows PowerShell 5.1 runs every version (with .NET Framework 4.7.2). Preview versions of PackageManagement or PowerShellGet can also break connections.
Installing and loading the module#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
Files cannot be loaded because running scripts is disabled on this system. Provide a valid certificate with which to sign the files. | PowerShell refuses to run the module's scripts | The execution policy still blocks scripts, which is the default | Set-ExecutionPolicy RemoteSigned in an elevated session |
Cannot find a cmdlet Update-Manifest | Connecting needs PowerShellGet | PowerShellGet isn't installed (Windows) | Install or update PowerShellGet, then close and reopen PowerShell |
The specified module 'ExchangeOnlineManagement' with PowerShellGetFormatVersion '<version>' isn't supported by the current version of PowerShellGet. | PowerShellGet is too old for this module | Usually the old version that ships with Windows PowerShell 5.1 | Update PowerShellGet, reopen the window, then retry |
WARNING: Unable to download from URI 'https://go.microsoft.com/fwlink/?LinkID=627338&clcid=0x409' to ''. | PowerShellGet can't download its provider list | An old PowerShellGet; on older Windows, Windows PowerShell 5.1 not using TLS 1.2, which the PowerShell Gallery requires | Update PowerShellGet; apply Microsoft's PowerShell Gallery TLS guidance |
WARNING: Unable to download the list of available providers. Check your internet connection. | Logged with the line above | Same causes | Same fix |
No match was found for the specified search criteria and module name 'ExchangeOnlineManagement'. | The module can't be found in any registered repository | The PowerShell Gallery (PSGallery) isn't registered as the default repository | Get-PSRepository, then Register-PSRepository -Default |
The term 'Update-ModuleManifest' is not recognized as a name of a cmdlet, function, script file, or executable program. | Seen when connecting from code through the Windows PowerShell SDK | Loading format data in that host | Add -SkipLoadingFormatData to Connect-ExchangeOnline |
The term 'Connect-ExchangeOnline' is not recognized as the name of a cmdlet, function, script file, or operable program. | PowerShell can't find the module | Not installed, or installed for another account or for the current user in the other PowerShell edition | Get-InstalledModule ExchangeOnlineManagement in this window; install with -Scope CurrentUser |
Connecting and signing in#
Since October 2023, Exchange Online PowerShell accepts only REST API connections. Scripts that still build a remote PowerShell session with New-PSSession, or run very old module versions, fail with the errors below. The fix is the same for all of them: a current module and Connect-ExchangeOnline instead of session code (see Exchange Online PowerShell V3: connect and automate). The UseRpsSession parameter was deprecated in version 3.9.2.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
[outlook.office365.com] Connecting to remote server failed with the following error message: Access is denied. | The remote PowerShell sign-in was refused | Wrong credentials, an account without Exchange Online access, or security defaults blocking the old sign-in | Use Connect-ExchangeOnline with modern authentication |
Import-PSSession : Cannot validate argument on parameter 'Session'. The argument is null. | Follows the row above: no session was created | The failed New-PSSession | Fix the connection, not this line |
The WinRM client cannot process the request | WinRM on the client won't use Basic authentication | The old remote PowerShell method needed Basic authentication in WinRM | REST connections don't need it: switch to the module |
Cannot invoke the pipeline because the runspace isn't in the Opened state. Current state of the runspace is 'Closed'. | A piped command ran against a closed session | An authentication bug in early module versions | Update-Module ExchangeOnlineManagement; current versions don't open a runspace |
Three sign-in problems have no single error text:
- Only one admin can't connect. Check whether PowerShell access was turned off for that account:
Get-User -Identity admin@contoso.com | Format-List EXOModuleEnabled, and have another admin runSet-User -Identity admin@contoso.com -EXOModuleEnabled $true. - The sign-in window fails or hangs. Version 3.7.0 added Web Account Manager (WAM) to the sign-in flow. For WAM-related errors, add
-DisableWAM(3.7.2 and later); on a machine without a browser, use-Devicein PowerShell 7. - Linux or macOS.
Connect-IPPSSessionisn't available in PowerShell 7 on either, and on Ubuntu 20.04 module versions 3.7.0 to 3.9.2 might fail with SSL protocol errors. For Security & Compliance PowerShell, see Connect-IPPSSession errors.
App-only (certificate) connections#
Unattended scripts fail for setup reasons more than for code reasons. Before you debug the script, confirm each item Microsoft lists:
- The app has the Office 365 Exchange Online › Exchange.ManageAsApp application permission, with admin consent granted.
- The app holds a supported Microsoft Entra role (for example Exchange Administrator, Exchange Recipient Administrator or Global Reader), or its service principal is in a custom role group (
New-ServicePrincipal, thenAdd-RoleGroupMember). Without one, the session has no permissions. - The certificate uses a CSP key, not a Cryptography Next Generation (CNG) key, which is the default in modern Windows. Create it with
New-SelfSignedCertificate ... -KeySpec KeyExchange. -CertificateThumbprintworks only on Windows, with the certificate in the user certificate store.-Organizationis the primary.onmicrosoft.comdomain.- The script doesn't call
New-UnifiedGroup,Remove-UnifiedGroup,Add-UnifiedGroupLinksorRemove-UnifiedGroupLinks, which don't support app-only authentication; use Microsoft Graph instead.
Running cmdlets#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
The operation couldn't be performed because object '<identity>' couldn't be found on '<server>'. (ManagementObjectNotFoundException) | The identity didn't resolve to an object of the type the cmdlet expects | A typo, the wrong cmdlet for the recipient type (for example Get-Mailbox for a mail user), or an object that hasn't synced yet | Get-Recipient '<identity>' | Format-List Name, RecipientTypeDetails |
The term 'Get-Mailbox' is not recognized as the name of a cmdlet (after connecting) | That cmdlet isn't loaded in your session | The connection dropped, -CommandName limited what was imported, or none of your roles include the cmdlet | Get-ConnectionInformation; Get-ManagementRole -Cmdlet Get-Mailbox to see which roles grant it |
The data in the command exceeded the maximum permitted by the session configuration. The allowed maximum is 500MB. | Too much data for one remote PowerShell command | Get-Mailbox -ResultSize Unlimited in a very large organization over the old session | Use Get-EXOMailbox with -PropertySets or -Properties to return only what you need |
Limits and throttling in REST connections#
- REST cmdlets retry transient failures themselves, but each cmdlet times out after 15 minutes. Microsoft's example is
Update-DistributionGroupMemberwith 10,000 members: update about half, then add the rest one by one withAdd-DistributionGroupMember. Invoke-Commanddoesn't work against REST connections, andGet-PSSessionshows nothing: useGet-ConnectionInformation.- Calling
Connect-ExchangeOnlineandDisconnect-ExchangeOnlinerepeatedly in one session can leak memory. Connect once and use-CommandNameto import only the cmdlets the script needs. - For loops over thousands of objects, use the
Get-EXO*cmdlets for reads, and add a shortStart-Sleepbetween per-object calls, as Microsoft's workaround for large queries does. Get-Helpshows little since 3.7.0, because help isn't loaded by default: add-LoadCmdletHelpwhen you connect.
How to verify a fix#
PowerShell
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com -ShowBanner:$false
Get-ConnectionInformation | Format-List
Get-EXOMailbox -ResultSize 1 | Format-List DisplayName, PrimarySmtpAddress
$EXO_LastExecutionStatus
Disconnect-ExchangeOnline -Confirm:$false- The connection appears in
Get-ConnectionInformationwith the expected account or app ID and organization. - A read returns data and the failing cmdlet now runs; for app-only scripts, run the scheduled task once by hand and check its output.
- After module updates,
Get-InstalledModuleshows one current version in the scope you use.
References#
- About the Exchange Online PowerShell module (Microsoft Learn): prerequisites, install errors, REST connections and release notes
- App-only authentication for unattended scripts and Enable or disable access to Exchange Online PowerShell (Microsoft Learn)
- Access is denied when you connect to Exchange Online and Data in the command exceeded the maximum permitted (Microsoft Learn)
