Microsoft Office 365 Powershell Cmdlets

Front 1

Convert-MsolFederatedUser

Back 1

Convert-MsolFederatedUser The Convert-MsolFederatedUser cmdlet is used to update a user in a domain that was recently converted from single sign-on (also known as identity federation) to standard authentication type. A new password must be provided for the user.

Front 2

Get-MsolUser

Back 2

The Get-MsolUser cmdlet can be used to retrieve an individual user, or list of users. An individual user will be retrieved if the ObjectId or UserPrincipalName parameter is used.

Front 3

New-MsolUser

Back 3

The New-MsolUser cmdlet is used to create a new user in the Microsoft Online directory. In order to give the user access to services, they must also be assigned a license (using the LicenseAssignment parameter).

Front 4

Remove-MsolUser

Back 4

The Remove-MsolUser cmdlet is used to remove a user from the Microsoft Online directory. This cmdlet will delete the user, their licenses, and any other associated data

Front 5

Restore-MsolUser

Back 5

The Restore-MsolUser cmdlet restores a user that is in the Deleted users view to their original state. Users will remain in the Deleted users view for 30 days.

Front 6

Set-MsolUser

Back 6

The Set-MsolUser cmdlet is used to update a user object. Note that this cmdlet should be used for basic properties only. The licenses, password, and User Principal Name for a user can be updated through Set-MsolUserLicense, Set-MsolUserPassword and Set-MsolUserPrincipalName cmdlets respectively

Front 7

Set-MsolUserPassword

Back 7

The Set-MsolUserPassword cmdlet is used to change the password of a user. This cmdlet can only be used for users with standard identities

Front 8

Set-MsolUserPrincipalName

Back 8

The Set-MsolUserPrincipalName cmdlet is used to change the User Principal Name (user ID) of a user. This cmdlet can be used to move a user between a federated and standard domain, which will result in their authentication type changing to that of the target domain.

Front 9

Set-MsolPasswordPolicy

Back 9

The Set-MsolPasswordPolicy cmdlet can be used to update the password policy of a specified domain or tenant. Two settings are required, the first is to indicate the length of time that a password remains valid before it must be changed and the second is to indicate the number of days before the password expiration date that will trigger when users will receive their first notification that their password will soon expire

Front 10

Get-MsolPasswordPolicy

Back 10

The Get-MsolPasswordPolicy cmdlet can be used to retrieve the values associated with the Password Expiry window or Password Expiry Notification window for a tenant or specified domain. When a domain name is specified, it must be a verified domain for the company.

Front 11

Add-MsolGroupMember

Back 11

The Add-MsolGroupMember cmdlet is used to add members to a security group. The new members can be either users or other security groups.

Front 12

Get-MsolGroup

Back 12

The Get-MsolGroup cmdlet is used to retrieve groups from Office 365. This cmdlet can be used to return a single group (if ObjectId is passed in), or to search within all groups.

Front 13

Get-MsolGroupMember

Back 13

The Get-MsolGroupMember cmdlet is used to retrieve members of the specified group. The members can be either users or groups.

Front 14

New-MsolGroup

Back 14

The New-MsolGroup cmdlet is used to add a new security group to the Microsoft Online directory.

Front 15

Remove-MsolGroup

Back 15

The Remove-MsolGroup cmdlet is used to delete a group from the Microsoft Online directory.

Front 16

Remove-MsolGroupMember

Back 16

The Remove-MsolGroupMember cmdlet is used to remove a member from a security group. This member can be either a user or a group.

Front 17

Set-MsolGroup

Back 17

The Set-MsolGroup cmdlet is used to update the properties of a security group

Front 18

Add-MsolRoleMember

Back 18

The Add-MsolRoleMember cmdlet is used to add a member to a role. Currently, only users can be added to a role (adding a security group is not supported).

Front 19

Get-MsolRole

Back 19

The Get-MsolRole cmdlet can be used to retrieve a list of administrator roles.

Front 20

Get-MsolUserRole

Back 20

The Get-MsolUserRole cmdlet is used to retrieve all of the administrator roles that the specified user belongs to. This cmdlet will also return roles that the user is a member of through security group membership.

Front 21

Get-MsolRoleMember

Back 21

The Get-MsolRoleMember cmdlet is used to retrieve all members of the specified role.

Front 22

Remove-MsolRoleMember

Back 22

The Remove-MsolRoleMember cmdlet is used to remove a user from an administrator role.

Front 23

Set-MsolServicePrincipal

Back 23

The Set-MsolServicePrincipal cmdlet updates a service principal in the Microsoft Online directory. It can be used to update the display name, enable/disable the service principal, trusted for delegation, the service principal names (SPNs) or the addresses.

Front 24

New-MsolServicePrincipal

Back 24

The New-MsolServicePrincipal cmdlet creates a service principal that can be used to represent a Line Of Business (LOB) application or an on-premises server such as Microsoft Exchange, SharePoint or Lync in the Microsoft Online directory as "service principal" objects. Adding a new application as a service principal allows that application to authenticate to other services such as Microsoft Office 365.

Front 25

Get-MsolServicePrincipal

Back 25

The Get-MsolServicePrincipal cmdlet can be used to retrieve a service principal or a list of service principals from the Microsoft Online directory.

Front 26

Remove-MsolServicePrincipal

Back 26

The Remove-MsolServicePrincipal cmdlet removes a service principal from the Microsoft Online directory.

Front 27

New-MsolServicePrincipalAddress

Back 27

The New-MsolServicePrincipalAddress cmdlet creates a new service principal address object that can be used to update the addresses for a service principal.

Front 28

Get-MsolServicePrincipalCredential

Back 28

The Get-MsolServicePrincipalCredential cmdlet can be used to retrieve a list of credentials associated with a service principal.

Front 29

New-MsolServicePrincipalCredential

Back 29

The New-MsolServicePrincipalCredential cmdlet can be used to add a new credential to a service principal or to add or roll credential keys for an application. The service principal is identified by supplying either the object ID, application ID, or service principal name (SPN).

Front 30

Remove-MsolServicePrincipalCredential

Back 30

The Remove-MsolServicePrincipalCredential cmdlet can be used to remove a credential key from a service principal in the case of a compromise or as part of credential key rollover expiration. The service principal is identified by supplying either the object ID, application ID, or service principal name (SPN). The credential to be removed is identified by its key ID.

Front 31

Confirm-MsolDomain

Back 31

The Confirm-MsolDomain cmdlet is used to confirm ownership of a domain. In order to confirm ownership, a custom TXT DNS record must be added for the domain. The domain must first be added using the Add-MsolDomain cmdlet, and then the Get-MsolDomainVerificationDNS cmdlet should be called to retrieve the details of the DNS record that must be set.Note that there may be a delay (15 to 60 minutes) between when the DNS update is made and when the cmdlet is able to confirm ownership of a domain.

Front 32

Get-MsolDomain

Back 32

The Get-MsolDomain cmdlet is used to retrieve company domains.

Front 33

Get-MsolDomainVerificationDns

Back 33

The Get-MsolDomainVerificationDns cmdlet is used to return the DNS records that need to be set to verify a domain.

Front 34

New-MsolDomain

Back 34

The New-MsolDomain cmdlet is used to create a new domain object. This cmdlet can be used to create a domain with managed or federated identities, although the New-MsolFederatedDomain cmdlet should be used for federated domains in order to ensure proper setup.

Front 35

Remove-MsolDomain

Back 35

The Remove-MsolDomain cmdlet is used to delete a domain from the Microsoft Online directory. The domain being deleted must be empty; that is, there cannot be any users or groups with email addresses in this domain.

Front 36

Set-MsolDomain

Back 36

The Set-MsolDomain cmdlet is used to update settings for a domain. Using this cmdlet, the default domain can be changed, or the capabilities (Email, Sharepoint, OfficeCommunicationsOnline) can be changed.

Front 37

Set-MsolDomainAuthentication

Back 37

The Set-MsolDomainAuthentication cmdlet is used to change the domain authentication between standard identity and single sign-on. This cmdlet will only update the settings in Office 365; typically the Convert-MsolDomainToStandard or Convert-MsolDomainToFederated should be used instead.

Front 38

New-MsolFederatedDomain

Back 38

The New-MsolFederatedDomain cmdlet adds a new single sign-on domain (also known as identity-federated domain) to Office 365 and configures the relying party trust settings between the on-premises Active Directory Federation Services 2.0 server and Office 365. Due to domain verification requirements, you may need to run this cmdlet several times in order to complete the process of adding the new single sign-on domain.

Front 39

Convert-MsolDomainToStandard

Back 39

The Convert-MsolDomainToStandard cmdlet converts the specified domain from single sign-on (also known as identity federation) to standard authentication. This process also removes the relying party trust settings in the Active Directory Federation Services 2.0 server and Office 365. After the conversion, this cmdlet will convert all existing users from single sign-on to standard authentication. Any existing user who was configured for single sign-on will be given a new temporary password as part of the conversion process. Each converted user name and new temporary password will be recorded in a file for reference by the administrator. The administrator can then distribute the new temporary password to each converted user to enable the user to sign in to Office 365.

Front 40

Convert-MsolDomainToFederated

Back 40

The Convert-MsolDomainToFederated cmdlet converts the specified domain from standard authentication to single sign-on (also known as identity federation), including configuring the relying party trust settings between the Active Directory Federation Services 2.0 server and Office 365. As part of converting a domain from standard authentication to single sign-on, each user must also be converted. This conversion happens automatically the next time a user signs in; no action is required by the administrator.

Front 41

Get-MsolFederationProperty

Back 41

The Get-MsolFederationProperty cmdlet gets key settings from both the Active Directory Federation Services 2.0 server and Office 365. You can use this information to troubleshoot authentication problems caused by mismatched settings between the Active Directory Federation Services 2.0 server and Office 365.

Front 42

Get-MsolDomainFederationSettings

Back 42

The Get-MsolDomainFederationSettings cmdlet gets key settings from Office 365. Use the Get-MsolFederationProperty cmdlet to get settings for both Office 365 and the Active Directory Federation Services server.

Front 43

Remove-MsolFederatedDomain

Back 43

The Remove-MsolFederatedDomain cmdlet removes the specified single sign-on domain from Office 365 and the associated relying party trust settings in Active Directory Federation Services 2.0. Note: If the domain specified has objects associated with it, you will not be able to remove the domain.

Front 44

Set-MsolDomainFederationSettings

Back 44

The Set-MsolDomainFederationSettings cmdlet is used to update the settings of a single sign-on domain.

Front 45

Set-MsolADFSContext

Back 45

The Set-MsolADFSContext cmdlet sets the credentials to connect to Office 365 and to the Active Directory Federation Services 2.0 (AD FS 2.0) server. This cmdlet must be run before making other single sign-on (also known as identity federation) cmdlet calls. If this cmdlet is called without parameters, the user will be prompted for credentials to connect to the different systems. When the AD FS 2.0 server is used remotely, the user must specify the computer name of the primary AD FS 2.0 server. Note that the specified logfile is shared by all single sign-on cmdlets for the session. A default logfile is created if one is not specified.

Front 46

Update-MsolFederatedDomain

Back 46

The Update-MsolFederatedDomain cmdlet changes settings in both the Active Directory Federation Services 2.0 server and Office 365. It is necessary to run this cmdlet whenever the URLs or certificate information within Active Directory Federation Services 2.0 change due to configuration changes or through regular maintenance of the certificates, such as when a certificate is about to expire. This cmdlet should also be run when changes occur in Office 365. To confirm that the information in the two systems is correct, the Get-MsolFederationProperty cmdlet can be used to retrieve the settings.

Front 47

Get-MsolSubscription

Back 47

The Get-MsolSubscription cmdlet returns all the subscriptions that the company has purchased. When assigning licenses to users, the Get-MsolAccountSku API should be used instead.

Front 48

Get-MsolAccountSku

Back 48

The Get-MsolAccountSku will return all the SKUs that the company owns.

Front 49

New-MsolLicenseOptions

Back 49

The New-MsolLicenseOptions cmdlet creates a new License Options object. This cmdlet disables specific service plans when assigning a user a license using the Add-MsolUser and Set-MsolUserLicense cmdlets.

Front 50

Set-MsolUserLicense

Back 50

The Set-MsolUserLicense cmdlet can be used to adjust the licenses for a user. This can include adding a new license, removing a license, updating the license options, or any combination of these actions.

Front 51

Connect-MsolService

Back 51

The Connect-MsolService cmdlet will attempt to initiate a connection to Office 365. The caller must either provide their credential (a PSCredential object), or use the UseCurrentCredential option if the current logged in user is federated with Office 365. This cmdlet may return a warning or error if the version of the module being used is out of date.

Front 52

Set-MsolDirSyncEnabled

Back 52

The Set-MsolDirSyncEnabled cmdlet is used to turn directory synchronization on or off for a company.

Front 53

Get-MsolPartnerContract

Back 53

The Get-MsolPartnerContract cmdlet should only be used by partners, as it is used to retrieve a list of contracts for a partner. The input to this cmdlet should be a domain to look up, which must be verified for the tenant. If the company exists and the partner has access to this company, then the corresponding contract will be returned.

Front 54

Get-MsolPartnerInformation

Back 54

The Get-MsolPartnerInformation cmdlet is used to retrieve partner-specific information. This cmdlet should only be used for partner tenants.

Front 55

Set-MsolPartnerInformation

Back 55

The Set-MsolPartnerInformation cmdlet is used by partners to set partner-specific properties. These properties will be viewable by all tenants that the partner has access to.

Front 56

Get-MsolContact

Back 56

The Get-MsolContact cmdlet can be used to retrieve a contact object, or list of contacts. A single contact will be retrieved if the ObjectId parameter is used.

Front 57

Remove-MsolContact

Back 57

The Remove-MsolContact cmdlet is used to delete a contact from the Microsoft Online directory

Front 58

Get-MsolCompanyInformation

Back 58

The Get-MsolCompanyInformation cmdlet will retrieve company-level information.

Front 59

Set-MsolCompanyContactInformation

Back 59

The Set-MsolCompanyContactInformation cmdlet is used to set company-level contact preferences. This includes email addresses for billing, marketing, and technical notifications about Office 365.

Front 60

Set-MsolCompanySettings

Back 60

The Set-MsolCompanySettings cmdlet is used to set company-level configuration settings.

Front 61

Redo-MsolProvisionContact

Back 61

The Redo-MsolProvisionContact cmdlet can be used to retry the provisioning of a contact object in the Microsoft Online directory when a previous attempt to create the contact object resulted in an error.

Front 62

Redo-MsolProvisionGroup

Back 62

The Redo-MsolProvisionGroup cmdlet can be used to retry the provisioning of a group object in the Microsoft Online directory when a previous attempt to create the group object resulted in an error.

Front 63

Redo-MsolProvisionUser

Back 63

The Redo-MsolProvisionUser cmdlet can be used to retry the provisioning of a user object in the Microsoft Online directory when a previous attempt to create the user object resulted in an error.