Allow Quarantined Exchange Online Devices Using PowerShell and CSV
Question details
The user wants to approve quarantined Exchange Online mobile devices in bulk using a CSV file with an Identity column.
- Product
- Microsoft Exchange Online
- Device & OS
- not provided
- Scenario
- An administrator has a list of approved mailbox users and wants to automate Exchange ActiveSync device approval instead of processing each mailbox manually.
- Observed behavior
- The intended result is to allow the approved quarantined devices associated with the mailboxes listed in the CSV.
Prepare a CSV with an Identity header and one mailbox email address per row, and use an account with permission to run Get-MobileDevice and Set-CASMailbox in Exchange Online. Confirm which devices are approved: the bulk example below allows every currently quarantined ActiveSync device found for each listed mailbox.
Approve quarantined ActiveSync devices for mailboxes listed in a CSV
Use Exchange Online PowerShell to resolve each mailbox Identity to quarantined devices, then add their device IDs to the mailbox's ActiveSync allow list.
The CSV Identity value identifies a mailbox, not a mobile device. Device approval requires the DeviceId returned by Get-MobileDevice; the script adds those IDs with Set-CASMailbox rather than replacing the existing allow list.
In a spreadsheet editor or text editor, create C:\Temp\approved-users.csv with the following structure: Identity approved.user@contoso.com another.user@contoso.com Replace the example addresses with actual mailbox identities. Remove duplicate rows and blank identities.
Open PowerShell. If the Exchange Online module is not installed, run: Install-Module ExchangeOnlineManagement -Scope CurrentUser Then connect with your administrator account: Import-Module ExchangeOnlineManagement Connect-ExchangeOnline -UserPrincipalName admin@contoso.com
Run the following commands with one approved mailbox: $identity = 'approved.user@contoso.com' $devices = @(Get-MobileDevice -Mailbox $identity | Where-Object { $_.DeviceAccessState -eq 'Quarantined' }) $devices | Format-Table Identity, DeviceId, DeviceType, DeviceAccessState Review the listed devices. If all are approved, run: foreach ($device in $devices) { Set-CASMailbox -Identity $identity -ActiveSyncAllowedDeviceIDs @{Add = $device.DeviceId} -ErrorAction Stop } If only selected devices are approved, narrow $devices to those DeviceId values before running the loop.
After the single-mailbox test succeeds, run this script. It validates the CSV header, skips empty identities, and reports errors by mailbox: $rows = @(Import-Csv -Path 'C:\Temp\approved-users.csv') if ($rows.Count -eq 0 -or $rows[0].PSObject.Properties.Name -notcontains 'Identity') { throw 'The CSV must contain an Identity column and at least one data row.' } foreach ($row in $rows) { $identity = ([string]$row.Identity).Trim() if ([string]::IsNullOrWhiteSpace($identity)) { continue } try { $devices = @(Get-MobileDevice -Mailbox $identity -ErrorAction Stop | Where-Object { $_.DeviceAccessState -eq 'Quarantined' }) foreach ($device in $devices) { Set-CASMailbox -Identity $identity -ActiveSyncAllowedDeviceIDs @{Add = $device.DeviceId} -ErrorAction Stop Write-Host "Added device $($device.DeviceId) to the allow list for $identity" } if ($devices.Count -eq 0) { Write-Host "No quarantined devices found for $identity" } } catch { Write-Warning "Failed for ${identity}: $($_.Exception.Message)" } }
For a processed mailbox, run: Get-CASMailbox -Identity 'approved.user@contoso.com' | Format-List ActiveSyncAllowedDeviceIDs, ActiveSyncBlockedDeviceIDs Ask the user to retry synchronization, then check: Get-MobileDevice -Mailbox 'approved.user@contoso.com' | Format-Table DeviceId, DeviceAccessState, DeviceAccessStateReason When finished, run Disconnect-ExchangeOnline -Confirm:$false.
Prepare Your Exchange Online Approval CSV with WPS Spreadsheet
WPS Office is a free, lightweight Microsoft Office alternative with a familiar spreadsheet interface and support for Excel formats. Use WPS Spreadsheet to review mailbox identities and prepare the CSV, then run device approval separately in Exchange Online PowerShell.
Frequently Asked Questions
What should the CSV Identity column contain?
For the script on this page, use mailbox email addresses or other mailbox identities accepted by Get-MobileDevice -Mailbox and Set-CASMailbox -Identity. Do not put mobile device IDs in this column; the script retrieves those separately.
Does listing a mailbox approve all of its mobile devices?
The bulk script approves every currently quarantined ActiveSync device returned for that mailbox. It does not approve devices that enroll later. If approval applies only to specific devices, review Get-MobileDevice output and filter by the approved DeviceId values before running Set-CASMailbox.
Will this script replace existing allowed device IDs?
No. Set-CASMailbox -ActiveSyncAllowedDeviceIDs @{Add = $device.DeviceId} adds an ID to the existing collection. Supplying a replacement list instead of the Add syntax could overwrite existing entries.
How do I create the CSV in WPS Spreadsheet?
Open WPS Spreadsheet, enter Identity in cell A1, and enter one mailbox email address in each row below it. Choose Menu > Save As and select CSV as the file type. Export the sheet containing the mailbox list, then confirm that Import-Csv reads an Identity property before running the approval script.
Where can I get help if the PowerShell script fails?
First check the reported mailbox error, confirm your Exchange Online connection, and verify permissions for Get-MobileDevice and Set-CASMailbox. For script syntax or loop troubleshooting, post the relevant code and sanitized error message in Microsoft's PowerShell support community; do not include credentials or sensitive mailbox data.
