MFA Security Issues

Will Exchange Online PowerShell Require MFA After 2025?

John Wilson Sep 27, 2026 869 views

Question details

Microsoft 365 administrators are seeking clarity on whether Exchange Online PowerShell cmdlets will be subject to mandatory multifactor authentication (MFA) enforcement starting in 2025.

Will Exchange Online PowerShell Require MFA After 2025?

Product: Exchange Online
Device & OS: not provided
Scenario: Administrators managing Microsoft 365 environments via automated or interactive Exchange Online PowerShell scripts.
Observed behavior: Users need to know how the expanding Microsoft Entra MFA enforcement will impact their administrative tools to avoid disruptions in PowerShell connectivity and script execution.

Before you start

Verify that you have administrative access to the Microsoft Entra admin center and review your organization's current Conditional Access policies for administrative roles.

Solution 1Recommended

Transition to Modern and Certificate-Based Authentication

Prepare for Microsoft Entra's mandatory MFA rollout by migrating your administrative scripts to non-interactive modern authentication methods like Certificate-Based Authentication (CBA).

While Microsoft began gradually enforcing MFA for Azure sign-ins and tools like Azure CLI in early 2025, the enforcement for specific services like Exchange Online PowerShell depends on the authentication flow.

Interactive log-ins will increasingly require MFA. To ensure automated administrative tasks continue running without interruption, administrators must transition from legacy authentication to modern, secure application-based authentication.

Monitor Entra Announcements

Regularly check the Microsoft Entra admin center and Microsoft 365 Message Center for specific rollout dates regarding mandatory MFA for PowerShell and administrative cmdlets in your tenant.

Update Exchange Online Modules

Ensure all administrators and server environments are running the latest Exchange Online PowerShell V3 module (EXO V3), which natively supports modern authentication and REST APIs.

Implement Certificate-Based Authentication

For unattended scripts, configure App-Only authentication using certificates in Microsoft Entra ID. Register an application, assign the necessary Exchange permissions (like Exchange.ManageAsApp), and generate a certificate to authenticate without interactive MFA prompts.

App-Only Authentication: Using App-Only authentication with a certificate is Microsoft's recommended method for automated scripts, as it securely bypasses the need for a user identity and interactive MFA.

Solution 2

Configure Conditional Access for Administrative Tools

Use Microsoft Entra Conditional Access policies to manage and test how MFA requirements affect your administrators before global enforcement takes effect.

Free Microsoft Office alternative

Simplify Your Document Management with WPS Office

While Microsoft 365 administrators navigate complex authentication updates and PowerShell script migrations, everyday users can enjoy a straightforward, lightweight productivity experience with WPS Office. It provides robust capabilities and familiar interfaces without administrative overhead.

1. Download the Installer: Visit the official WPS Office website to download the free, lightweight installer tailored for your operating system.
2. Install the Application: Run the executable file to install the all-in-one suite containing Writer, Spreadsheets, Presentation, and PDF tools.
3. Open Your Office Files: Double-click your existing Microsoft Office documents to instantly open them in WPS Office with seamless formatting preservation.

Fully compatible with Microsoft Word, Excel, and PowerPoint (.docx, .xlsx, .pptx) formats.Lightweight software footprint with lightning-fast startup times.Built-in robust PDF editing, merging, and signing capabilities.Familiar ribbon interface requiring zero learning curve for Office users.

microsoft office alternative - wps office

Frequently Asked Questions

Why is Microsoft enforcing MFA for PowerShell tools?

Microsoft is enforcing mandatory MFA across Azure and Microsoft Entra ID management tools to enhance security, significantly reducing the risk of administrative accounts being compromised by phishing or credential stuffing attacks.

Can I still use basic authentication with Exchange Online PowerShell?

No. Microsoft has officially deprecated and disabled basic authentication for Exchange Online. Administrators must use modern authentication (OAuth 2.0), which natively integrates with MFA and Conditional Access.

How do automated PowerShell scripts authenticate if interactive MFA is required?

Unattended or automated scripts cannot use interactive MFA. Instead, you must use Service Principals with Certificate-Based Authentication (CBA) or Managed Identities. These methods provide secure, non-interactive authentication for automated tasks.

Will my older Exchange PowerShell modules still work in 2025?

Older modules that rely on remote PowerShell (RPS) or basic authentication are no longer supported. You must upgrade to the Exchange Online Management module V3 (EXO V3) which utilizes REST API connections.

Microsoft Office Security Issues