M365-002 · Script
Bulk Tenant Configuration
Checks a Microsoft 365 tenant against a security baseline and optionally applies it.
What it does
Each baseline setting is checked and reported as Compliant or Needs change. In Apply mode, settings that need a change are set, then checked again. Settings (choose with -Settings; default is all):
- SmtpAuthOff: Turn off basic SMTP AUTH sending for the whole organization
- ModernAuthOn: Make sure modern authentication is on for Outlook
- MailboxAuditOn: Keep mailbox auditing on by default
- UnifiedAuditOn: Turn on the unified audit log
- BlockAutoForward: Block automatic forwarding to outside addresses (outbound spam policy)
RemoteDomainForward Block auto-forwarding on the default remote domain
- ExternalTagOn: Show the "External" sender tag in Outlook
With -DisablePopImap, POP and IMAP are also turned off for every mailbox that has them on, except mailboxes listed in -PopImapExceptions. Preview mode (default) reports only.
Requirements
ExchangeOnlineManagement module, installed by you from the PowerShell Gallery (not included). App registration with Exchange.ManageAsApp and the Exchange Administrator role. Windows PowerShell 5.1 or PowerShell 7.
How to run it
- Run from: an admin workstation or scheduled task with the Microsoft modules installed and app sign-in configured
- This is an admin script for your Microsoft 365 tenant, not a per-device endpoint script
- User interaction: none with app-only sign-in
- Schedule: run on demand, or weekly for reports
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Preview = report only (default). Apply = make the changes. | Preview, Apply | Preview |
| Settings | Which settings to check. Default: all of them. | SmtpAuthOff, ModernAuthOn, MailboxAuditOn, UnifiedAuditOn, BlockAutoForward, RemoteDomainForward, ExternalTagOn | SmtpAuthOff, ModernAuthOn, MailboxAuditOn, UnifiedAuditOn, BlockAutoForward, RemoteDomainForward, ExternalTagOn |
| DisablePopImap | Also check (and in Apply mode, turn off) POP and IMAP on all mailboxes. | False | |
| PopImapExceptions | Mailboxes (UPNs) that keep POP/IMAP, such as a scanner or ticketing mailbox. | (none) | |
| ClientId | Application (client) ID of your app registration. | ||
| CertificateThumbprint | Thumbprint of the certificate uploaded to the app registration. | ||
| Organization | Your tenant's onmicrosoft.com name, for example contoso.onmicrosoft.com | ||
| UseExistingSession | Use an Exchange Online session you already opened with Connect-ExchangeOnline. | False |
Exit codes
- 0 = All checked settings compliant (or all changes applied)
- 1 = One or more settings need a change, or a change failed
- 2 = Script error (see log)
Testing steps
- Run it first with the mode set to Preview on one test account or small group. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Preview mode changes nothing and records each current value. Set any setting back in the Exchange admin center or with the matching Exchange Online command.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |