Skip to main content
This tool lets a Neo Agent generate and run validated PowerShell against Exchange — Exchange Online for cloud tenants, or on-prem Exchange Server via your RMM. It covers the full range of mailbox, recipient, mail-flow, and compliance operations.
Enabled automatically when you turn on Exchange permissions on the agent’s Tools & Settings tab, under Identity & Workspace — there’s no separate toggle in the tool list. See Microsoft 365 integration.

​
What It Does

  • Manage mailboxes — properties, statistics, diagnostic logs, shared mailboxes, archive settings
  • Cancel the future meetings of a user who leaves
  • Configure mailbox permissions — full access, send-as, send-on-behalf, delegation
  • Set up and remove email forwarding
  • Manage recipients, contacts, and distribution groups
  • Configure mail flow — transport rules, connectors, address lists, retention policies
  • Configure email security — quarantine policies, preset security policies (Defender for Office 365), the External sender tag, phishing simulation overrides, and how users report messages
  • Find users that Microsoft restricted from sending email for outbound spam, and remove the restriction
  • Read the email security reports of Defender for Office 365 and Exchange Online Protection: spam, phishing and malware counts (the Threat protection status and Mailflow status reports), zero-hour auto purge, Safe Links, spoofing and compromised users. See Monthly email security report per client
  • Run Exchange Online compliance and auditing operations, such as retention policies and audit log searches
  • Handle bulk operations across many mailboxes or recipients
This tool does not run content search and purge (New-ComplianceSearch, New-ComplianceSearchAction and the other *-ComplianceSearch cmdlets), eDiscovery cases (*-ComplianceCase) or DLP compliance rules (*-DlpComplianceRule). In Exchange Online these run only in Security & Compliance PowerShell, which this tool does not connect to.To remove an email, the agent deletes it in each recipient’s mailbox through Microsoft Graph, when its Microsoft Graph permissions allow mail writes. A purge across the whole tenant stays with a technician in Microsoft Purview or Microsoft Defender.

​
Safety

​
How to Configure

1

Connect Microsoft 365

Connect your tenant (cloud) or on-prem environment. Exchange Server runs through your RMM.
2

Enable Exchange permissions

On the agent’s Tools & Settings tab, click Identity & Workspace, expand Exchange (Online/Cloud and On-Prem) and set the Exchange permission groups (mailboxes, permissions, recipients, distribution groups, mail flow, address lists, compliance) to Read Only or Read / Write.
3

Set approval and cmdlet limits

Decide whether writes require technician approval on each permission group. To limit the cmdlets, use the two pickers above the Exchange permission groups:
  • Allowed cmdlets: when you pick any, the agent can run only those. Also pick the helper cmdlets its scripts need, such as Select-Object. Leave it empty to allow every supported cmdlet. When a script needs a cmdlet that is not on the list, the agent is told the list, rewrites the script with it, and names in its report any cmdlet it still needs.
  • Blocked cmdlets: the agent can never run these, even when a permission group or the allowed list includes them.
The pickers show while at least one permission group is on.
Use this for Exchange operations the higher-level Microsoft 365 tools don’t cover — detailed mailbox statistics, transport rules, retention policies, or bulk recipient changes.