What stopped working, what replaced it, and the behaviour differences that bite during migration. Written for MSP helpdesk and admin engineers maintaining scripts across many tenants.
Microsoft has spent the last few years retiring entire layers of its PowerShell tooling: basic-auth remoting into Exchange Online, the RPS-backed cmdlets behind it, the MSOnline and AzureAD modules, and a steady list of individual cmdlets inside Exchange Online itself. Scripts that ran for years now fail with errors that rarely say "this cmdlet was deprecated", which is why a working knowledge of the replacements matters more than the deprecation announcements themselves.
The table below is the quick lookup. The sections after it explain each migration with working examples, because most replacements are not drop-in: parameters change, output shapes change, and a few familiar tricks stop working entirely.
Type to filter. Matches old and new cmdlet names and notes.
| Deprecated / retired | Use instead | Notes |
|---|---|---|
| Get-MessageTrace | Get-MessageTraceV2 | V2 reaches back 90 days. No -Page parameter and no -Subject parameter; see the message trace section. |
| Get-MessageTraceDetail | Get-MessageTraceDetailV2 | Pairs with Get-MessageTraceV2 output. |
| Search-AdminAuditLog | Search-UnifiedAuditLog | Admin audit events now live in the unified audit log. |
| Search-MailboxAuditLog | Search-UnifiedAuditLog | Use -RecordType ExchangeItem and related record types. |
| Get-Mailbox | Get-EXOMailbox | REST-backed, faster at scale. Returns a reduced default property set; request more with -Properties or -PropertySets. |
| Get-MailboxStatistics | Get-EXOMailboxStatistics | Same idea: faster, leaner default output. |
| Get-MailboxFolderStatistics | Get-EXOMailboxFolderStatistics | |
| Get-MailboxPermission | Get-EXOMailboxPermission | |
| Get-MailboxFolderPermission | Get-EXOMailboxFolderPermission | |
| Get-RecipientPermission | Get-EXORecipientPermission | |
| Get-Recipient | Get-EXORecipient | |
| Get-CASMailbox | Get-EXOCASMailbox | |
| Get-MobileDeviceStatistics | Get-EXOMobileDeviceStatistics | The old cmdlet never supported -ResultSize Unlimited, despite what old forum posts claim. |
| New-PSSession to outlook.office365.com | Connect-ExchangeOnline | Basic-auth WinRM remoting is gone. EXO V3 module connects over REST. |
| Connect-EXOPSSession | Connect-ExchangeOnline | V1 module helper, long retired. |
| Connect-MsolService | Connect-MgGraph | MSOnline module is retired. Request scopes explicitly at connect time. |
| Connect-AzureAD | Connect-MgGraph | AzureAD module is retired. |
| Get-MsolUser | Get-MgUser | Graph returns only requested properties; add -Property. Paging needs -All. |
| Get-AzureADUser | Get-MgUser | |
| Set-MsolUser | Update-MgUser | |
| Set-AzureADUser | Update-MgUser | |
| New-MsolUser | New-MgUser | Password goes in a -PasswordProfile hashtable. |
| Remove-MsolUser | Remove-MgUser | Soft delete with a 30-day recovery window. |
| Set-MsolUserPassword | Update-MgUser -PasswordProfile | Needs an appropriate admin role; least-privileged scope is User-PasswordProfile.ReadWrite.All. |
| Set-MsolUserLicense | Set-MgUserLicense | Takes SkuId GUIDs via -AddLicenses / -RemoveLicenses hashtables. |
| Get-MsolAccountSku | Get-MgSubscribedSku | |
| Get-MsolGroup | Get-MgGroup | |
| Get-AzureADGroup | Get-MgGroup | |
| Add-MsolGroupMember | New-MgGroupMember | Takes object IDs, not UPNs. Resolve the user first. |
| Add-AzureADGroupMember | New-MgGroupMember | |
| Remove-AzureADGroupMember | Remove-MgGroupMemberByRef | |
| Get-MsolRole / Get-AzureADDirectoryRole | Get-MgDirectoryRole | Shows activated roles only; Get-MgRoleManagementDirectoryRoleDefinition lists all. |
| Get-MsolRoleMember | Get-MgDirectoryRoleMember | Member details sit in AdditionalProperties. |
| Get-AzureADAuditSignInLogs | Get-MgAuditLogSignIn | Requires AuditLog.Read.All and Entra ID P1 for full retention. |
| Get-AzureADAuditDirectoryLogs | Get-MgAuditLogDirectoryAudit | |
| Revoke-AzureADUserAllRefreshToken | Revoke-MgUserSignInSession | |
| Get-MsolDevice / Get-AzureADDevice | Get-MgDevice | |
| Get-MsolDomain / Get-AzureADDomain | Get-MgDomain | |
| Get-MsolCompanyInformation | Get-MgOrganization | OnPremisesSyncEnabled lives here for hybrid checks. |
The original Get-MessageTrace and Get-MessageTraceDetail cmdlets have been deprecated in favour of V2 versions. The headline improvement is history: V2 can query up to 90 days of message data, where V1 stopped at 10. But two habits from V1 no longer work, and both fail in confusing ways.
V1 scripts sometimes filtered by subject server-side. Get-MessageTraceV2 does not support a subject parameter, so filter client-side with Where-Object instead:
Old habit (fails on V2)
Get-MessageTrace -SenderAddress user@contoso.com -Subject "Invoice"
Working V2 pattern
Get-MessageTraceV2 -SenderAddress user@contoso.com -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Where-Object Subject -like "*Invoice*" | Select-Object Received, SenderAddress, RecipientAddress, Subject, Status
V1 used -Page and -PageSize to walk through large result sets. V2 drops page-based paging; for result sets that hit the per-query cap, narrow the time window and walk through it in slices (for example, day by day) rather than requesting page 2. For one-off investigations this rarely matters, but scheduled reporting scripts built around a page loop need restructuring.
Get-MessageTraceV2 -RecipientAddress user@contoso.com -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) | Get-MessageTraceDetailV2 | Select-Object Date, Event, Detail
Search-AdminAuditLog and Search-MailboxAuditLog are deprecated. Both kinds of event now live in the unified audit log, searched with Search-UnifiedAuditLog or through the Purview portal.
Deprecated
Search-AdminAuditLog -Cmdlets Set-Mailbox -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)
Replacement
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) ` -RecordType ExchangeAdmin -Operations "Set-Mailbox" -ResultSize 1000 | Select-Object CreationDate, UserIds, Operations
The unified log wraps event detail in a JSON blob in the AuditData property. To get at the interesting fields, parse it:
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) -RecordType ExchangeAdmin -ResultSize 500 |
ForEach-Object { $_.AuditData | ConvertFrom-Json } |
Select-Object CreationTime, UserId, Operation, ObjectId
The Exchange Online V3 module ships REST-backed versions of the highest-volume read cmdlets, prefixed EXO: Get-EXOMailbox, Get-EXOMailboxStatistics, Get-EXORecipient, Get-EXOCASMailbox, Get-EXOMobileDeviceStatistics and the permission cmdlets. The originals still exist, but the EXO versions are markedly faster on bulk operations and are the right default for anything touching more than a handful of mailboxes.
The trade-off is that EXO cmdlets return a minimal property set by default. A script that did Get-Mailbox | Select ForwardingSmtpAddress will get blank output from Get-EXOMailbox until the property is requested explicitly:
Requesting properties explicitly
Get-EXOMailbox -ResultSize Unlimited -Properties ForwardingSmtpAddress, HiddenFromAddressListsEnabled | Where-Object ForwardingSmtpAddress -ne $null | Select-Object DisplayName, ForwardingSmtpAddress
Property groups are also available via -PropertySets (for example Minimum, Delivery, Quota) when you need a themed bundle rather than individual fields.
Older scripts connected to Exchange Online by creating a WinRM session against outlook.office365.com with basic authentication, then importing it. Basic authentication for Exchange Online PowerShell has been switched off, so this pattern is dead, as is the V1 Connect-EXOPSSession helper and the V3 module's temporary -UseRPSSession escape hatch.
Dead pattern
$session = New-PSSession -ConfigurationName Microsoft.Exchange ` -ConnectionUri https://outlook.office365.com/powershell-liveid/ ` -Credential $cred -Authentication Basic -AllowRedirection Import-PSSession $session
Current pattern
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com # unattended automation: certificate-based app-only auth Connect-ExchangeOnline -AppId $appId -CertificateThumbprint $thumb -Organization contoso.onmicrosoft.com
For unattended scripts, certificate-based app-only authentication replaces stored credentials. Storing a password for a basic-auth session was always the weakest link in MSP automation; there is no supported way to keep doing it.
The MSOnline (*-Msol*) and AzureAD (*-AzureAD*) modules are retired. Scripts still calling them fail at connect time, so this is the migration most likely to surface as a sudden outage in old onboarding and reporting scripts. The replacement for both is the Microsoft Graph PowerShell SDK, and it is not a rename: Graph behaves differently in five ways that account for nearly every migration bug.
MSOnline returned everything about a user by default. Graph returns a small default set, and anything else comes back empty unless requested with -Property:
Silently returns blank Department
Get-MgUser -UserId user@contoso.com | Select-Object DisplayName, Department
Correct
Get-MgUser -UserId user@contoso.com -Property DisplayName, Department | Select-Object DisplayName, Department
Graph list cmdlets return one page (typically 100 objects) unless -All is supplied. A migrated user report that mysteriously caps at 100 rows has lost its -All.
Filters that count, negate or use certain operators are "advanced queries" and require -ConsistencyLevel eventual together with -CountVariable. Without them, Graph rejects the request:
Get-MgUser -All -Filter "assignedLicenses/`$count eq 0 and userType eq 'Member'" ` -ConsistencyLevel eventual -CountVariable c
Membership and reference operations take directory object IDs. The reliable pattern is resolve first, then act:
$grp = Get-MgGroup -Filter "displayName eq 'All Staff'" $usr = Get-MgUser -UserId "user@contoso.com" New-MgGroupMember -GroupId $grp.Id -DirectoryObjectId $usr.Id
Cmdlets that return generic directory objects (group members, role members, a user's manager) put the useful fields inside AdditionalProperties:
Get-MgGroupMember -GroupId $grp.Id -All |
ForEach-Object { [pscustomobject]@{
Name = $_.AdditionalProperties.displayName
UPN = $_.AdditionalProperties.userPrincipalName } }
For ready-made Graph commands covering users, licensing, groups, roles, sign-in logs and MFA methods, see the Entra ID command builder on this site. Every command there lists the scopes it needs.
A special category: cmdlets that circulate in forum answers and AI-generated scripts but have never existed. They fail with "not recognized as the name of a cmdlet", which sends people hunting for module problems that are not there.
| Not a real cmdlet | What people actually want |
|---|---|
| Get-DmarcAggregateReport | There is no Exchange Online cmdlet for DMARC reports. To check a DMARC record: Resolve-DnsName -Name "_dmarc.contoso.com" -Type TXT. Aggregate reports arrive by email to the address in the record's rua tag. |
| Get-MobileDeviceStatistics -ResultSize Unlimited | The cmdlet exists but the parameter does not. Use Get-EXOMobileDeviceStatistics -Mailbox user@contoso.com per mailbox. |
| Get-MailboxQuota | Quotas are properties, not a cmdlet: Get-Mailbox user@contoso.com | Format-List *Quota*. |
When in doubt, verify before debugging: Get-Command Get-MessageTraceV2 confirms a cmdlet exists in your session, and Get-Command Get-MessageTraceV2 -Syntax shows its real parameters. Thirty seconds of verification routinely saves an hour of chasing a cmdlet that was never there.
When reviving a script of unknown age, work through it in this order. First, replace the connection block: Connect-ExchangeOnline for Exchange, Connect-MgGraph with explicit scopes for directory work. Second, run the script body through a search for Msol, AzureAD, Get-MessageTrace and Search-AdminAuditLog, and swap in the replacements from the table above. Third, on every Graph list call, confirm -All and -Property are present. Fourth, test against a single known object before running at tenant scale. The Exchange and Entra ID builders on this site produce current-syntax commands you can diff your old script against.