Connect-ExchangeOnline -Device (device code sign-in, PowerShell 7 only)

Connect-ExchangeOnline -Device signs in with the device code flow: the command prints the URL https://microsoft.com/devicelogin and a one-time code; you open the URL in a browser on any device, enter the code and sign in (MFA included), and the PowerShell session continues. Use it on servers or SSH sessions without a browser.

Connect-ExchangeOnline -Device

PowerShell 7 only

The parameter exists only when the module runs in PowerShell 7 (7.0.3 or later, module 2.0.4 or later). In Windows PowerShell 5.1 the module does not define it, and neither does it define -InlineCredential, the other PowerShell 7-only sign-in switch. Checked in Windows PowerShell 5.1 with module 3.10.1:

Import-Module ExchangeOnlineManagement
$p = (Get-Command Connect-ExchangeOnline).Parameters
"PowerShell " + $PSVersionTable.PSVersion.Major + "." + $PSVersionTable.PSVersion.Minor
"Device:           " + $p.ContainsKey('Device')
"InlineCredential: " + $p.ContainsKey('InlineCredential')
"UserPrincipalName: " + $p.ContainsKey('UserPrincipalName')

So in Windows PowerShell 5.1 Connect-ExchangeOnline -Device fails with A parameter cannot be found that matches parameter name 'Device'. Install PowerShell 7 (pwsh) and run the command there.

Alternatives

How the sign-in works

1. Run Connect-ExchangeOnline -Device in PowerShell 7. The module asks Microsoft Entra ID for a device code and prints a message with the sign-in URL and the code.
2. On any device with a browser, open the URL, type the code, and sign in with the admin account. MFA and Conditional Access are evaluated during this browser sign-in.
3. When the sign-in completes, the PowerShell session receives its token and the Exchange cmdlets are imported, as with any other sign-in method.

You can add -UserPrincipalName or -Organization as usual; the device code only changes how the user authenticates, not what the session can do afterwards. The permissions still come from the account's Exchange roles.

When to use it

Device code sign-in fits remote shells: an SSH session to a Linux jump host, a container, a Windows Server Core machine, or a VS Code remote terminal, where no browser window can open next to the shell. On a normal desktop the default interactive sign-in is simpler. For anything scheduled, use app-only certificate authentication, because the device code flow always needs a person.

Pitfalls

• Windows PowerShell 5.1. The parameter does not exist there, as the check above shows; the call fails with "A parameter cannot be found that matches parameter name 'Device'".
• Conditional Access. Many organizations block the device code flow with a Conditional Access policy, or require a compliant device. The sign-in then fails in the browser with an AADSTS error such as AADSTS53003; ask the Entra ID administrator which sign-in method is allowed for admin accounts.
• Waiting too long. The code is valid only for a limited time. If the sign-in times out, run the command again to get a new code.
• Wrong account. The browser may already be signed in with a personal or user account. Use a private window or pick the admin account explicitly.

After connecting, Get-ConnectionInformation shows the session, and cmdlets that ran before it fail with You must call Connect-ExchangeOnline.

FAQ