Commands › Exchange Online
New-ClientAccessRule
> [!NOTE] > Client access rules were deprecated for all Exchange Online organizations in September 2025. For more information, see Update on Client Access Rules Deprecation in Exchange Online. This cmdlet is functional only in Exchange Server 2019 or later. Use the New-ClientAccessRule cmdlet to create client access rules. Client access rules help you control access to your organization based on the properties of the connection.
Quick start script
# New-ClientAccessRule — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org
# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-ClientAccessRule
$before | Format-List
# 3. Make the change (dry run first)
New-ClientAccessRule -Name <String> -Action <ClientAccessRulesAction> -WhatIf
New-ClientAccessRule -Name <String> -Action <ClientAccessRulesAction>
# 4. Verify and diff
$after = Get-ClientAccessRule
Compare-Object ($before | Out-String) ($after | Out-String)Syntax
New-ClientAccessRule [-Name] <String> -Action <ClientAccessRulesAction>
[-AnyOfAuthenticationTypes <MultiValuedProperty>]
[-AnyOfClientIPAddressesOrRanges <MultiValuedProperty>]
[-AnyOfProtocols <MultiValuedProperty>]
[-AnyOfSourceTcpPortNumbers <MultiValuedProperty>]
[-Confirm]
[-DomainController <Fqdn>]
[-Enabled <Boolean>]
[-ExceptAnyOfAuthenticationTypes <MultiValuedProperty>]
[-ExceptAnyOfClientIPAddressesOrRanges <MultiValuedProperty>]
[-ExceptAnyOfProtocols <MultiValuedProperty>]
[-ExceptAnyOfSourceTcpPortNumbers <MultiValuedProperty>]
[-ExceptUserIsMemberOf <MultiValuedProperty>]
[-ExceptUsernameMatchesAnyOfPatterns <MultiValuedProperty>]
[-Priority <Int32>]
[-Scope <ClientAccessRulesScope>]
[-UserIsMemberOf <MultiValuedProperty>]
[-UsernameMatchesAnyOfPatterns <MultiValuedProperty>]
[-UserRecipientFilter <String>]
[-WhatIf]
[<CommonParameters>]Parameters (21)
| Parameter | Type | Required | What it controls |
|---|---|---|---|
| -Name | String | yes | The Name parameter specifies a unique name for the client access rule. |
| -Action | ClientAccessRulesAction | yes | The Action parameter specifies the action for the client access rule. Valid values for this parameter are AllowAccess and DenyAccess. |
| -AnyOfAuthenticationTypes | MultiValuedProperty | This parameter is reserved for internal Microsoft use. | |
| -AnyOfClientIPAddressesOrRanges | MultiValuedProperty | The AnyOfClientIPAddressesOrRanges parameter specifies a condition for the client access rule that's based on the client's IPv4 or IPv6 address. Valid values are: | |
| -AnyOfProtocols | MultiValuedProperty | The AnyOfProtocols parameter specifies a condition for the client access rule that's based on the client's protocol. | |
| -AnyOfSourceTcpPortNumbers | MultiValuedProperty | This parameter is reserved for internal Microsoft use. | |
| -Confirm | SwitchParameter | The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding. | |
| -DomainController | Fqdn | The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name... | |
| -Enabled | Boolean | The Enabled parameter specifies whether the client access rule is enabled or disabled. Valid values for this parameter are $true or $false. The default value is $true. | |
| -ExceptAnyOfAuthenticationTypes | MultiValuedProperty | This parameter is reserved for internal Microsoft use. | |
| -ExceptAnyOfClientIPAddressesOrRanges | MultiValuedProperty | The ExceptAnyOfClientIPAddressesOrRanges parameter specifies an exception for the client access rule that's based on the client's IPv4 or IPv6 address. Valid values are: | |
| -ExceptAnyOfProtocols | MultiValuedProperty | This parameter is reserved for internal Microsoft use. | |
| -ExceptAnyOfSourceTcpPortNumbers | MultiValuedProperty | This parameter is reserved for internal Microsoft use. | |
| -ExceptUserIsMemberOf | MultiValuedProperty | This parameter is reserved for internal Microsoft use. | |
| -ExceptUsernameMatchesAnyOfPatterns | MultiValuedProperty | The ExceptUsernameMatchesAnyOfPatterns parameter specifies an exception for the client access rule that's based on the user's account name in the format `<Domain>\<UserName>` (for example, `contoso.com\jeff`). This... | |
| -Priority | Int32 | The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't... | |
| -Scope | ClientAccessRulesScope | The Scope parameter specifies the scope of the client access rule. Valid values are: | |
| -UserIsMemberOf | MultiValuedProperty | This parameter is reserved for internal Microsoft use. | |
| -UsernameMatchesAnyOfPatterns | MultiValuedProperty | The UsernameMatchesAnyOfPatterns parameter specifies a condition for the client access rule that's based on the user's account name in the format `<Domain>\<UserName>` (for example, `contoso.com\jeff`). This... | |
| -UserRecipientFilter | String | The UserRecipientFilter parameter specifies a condition for the client access rule that uses OPATH filter syntax to identify the user based on a limited set of recipient properties. Client Access Rules don't support... | |
| -WhatIf | SwitchParameter | The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch. |
Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.