Commands › Exchange Online
New-MobileDeviceMailboxPolicy
Create mobile device mailbox policies.
Quick start script
# New-MobileDeviceMailboxPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org
# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-MobileDeviceMailboxPolicy
$before | Format-List
# 3. Make the change (dry run first)
New-MobileDeviceMailboxPolicy -Name <String> -WhatIf
New-MobileDeviceMailboxPolicy -Name <String>
# 4. Verify and diff
$after = Get-MobileDeviceMailboxPolicy
Compare-Object ($before | Out-String) ($after | Out-String)Syntax
New-MobileDeviceMailboxPolicy [-Name] <String>
[-AllowApplePushNotifications <Boolean>]
[-AllowBluetooth <BluetoothType>]
[-AllowBrowser <Boolean>]
[-AllowCamera <Boolean>]
[-AllowConsumerEmail <Boolean>]
[-AllowDesktopSync <Boolean>]
[-AllowExternalDeviceManagement <Boolean>]
[-AllowGooglePushNotifications <Boolean>]
[-AllowHTMLEmail <Boolean>]
[-AllowInternetSharing <Boolean>]
[-AllowIrDA <Boolean>]
[-AllowMicrosoftPushNotifications <Boolean>]
[-AllowMobileOTAUpdate <Boolean>]
[-AllowNonProvisionableDevices <Boolean>]
[-AllowPOPIMAPEmail <Boolean>]
[-AllowRemoteDesktop <Boolean>]
[-AllowSimplePassword <Boolean>]
[-AllowSMIMEEncryptionAlgorithmNegotiation <SMIMEEncryptionAlgorithmNegotiationType>]
[-AllowSMIMESoftCerts <Boolean>]
[-AllowStorageCard <Boolean>]
[-AllowTextMessaging <Boolean>]
[-AllowUnsignedApplications <Boolean>]
[-AllowUnsignedInstallationPackages <Boolean>]
[-AllowWiFi <Boolean>]
[-AlphanumericPasswordRequired <Boolean>]
[-ApprovedApplicationList <ApprovedApplicationCollection>]
[-AttachmentsEnabled <Boolean>]
[-Confirm]
[-DeviceEncryptionEnabled <Boolean>]
[-DevicePolicyRefreshInterval <Unlimited>]
[-DomainController <Fqdn>]
[-IrmEnabled <Boolean>]
[-IsDefault <Boolean>]
[-MaxAttachmentSize <Unlimited>]
[-MaxCalendarAgeFilter <CalendarAgeFilterType>]
[-MaxEmailAgeFilter <EmailAgeFilterType>]
[-MaxEmailBodyTruncationSize <Unlimited>]
[-MaxEmailHTMLBodyTruncationSize <Unlimited>]
[-MaxInactivityTimeLock <Unlimited>]
[-MaxPasswordFailedAttempts <Unlimited>]
[-MinPasswordComplexCharacters <Int32>]
[-MinPasswordLength <Int32>]
[-PasswordEnabled <Boolean>]
[-PasswordExpiration <Unlimited>]
[-PasswordHistory <Int32>]
[-PasswordRecoveryEnabled <Boolean>]
[-RequireDeviceEncryption <Boolean>]
[-RequireEncryptedSMIMEMessages <Boolean>]
[-RequireEncryptionSMIMEAlgorithm <EncryptionSMIMEAlgorithmType>]
[-RequireManualSyncWhenRoaming <Boolean>]
[-RequireSignedSMIMEAlgorithm <SignedSMIMEAlgorithmType>]
[-RequireSignedSMIMEMessages <Boolean>]
[-RequireStorageCardEncryption <Boolean>]
[-UnapprovedInROMApplicationList <MultiValuedProperty>]
[-UNCAccessEnabled <Boolean>]
[-WhatIf]
[-WSSAccessEnabled <Boolean>]
[<CommonParameters>]Parameters (58)
| Parameter | Type | Required | What it controls |
|---|---|---|---|
| -Name | String | yes | The Name parameter specifies the name of the mobile device mailbox policy. You can use any value that uniquely identifies the policy. For example: |
| -AllowApplePushNotifications | Boolean | This parameter is available only in the cloud-based service. | |
| -AllowBluetooth | BluetoothType | The AllowBluetooth parameter specifies whether the Bluetooth capabilities are allowed on the mobile device. Valid values are: | |
| -AllowBrowser | Boolean | The AllowBrowser parameter specifies whether Microsoft Pocket Internet Explorer is allowed on the mobile device. Valid input for this parameter is $true or $false. The default value is $true. This parameter doesn't... | |
| -AllowCamera | Boolean | The AllowCamera parameter specifies whether the mobile device's camera is allowed. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AllowConsumerEmail | Boolean | The AllowConsumerEmail parameter specifies whether the user can configure a personal email account on the mobile device. Valid input for this parameter is $true or $false. The default value is $true. This parameter... | |
| -AllowDesktopSync | Boolean | The AllowDesktopSync parameter specifies whether the mobile device can synchronize with a desktop computer through a cable. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AllowExternalDeviceManagement | Boolean | The AllowExternalDeviceManagement parameter specifies whether an external device management program is allowed to manage the mobile device. Valid input for this parameter is $true or $false. The default value is $false. | |
| -AllowGooglePushNotifications | Boolean | This parameter is available only in the cloud-based service. | |
| -AllowHTMLEmail | Boolean | The AllowHTMLEmail parameter specifies whether HTML-formatted email is enabled on the mobile device. Valid input for this parameter is $true or $false. The default value is $true. If set to $false, all email is... | |
| -AllowInternetSharing | Boolean | The AllowInternetSharing parameter specifies whether the mobile device can be used as a modem to connect a computer to the Internet. This process is also known as tethering. Valid input for this parameter is $true or... | |
| -AllowIrDA | Boolean | The AllowIrDA parameter specifies whether infrared connections are allowed to the mobile device. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AllowMicrosoftPushNotifications | Boolean | This parameter is available only in the cloud-based service. | |
| -AllowMobileOTAUpdate | Boolean | The AllowMobileOTAUpdate parameter specifies whether the policy can be sent to the mobile device over a cellular data connection. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AllowNonProvisionableDevices | Boolean | The AllowNonProvisionableDevices parameter specifies whether all mobile devices can synchronize with Exchange. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AllowPOPIMAPEmail | Boolean | The AllowPOPIMAPEmail parameter specifies whether the user can configure a POP3 or IMAP4 email account on the mobile device. Valid input for this parameter is $true or $false. The default value is $true. This... | |
| -AllowRemoteDesktop | Boolean | The AllowRemoteDesktop parameter specifies whether the mobile device can initiate a remote desktop connection. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AllowSimplePassword | Boolean | The AllowSimplePassword parameter specifies whether a simple password is allowed on the mobile device. A simple password is a password that has a specific pattern, such as 1111 or 1234. Valid input for this parameter... | |
| -AllowSMIMEEncryptionAlgorithmNegotiation | SMIMEEncryptionAlgorithmNegotiationType | The AllowSMIMEEncryptionAlgorithmNegotiation parameter specifies whether the messaging application on the mobile device can negotiate the encryption algorithm if a recipient's certificate doesn't support the... | |
| -AllowSMIMESoftCerts | Boolean | The AllowSMIMESoftCerts parameter specifies whether S/MIME software certificates are allowed on the mobile device. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AllowStorageCard | Boolean | The AllowStorageCard parameter specifies whether the mobile device can access information stored on a storage card. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AllowTextMessaging | Boolean | The AllowTextMessaging parameter specifies whether text messaging is allowed from the mobile device. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AllowUnsignedApplications | Boolean | The AllowUnsignedApplications parameter specifies whether unsigned applications can be installed on the mobile device. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AllowUnsignedInstallationPackages | Boolean | The AllowUnsignedInstallationPackages parameter specifies whether unsigned installation packages are allowed to run on the mobile device. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AllowWiFi | Boolean | The AllowWiFi parameter specifies whether wireless Internet access is allowed on the mobile device. Valid input for this parameter is $true or $false. The default value is $true. | |
| -AlphanumericPasswordRequired | Boolean | The AlphanumericPasswordRequired parameter specifies whether the password for the mobile device must be alphanumeric. Valid input for this parameter is $true or $false. The default value is $false. | |
| -ApprovedApplicationList | ApprovedApplicationCollection | The ApprovedApplicationList parameter specifies a configured list of approved applications for the device. | |
| -AttachmentsEnabled | Boolean | The AttachmentsEnabled parameter specifies whether attachments can be downloaded on the mobile device. Valid input for this parameter is $true or $false. The default value is $true. | |
| -Confirm | SwitchParameter | The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding. | |
| -DeviceEncryptionEnabled | Boolean | **Note**: This setting is supported by Outlook for iOS and Android. | |
| -DevicePolicyRefreshInterval | Unlimited | The DevicePolicyRefreshInterval parameter specifies how often the policy is sent to the mobile device. | |
| -DomainController | Fqdn | This parameter is available only in on-premises Exchange. | |
| -IrmEnabled | Boolean | The IrmEnabled parameter specifies whether Information Rights Management (IRM) is enabled for the mobile device. Valid input for this parameter is $true or $false. The default value is $true. | |
| -IsDefault | Boolean | The IsDefault parameter specifies whether this policy is the default mobile device mailbox policy. Valid input for this parameter is $true or $false. The default value for the built-in mobile device mailbox policy... | |
| -MaxAttachmentSize | Unlimited | The MaxAttachmentSize parameter specifies the maximum size of attachments that can be downloaded to the mobile device. Valid input for this parameter is a size value between 0 and 2147482624 bytes (approximately 2... | |
| -MaxCalendarAgeFilter | CalendarAgeFilterType | The MaxCalendarAgeFilter parameter specifies the maximum range of calendar days that can be synchronized to the mobile device. Valid values for this parameter are: | |
| -MaxEmailAgeFilter | EmailAgeFilterType | The MaxEmailAgeFilter parameter specifies the maximum number of days of email items to synchronize to the mobile device. Valid values for this parameter are: | |
| -MaxEmailBodyTruncationSize | Unlimited | The MaxEmailBodyTruncationSize parameter specifies the maximum size at which email messages are truncated when synchronized to the mobile device. Valid input for this parameter is an integer between 0 and 2147483647... | |
| -MaxEmailHTMLBodyTruncationSize | Unlimited | The MaxEmailHTMLBodyTruncationSize parameter specifies the maximum size at which HTML-formatted email messages are truncated when synchronized to the mobile device. Valid input for this parameter is an integer... | |
| -MaxInactivityTimeLock | Unlimited | The MaxInactivityTimeLock parameter specifies the length of time that the mobile device can be inactive before the password is required to reactivate it. Valid values are: | |
| -MaxPasswordFailedAttempts | Unlimited | The MaxPasswordFailedAttempts parameter specifies the number of attempts a user can make to enter the correct password for the mobile device. | |
| -MinPasswordComplexCharacters | Int32 | The MinPasswordComplexCharacters parameter specifies the character sets that are required in the password of the mobile device. The character sets are: | |
| -MinPasswordLength | Int32 | **Note**: This setting is supported by Outlook for Android. | |
| -PasswordEnabled | Boolean | The PasswordEnabled parameter specifies whether a password is required on the mobile device. Valid input for this parameter is $true or $false. The default value is $false. | |
| -PasswordExpiration | Unlimited | The PasswordExpiration parameter specifies how long a password can be used on a mobile device before the user is forced to change the password. Valid values are: | |
| -PasswordHistory | Int32 | The PasswordHistory parameter specifies the number of unique new passwords that need to be created on the mobile device before an old password can be reused. | |
| -PasswordRecoveryEnabled | Boolean | The PasswordRecoveryEnabled parameter specifies whether the recovery password for the mobile device is stored in Exchange. Valid input for this parameter is $true or $false. The default value is $false. | |
| -RequireDeviceEncryption | Boolean | The RequireDeviceEncryption parameter specifies whether encryption is required on the mobile device. Valid input for this parameter is $true or $false. The default value is $false. | |
| -RequireEncryptedSMIMEMessages | Boolean | The RequireEncryptedSMIMEMessages parameter specifies whether the mobile device must send encrypted S/MIME messages. Valid input for this parameter is $true or $false. The default value is $false. | |
| -RequireEncryptionSMIMEAlgorithm | EncryptionSMIMEAlgorithmType | The RequireEncryptionSMIMEAlgorithm parameter specifies the algorithm that's required to encrypt S/MIME messages on a mobile device. The valid values for this parameter are: | |
| -RequireManualSyncWhenRoaming | Boolean | The RequireManualSyncWhenRoaming parameter specifies whether the mobile device must synchronize manually while roaming. Valid input for this parameter is $true or $false. The default value is $false. | |
| -RequireSignedSMIMEAlgorithm | SignedSMIMEAlgorithmType | The RequireSignedSMIMEAlgorithm parameter specifies the algorithm that's used to sign S/MIME messages on the mobile device. | |
| -RequireSignedSMIMEMessages | Boolean | The RequireSignedSMIMEMessages parameter specifies whether the mobile device must send signed S/MIME messages. Valid input for this parameter is $true or $false. The default value is $false. | |
| -RequireStorageCardEncryption | Boolean | The RequireStorageCardEncryption parameter specifies whether storage card encryption is required on the mobile device. Valid input for this parameter is $true or $false. The default value is $false. | |
| -UnapprovedInROMApplicationList | MultiValuedProperty | The UnapprovedInROMApplicationList parameter specifies a list of applications that can't be run in ROM on the mobile device. | |
| -UNCAccessEnabled | Boolean | The UNCAccessEnabled parameter specifies whether access to Microsoft Windows file shares is enabled from the mobile device. In on-premises Exchange organizations, access to specific shares is configured on the... | |
| -WhatIf | SwitchParameter | The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch. | |
| -WSSAccessEnabled | Boolean | The WSSAccessEnabled parameter specifies whether access to Microsoft Windows SharePoint Services is enabled from the mobile device. In on-premises Exchange organizations, access to specific shares is configured on... |
Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.