Commands › Exchange Online

Set-ClientAccessRule

Exchange Online ExchangeOnlineManagement Set-*

> [!NOTE] > Client access rules were deprecated for all Exchange Online organizations in September 2025. For more information, see Update on Client Access Rules Deprecation in Exchange Online. This cmdlet is functional only in Exchange Server 2019 or later. Use the Set-ClientAccessRule cmdlet to modify existing client access rules. Client access rules help you control access to your organization based on the properties of the connection.

Quick start script

# Set-ClientAccessRule — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-ClientAccessRule
$before | Format-List

# 3. Make the change (dry run first)
Set-ClientAccessRule -Identity <ClientAccessRuleIdParameter> -WhatIf
Set-ClientAccessRule -Identity <ClientAccessRuleIdParameter>

# 4. Verify and diff
$after = Get-ClientAccessRule
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-ClientAccessRule [-Identity] <ClientAccessRuleIdParameter>
 [-Action <ClientAccessRulesAction>]
 [-AnyOfAuthenticationTypes <MultiValuedProperty>]
 [-AnyOfClientIPAddressesOrRanges <MultiValuedProperty>]
 [-AnyOfProtocols <MultiValuedProperty>]
 [-AnyOfSourceTcpPortNumbers <MultiValuedProperty>]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-ExceptAnyOfAuthenticationTypes <MultiValuedProperty>]
 [-ExceptAnyOfClientIPAddressesOrRanges <MultiValuedProperty>]
 [-ExceptAnyOfProtocols <MultiValuedProperty>]
 [-ExceptAnyOfSourceTcpPortNumbers <MultiValuedProperty>]
 [-ExceptUserIsMemberOf <MultiValuedProperty>]
 [-ExceptUsernameMatchesAnyOfPatterns <MultiValuedProperty>]
 [-Name <String>]
 [-Priority <Int32>]
 [-Scope <ClientAccessRulesScope>]
 [-UserIsMemberOf <MultiValuedProperty>]
 [-UsernameMatchesAnyOfPatterns <MultiValuedProperty>]
 [-UserRecipientFilter <String>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (22)

Parameter	Type	Required	What it controls
-Identity	ClientAccessRuleIdParameter	yes	The Identity parameter specifies the client access rule that you want to modify. You can use any value that uniquely identifies the client access rule. For example:
-Action	ClientAccessRulesAction		The Action parameter specifies the action for the client access rule. Valid values for this parameter are AllowAccess and DenyAccess.
-AnyOfAuthenticationTypes	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-AnyOfClientIPAddressesOrRanges	MultiValuedProperty		The AnyOfClientIPAddressesOrRanges parameter specifies a condition for the client access rule that's based on the client's IPv4 or IPv6 address. Valid values are:
-AnyOfProtocols	MultiValuedProperty		The AnyOfProtocols parameter specifies a condition for the client access rule that's based on the client's protocol.
-AnyOfSourceTcpPortNumbers	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DomainController	Fqdn		The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-Enabled	Boolean		The Enabled parameter specifies whether the client access rule is enabled or disabled. Valid values for this parameter are $true or $false.
-ExceptAnyOfAuthenticationTypes	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-ExceptAnyOfClientIPAddressesOrRanges	MultiValuedProperty		The ExceptAnyOfClientIPAddressesOrRanges parameter specifies an exception for the client access rule that's based on the client's IPv4 or IPv6 address. Valid values are:
-ExceptAnyOfProtocols	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-ExceptAnyOfSourceTcpPortNumbers	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-ExceptUserIsMemberOf	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-ExceptUsernameMatchesAnyOfPatterns	MultiValuedProperty		The ExceptUsernameMatchesAnyOfPatterns parameter specifies an exception for the client access rule that's based on the user's account name in the format `<Domain>\<UserName>` (for example, `contoso.com\jeff`). This...
-Name	String		The Name parameter specifies a unique name for the client access rule.
-Priority	Int32		The Priority parameter specifies a priority value for the client access rule. A lower integer value indicates a higher priority, and a higher priority rule is evaluated before a lower priority rule. The default value is 1.
-Scope	ClientAccessRulesScope		The Scope parameter specifies the scope of the client access rule. Valid values are:
-UserIsMemberOf	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-UsernameMatchesAnyOfPatterns	MultiValuedProperty		The UsernameMatchesAnyOfPatterns parameter specifies a condition for the client access rule that's based on the user's account name in the format `<Domain>\<UserName>` (for example, `contoso.com\jeff`). This...
-UserRecipientFilter	String		The UserRecipientFilter parameter specifies a condition for the client access rule that uses OPATH filter syntax to identify the user based on a limited set of recipient properties. Client Access Rules don't support...
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.