Commands › Exchange Online

Set-DeviceConditionalAccessRule

Exchange Online ExchangeOnlineManagement Set-*

For more information, see Security & Compliance PowerShell. Use the Set-DeviceConditionalAccessRule cmdlet to modify mobile device conditional access rules in Basic Mobility and Security in Microsoft 365.

Quick start script

# Set-DeviceConditionalAccessRule — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-DeviceConditionalAccessRule
$before | Format-List

# 3. Make the change (dry run first)
Set-DeviceConditionalAccessRule -Identity <ComplianceRuleIdParameter> -TargetGroups <MultiValuedProperty> -WhatIf
Set-DeviceConditionalAccessRule -Identity <ComplianceRuleIdParameter> -TargetGroups <MultiValuedProperty>

# 4. Verify and diff
$after = Get-DeviceConditionalAccessRule
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-DeviceConditionalAccessRule [-Identity] <ComplianceRuleIdParameter> -TargetGroups <MultiValuedProperty>
 [-AccountName <String>]
 [-AccountUserName <String>]
 [-AllowAppStore <Boolean>]
 [-AllowAssistantWhileLocked <Boolean>]
 [-AllowConvenienceLogon <Boolean>]
 [-AllowDiagnosticSubmission <Boolean>]
 [-AllowiCloudBackup <Boolean>]
 [-AllowiCloudDocSync <Boolean>]
 [-AllowiCloudPhotoSync <Boolean>]
 [-AllowJailbroken <Boolean>]
 [-AllowPassbookWhileLocked <Boolean>]
 [-AllowScreenshot <Boolean>]
 [-AllowSimplePassword <Boolean>]
 [-AllowVideoConferencing <Boolean>]
 [-AllowVoiceAssistant <Boolean>]
 [-AllowVoiceDialing <Boolean>]
 [-AntiVirusSignatureStatus <Int64>]
 [-AntiVirusStatus <Int64>]
 [-AppsRating <CARatingAppsEntry>]
 [-AutoUpdateStatus <CAAutoUpdateStatusEntry>]
 [-BluetoothEnabled <Boolean>]
 [-CameraEnabled <Boolean>]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-EmailAddress <String>]
 [-EnableRemovableStorage <Boolean>]
 [-ExchangeActiveSyncHost <String>]
 [-FirewallStatus <Required>]
 [-ForceAppStorePassword <Boolean>]
 [-ForceEncryptedBackup <Boolean>]
 [-MaxPasswordAttemptsBeforeWipe <Int32>]
 [-MaxPasswordGracePeriod <TimeSpan>]
 [-MoviesRating <CARatingMovieEntry>]
 [-PasswordComplexity <Int64>]
 [-PasswordExpirationDays <Int32>]
 [-PasswordHistoryCount <Int32>]
 [-PasswordMinComplexChars <Int32>]
 [-PasswordMinimumLength <Int32>]
 [-PasswordQuality <Int32>]
 [-PasswordRequired <Boolean>]
 [-PasswordTimeout <TimeSpan>]
 [-PhoneMemoryEncrypted <Boolean>]
 [-RegionRatings <CARatingRegionEntry>]
 [-RequireEmailProfile <Boolean>]
 [-SmartScreenEnabled <Boolean>]
 [-SystemSecurityTLS <Boolean>]
 [-TVShowsRating <CARatingTvShowEntry>]
 [-UserAccountControlStatus <CAUserAccountControlStatusEntry>]
 [-WhatIf]
 [-WLANEnabled <Boolean>]
 [-WorkFoldersSyncUrl <String>]
 [<CommonParameters>]

Parameters (53)

Parameter	Type	Required	What it controls
-Identity	ComplianceRuleIdParameter	yes	The Identity parameter specifies the mobile device conditional access rule that you want to modify. The name of the rule uses the syntax `<Mobile device conditional access policy name>{<GUID value>}`. For example,...
-TargetGroups	MultiValuedProperty	yes	The TargetGroups parameter specifies the security groups that this rule applies to. This parameter uses the GUID value of the group. To find this GUID value, run the command Get-Group \| Format-Table Name,GUID.
-AccountName	String		The AccountName parameter specifies the account name. Valid values for this parameter are:
-AccountUserName	String		The AccountUserName parameter specifies the account user name. Valid values for this parameter are:
-AllowAppStore	Boolean		The AllowAppStore parameter specifies whether to allow access to the app store on devices. Valid values for this parameter are:
-AllowAssistantWhileLocked	Boolean		The AllowAssistantWhileLocked parameter specifies whether to allow the use of the voice assistant while devices are locked. Valid values for this parameter are:
-AllowConvenienceLogon	Boolean		The AllowConvenienceLogon parameter specifies whether to allow convenience logons on devices. Valid values for this parameter are:
-AllowDiagnosticSubmission	Boolean		The AllowDiagnosticSubmission parameter specifies whether to allow diagnostic submissions from devices. Valid values for this parameter are:
-AllowiCloudBackup	Boolean		The AllowiCloudBackup parameter specifies whether to allow Apple iCloud Backup from devices. Valid values for this parameter are:
-AllowiCloudDocSync	Boolean		The AllowiCloudDocSync parameter specifies whether to allow Apple iCloud Documents & Data sync on devices. Valid values for this parameter are:
-AllowiCloudPhotoSync	Boolean		The AllowiCloudPhotoSync parameter specifies whether to allow Apple iCloud Photos sync on devices. Valid values for this parameter are:
-AllowJailbroken	Boolean		The AllowJailbroken parameter specifies whether to allow access to your organization by jailbroken or rooted devices.
-AllowPassbookWhileLocked	Boolean		The AllowPassbookWhileLocked parameter specifies whether to allow the use of Apple Passbook while devices are locked. Valid values for this parameter are:
-AllowScreenshot	Boolean		The AllowScreenshot parameter specifies whether to allow screenshots on devices. Valid values for this parameter are:
-AllowSimplePassword	Boolean		The AllowSimplePassword parameter specifies whether to allow simple or non-complex passwords on devices. Valid values for this parameter are:
-AllowVideoConferencing	Boolean		The AllowVideoConferencing parameter specifies whether to allow video conferencing on devices. Valid values for this parameter are:
-AllowVoiceAssistant	Boolean		The AllowVoiceAssistant parameter specifies whether to allow using the voice assistant on devices. Valid values for this parameter are:
-AllowVoiceDialing	Boolean		The AllowVoiceDialing parameter specifies whether to allow voice-activated telephone dialing. Valid values for this parameter are:
-AntiVirusSignatureStatus	Int64		The AntiVirusSignatureStatus parameter specifies the antivirus signature status. Valid values for this parameter are:
-AntiVirusStatus	Int64		The AntiVirusStatus parameter specifies antivirus status. Valid values for this parameter are:
-AppsRating	CARatingAppsEntry		The AppsRating parameter species the maximum or most restrictive rating of apps that are allowed on devices. Valid values for this parameter are:
-AutoUpdateStatus	CAAutoUpdateStatusEntry		The AutoUpdateStatus parameter specifies the update settings for devices. Valid values for this parameter are:
-BluetoothEnabled	Boolean		The BluetoothEnabled parameter specifies whether to enable or disable Bluetooth on devices. Valid values for this parameter are:
-CameraEnabled	Boolean		The CameraEnabled parameter specifies whether to enable or disable cameras on devices. Valid values for this parameter are:
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DomainController	Fqdn		This parameter is reserved for internal Microsoft use.
-EmailAddress	String		The EmailAddress parameter specifies the email address. Valid values are:
-EnableRemovableStorage	Boolean		The EnableRemovableStorage parameter specifies whether removable storage can be used by devices. Valid values for this parameter are:
-ExchangeActiveSyncHost	String		The ExchangeActiveSyncHost parameter specifies the Exchange ActiveSync host. Valid values for this parameter are:
-FirewallStatus	Required		The FirewallStatus parameter specifies the acceptable firewall status values on devices. Valid values for this parameter are:
-ForceAppStorePassword	Boolean		The ForceAppStorePassword parameter specifies whether to require a password to use the app store on devices. Valid values for this parameter are:
-ForceEncryptedBackup	Boolean		The ForceEncryptedBackup parameter specifies whether to force encrypted backups for devices. Valid values for this parameter are:
-MaxPasswordAttemptsBeforeWipe	Int32		The MaxPasswordAttemptsBeforeWipe parameter specifies the number of incorrect password attempts that cause devices to be automatically wiped. Valid values for this parameter are:
-MaxPasswordGracePeriod	TimeSpan		The MaxPasswordGracePeriod parameter specifies the length of time users are allowed to reset expired passwords on devices.
-MoviesRating	CARatingMovieEntry		The MoviesRating parameter species the maximum or most restrictive rating of movies that are allowed on devices. You specify the country/region rating system to use with the RegionRatings parameter.
-PasswordComplexity	Int64		The PasswordComplexity parameter specifies the password complexity. Valid values for this parameter are:
-PasswordExpirationDays	Int32		The PasswordExpirationDays parameter specifies the number of days that the same password can be used on devices before users are required to change their passwords . Valid values for this parameter are:
-PasswordHistoryCount	Int32		The PasswordHistoryCount parameter specifies the minimum number of unique new passwords that are required on devices before an old password can be reused. Valid values for this parameter are:
-PasswordMinComplexChars	Int32		The PasswordMinComplexChars parameter specifies the minimum number of complex characters that are required for device passwords. A complex character isn't a letter. Valid values for this parameter are:
-PasswordMinimumLength	Int32		The PasswordMinimumLength parameter specifies the minimum number of characters that are required for device passwords. Valid values for this parameter are:
-PasswordQuality	Int32		The PasswordQuality parameter specifies the minimum password quality rating that's required for device passwords. Password quality is a numeric scale that indicates the security and complexity of the password. A...
-PasswordRequired	Boolean		The PasswordRequired parameter specifies whether a password is required to access devices. Valid values for this parameter are:
-PasswordTimeout	TimeSpan		The PasswordTimeout parameter specifies the length of time that devices can be inactive before a password is required to reactivate them.
-PhoneMemoryEncrypted	Boolean		The PhoneMemoryEncrypted parameter specifies whether to encrypt the memory on devices. Valid values for this parameter are:
-RegionRatings	CARatingRegionEntry		The RegionRatings parameter specifies the rating system (country/region) to use for movie and television ratings with the MoviesRating and TVShowsRating parameters.
-RequireEmailProfile	Boolean		The RequireEmailProfile parameter specifies whether an email profile is required on devices. Valid values for this parameter are:
-SmartScreenEnabled	Boolean		The SmartScreenEnabled parameter specifies whether to requireWindows SmartScreen on devices. Valid values for this parameter are:
-SystemSecurityTLS	Boolean		The SystemSecurityTLS parameter specifies whether TLS encryption is used on devices. Valid values for this parameter are:
-TVShowsRating	CARatingTvShowEntry		The TVShowsRating parameter species the maximum or most restrictive rating of television shows that are allowed on devices. You specify the country/region rating system to use with the RegionRatings parameter.
-UserAccountControlStatus	CAUserAccountControlStatusEntry		The UserAccountControlStatus parameter specifies how User Account Control messages are presented on devices. Valid values for this parameter are:
-WhatIf	SwitchParameter		The WhatIf switch doesn't work in Security & Compliance PowerShell.
-WLANEnabled	Boolean		The WLANEnabled parameter specifies whether Wi-Fi is enabled devices. Valid values for this parameter are:
-WorkFoldersSyncUrl	String		The WorkFoldersSyncUrl parameter specifies the URL that's used to synchronize company data on devices.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.