Commands › Exchange Online

Set-DeviceTenantRule

Exchange Online ExchangeOnlineManagement Set-*

For more information, see Security & Compliance PowerShell. Use the Set-DeviceTenantRule cmdlet to modify your organization's mobile device tenant rule in Basic Mobility and Security in Microsoft 365.

Quick start script

# Set-DeviceTenantRule — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-DeviceTenantRule
$before | Format-List

# 3. Make the change (dry run first)
Set-DeviceTenantRule -Identity <ComplianceRuleIdParameter> -WhatIf
Set-DeviceTenantRule -Identity <ComplianceRuleIdParameter>

# 4. Verify and diff
$after = Get-DeviceTenantRule
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-DeviceTenantRule [-Identity] <ComplianceRuleIdParameter>
 [-ApplyPolicyTo <PolicyResourceScope>]
 [-BlockUnsupportedDevices <Boolean>]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-ExclusionList <MultiValuedProperty>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (7)

Parameter	Type	Required	What it controls
-Identity	ComplianceRuleIdParameter	yes	The Identity parameter specifies the name of the mobile device tenant rule that you want to modify, but there's only one in your organization. The name of the rule is a GUID. For example,...
-ApplyPolicyTo	PolicyResourceScope		The ApplyPolicyTo parameter specifies where to apply the policy in your organization. Valid values for this parameter are:
-BlockUnsupportedDevices	Boolean		The BlockUnsupportedDevices parameter specifies whether to block access to your organization by unsupported devices. Valid values for this parameter are:
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DomainController	Fqdn		This parameter is reserved for internal Microsoft use.
-ExclusionList	MultiValuedProperty		The ExclusionList parameter specifies the security groups to exclude from this policy. Members of the specified security groups who have non-compliant devices are not affected by block access actions.
-WhatIf	SwitchParameter		The WhatIf switch doesn't work in Security & Compliance PowerShell.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.