Commands › Exchange Online

Set-PolicyConfig

Exchange Online ExchangeOnlineManagement Set-*

For more information, see Security & Compliance PowerShell. Use the Set-PolicyConfig cmdlet to modify the endpoint restrictions that are configured in the organization.

Quick start script

# Set-PolicyConfig — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-PolicyConfig
$before | Format-List

# 3. Make the change (dry run first)
Set-PolicyConfig  -WhatIf
Set-PolicyConfig

# 4. Verify and diff
$after = Get-PolicyConfig
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-PolicyConfig [[-Identity] <OrganizationIdParameter>]
 [-AggregationTimeWindowForDlpAlerts <System.UInt32>]
 [-CaseHoldPolicyLimit <Int32>]
 [-ClassificationScheme <ClassificationScheme>]
 [-ComplianceUrl <String>]
 [-Confirm]
 [-DlpAppGroups <PswsHashtable[]>]
 [-DlpAppGroupsPsws <PswsHashtable[]>]
 [-DlpExtensionGroups <PswsHashtable[]>]
 [-DlpNetworkShareGroups <PswsHashtable>]
 [-DlpPrinterGroups <PswsHashtable>]
 [-DlpRemovableMediaGroups <PswsHashtable>]
 [-DocumentIsUnsupportedSeverity <RuleSeverity>]
 [-EnableAdvancedRuleBuilder <Boolean>]
 [-EnableLabelCoauth <Boolean>]
 [-EnableSpoAipMigration <Boolean>]
 [-EndpointDlpGlobalSettings <PswsHashtable[]>]
 [-EndpointDlpGlobalSettingsPsws <PswsHashtable[]>]
 [-ExtendTeamsDlpPoliciesToSharePointOneDrive <Boolean>]
 [-InformationBarrierMode <InformationBarrierMode>]
 [-InformationBarrierPeopleSearchRestriction <InformationBarrierPeopleSearchRestriction>]
 [-IsDlpSimulationOptedIn <Boolean>]
 [-IsUserBaseDlpAlertAggregationEnabled <Boolean>]
 [-MigrateLabelScheme]
 [-MigrateLabelSchemeDisplayNames <System.Collections.Hashtable[]>]
 [-OnPremisesWorkload <Workload>]
 [-ProcessingLimitExceededSeverity <RuleSeverity>]
 [-PurviewLabelConsent <Boolean>]
 [-ReservedForFutureUse <Boolean>]
 [-RetentionForwardCrawl <Boolean>]
 [-RuleErrorAction <PolicyRuleErrorAction>]
 [-SenderAddressLocation <PolicySenderAddressLocation>]
 [-SiteGroups <PswsHashtable[]>]
 [-SiteGroupsPsws <PswsHashtable[]>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (35)

Parameter	Type	What it controls
-Identity	OrganizationIdParameter	You don't need to use this parameter. The only endpoint restrictions object in the organization is named Settings.
-AggregationTimeWindowForDlpAlerts	UInt32	{{ Fill AggregationTimeWindowForDlpAlerts Description }}
-CaseHoldPolicyLimit	Int32	{{ Fill CaseHoldPolicyLimit Description }}
-ClassificationScheme	ClassificationScheme	{{ Fill ClassificationScheme Description }}
-ComplianceUrl	String	{{ Fill ComplianceUrl Description }}
-Confirm	SwitchParameter	The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DlpAppGroups	PswsHashtable[]	{{ Fill DlpAppGroups Description }}
-DlpAppGroupsPsws	PswsHashtable[]	{{ Fill DlpAppGroupsPsws Description }}
-DlpExtensionGroups	PswsHashtable[]	{{ Fill DlpExtensionGroups Description }}
-DlpNetworkShareGroups	PswsHashtable	{{ Fill DlpNetworkShareGroups Description }}
-DlpPrinterGroups	PswsHashtable	{{ Fill DlpPrinterGroups Description }}
-DlpRemovableMediaGroups	PswsHashtable	{{ Fill DlpRemovableMediaGroups Description }}
-DocumentIsUnsupportedSeverity	RuleSeverity	{{ Fill DocumentIsUnsupportedSeverity Description }}
-EnableAdvancedRuleBuilder	Boolean	{{ Fill EnableAdvancedRuleBuilder Description }}
-EnableLabelCoauth	Boolean	The EnableLabelCoauth parameter enables or disables co-authoring support in Office desktop apps for the entire organization. Valid value are:
-EnableSpoAipMigration	Boolean	The EnableSpoAipMigration parameter enables or disables built-in labeling for supported Office files in SharePoint and OneDrive. Valid values are:
-EndpointDlpGlobalSettings	PswsHashtable[]	The EndpointDlpGlobalSettings parameter specifies the global endpoints. This parameter uses the following syntax: `@(@{"Setting"="<Setting>"; "Value"="<Value>}",@{"Setting"="<Setting>"; "Value"="<Value>"},...)`.
-EndpointDlpGlobalSettingsPsws	PswsHashtable[]	{{ Fill EndpointDlpGlobalSettingsPsws Description }}
-ExtendTeamsDlpPoliciesToSharePointOneDrive	Boolean	The ExtendTeamsDlpPoliciesToSharePointOneDrive parameter enables the Teams DLP Policy to automatically extend protection to the content stored in OneDrive shared in 1:1 chats and content stored in SharePoint...
-InformationBarrierMode	InformationBarrierMode	The InformationBarrierMode parameter specifies the mode that controls the total number of segments and how many segments a user can be part of. Valid values are:
-InformationBarrierPeopleSearchRestriction	InformationBarrierPeopleSearchRestriction	{{ Fill InformationBarrierPeopleSearchRestriction Description }}
-IsDlpSimulationOptedIn	Boolean	{{ Fill IsDlpSimulationOptedIn Description }}
-IsUserBaseDlpAlertAggregationEnabled	Boolean	{{ Fill IsUserBaseDlpAlertAggregationEnabled Description }}
-MigrateLabelScheme	SwitchParameter	{{ Fill MigrateLabelScheme Description }}
-MigrateLabelSchemeDisplayNames	Hashtable[]	{{ Fill MigrateLabelSchemeDisplayNames Description }}
-OnPremisesWorkload	Workload	{{ Fill OnPremisesWorkload Description }}
-ProcessingLimitExceededSeverity	RuleSeverity	{{ Fill ProcessingLimitExceededSeverity Description }}
-PurviewLabelConsent	Boolean	{{ Fill PurviewLabelConsent Description }}
-ReservedForFutureUse	Boolean	{{ Fill ReservedForFutureUse Description }}
-RetentionForwardCrawl	Boolean	{{ Fill RetentionForwardCrawl Description }}
-RuleErrorAction	PolicyRuleErrorAction	The RuleErrorAction parameter specifies what to do if an error is encountered during the evaluation of the rule. Valid values are:
-SenderAddressLocation	PolicySenderAddressLocation	The SenderAddressLocation parameter specifies where to look for sender addresses in conditions and exceptions that examine sender email addresses. Valid values are:
-SiteGroups	PswsHashtable[]	{{ Fill SiteGroups Description }}
-SiteGroupsPsws	PswsHashtable[]	{{ Fill SiteGroupsPsws Description }}
-WhatIf	SwitchParameter	The WhatIf switch doesn't work in Security & Compliance PowerShell.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.