Commands › Exchange Online

Set-SmimeConfig

Exchange Online ExchangeOnlineManagement Set-*

Modify the S/MIME configuration for Outlook on the web (formerly known as Outlook Web App or OWA) and new Outlook for Windows.

Quick start script

# Set-SmimeConfig — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-SmimeConfig
$before | Format-List

# 3. Make the change (dry run first)
Set-SmimeConfig  -WhatIf
Set-SmimeConfig

# 4. Verify and diff
$after = Get-SmimeConfig
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-SmimeConfig [[-Identity] <OrganizationIdParameter>]
 [-Confirm]
 [-OWAAllowUserChoiceOfSigningCertificate <Boolean>]
 [-OWAAlwaysEncrypt <Boolean>]
 [-OWAAlwaysSign <Boolean>]
 [-OWABCCEncryptedEmailForking <UInt32>]
 [-OWACheckCRLOnSend <Boolean>]
 [-OWAClearSign <Boolean>]
 [-OWACopyRecipientHeaders <Boolean>]
 [-OWACRLConnectionTimeout <UInt32>]
 [-OWACRLRetrievalTimeout <UInt32>]
 [-OWADisableCRLCheck <Boolean>]
 [-OWADLExpansionTimeout <UInt32>]
 [-OWAEncryptionAlgorithms <String>]
 [-OWAEncryptTemporaryBuffers <Boolean>]
 [-OWAForceSMIMEClientUpgrade <Boolean>]
 [-OWAIncludeCertificateChainAndRootCertificate <Boolean>]
 [-OWAIncludeCertificateChainWithoutRootCertificate <Boolean>]
 [-OWAIncludeSMIMECapabilitiesInMessage <Boolean>]
 [-OWAOnlyUseSmartCard <Boolean>]
 [-OWASenderCertificateAttributesToDisplay <String>]
 [-OWASignedEmailCertificateInclusion <Boolean>]
 [-OWASigningAlgorithms <String>]
 [-OWATripleWrapSignedEncryptedMail <Boolean>]
 [-OWAUseKeyIdentifier <Boolean>]
 [-OWAUseSecondaryProxiesWhenFindingCertificates <Boolean>]
 [-NoSignOnReply <Boolean>]
 [-SMIMECertificateIssuingCA <Byte[]>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (29)

Parameter	Type	What it controls
-Identity	OrganizationIdParameter	This parameter is reserved for internal Microsoft use.
-Confirm	SwitchParameter	This parameter is reserved for internal Microsoft use.
-OWAAllowUserChoiceOfSigningCertificate	Boolean	The OWAAllowUserChoiceOfSigningCertificate parameter specifies whether to allow users to select the certificate to use when they digitally sign email messages in Outlook on the web. Valid values are:
-OWAAlwaysEncrypt	Boolean	The OWAAlwaysEncrypt parameter specifies whether all outgoing messages are automatically encrypted in Outlook on the web.
-OWAAlwaysSign	Boolean	The OWAAlwaysSign parameter specifies whether all outgoing messages are automatically signed in Outlook on the web.
-OWABCCEncryptedEmailForking	UInt32	The OWABCCEncryptedEmailForking parameter specifies how Bcc messages are encrypted in Outlook on the web. Valid values are:
-OWACheckCRLOnSend	Boolean	The OWACheckCRLOnSend parameter specifies how the certificate revocation list (CRL) check is enforced when an email message is sent in Outlook on the web. Valid values are:
-OWAClearSign	Boolean	The OWAClearSign parameter specifies how email messages are signed in Outlook on the web. Valid values are:
-OWACopyRecipientHeaders	Boolean	This parameter is reserved for internal Microsoft use.
-OWACRLConnectionTimeout	UInt32	The OWACRLConnectionTimeout parameter specifies the time in milliseconds that Outlook on the web waits while connecting to retrieve a single CRL as part of a certificate validation operation.
-OWACRLRetrievalTimeout	UInt32	The OWACRLRetrievalTimeout parameter specifies the time in milliseconds that Outlook on the web waits to retrieve all CRLs when validating a certificate.
-OWADisableCRLCheck	Boolean	The OWADisableCRLCheck parameter enables or disables CRL checking in Outlook on the web. Valid values are:
-OWADLExpansionTimeout	UInt32	The OWADLExpansionTimeout parameter specifies the time in milliseconds that Outlook on the web waits when sending encrypted messages to members of a distribution group that requires expansion.
-OWAEncryptionAlgorithms	String	The OWAEncryptionAlgorithms parameter specifies a list of symmetric encryption algorithms that are used by Outlook on the web to encrypt messages. Valid values are:
-OWAEncryptTemporaryBuffers	Boolean	The OWAEncryptTemporaryBuffers parameter specifies whether the Outlook on the web client-side temporary message storage buffers are encrypted. Valid values are:
-OWAForceSMIMEClientUpgrade	Boolean	The OWAForceSMIMEClientUpgrade parameter specifies whether or not users are forced to upgrade an S/MIME control that's older than their current version in Outlook on the web.
-OWAIncludeCertificateChainAndRootCertificate	Boolean	The OWAIncludeCertificateChainAndRootCertificate parameter specifies whether the certificate chains and root certificates of the signing or encryption certificates are included in the message in Outlook on the web.
-OWAIncludeCertificateChainWithoutRootCertificate	Boolean	The OWAIncludeCertificateChainWithoutRootCertificate parameter specifies whether the certificate chains of the signing or encryption certificates are included in messages in Outlook on the web. Valid values are:
-OWAIncludeSMIMECapabilitiesInMessage	Boolean	The OWAIncludeSMIMECapabilitiesInMessage parameter specifies whether signed and encrypted messages in Outlook on the web include attributes that describe the supported encryption and signing algorithms.
-OWAOnlyUseSmartCard	Boolean	The OWAOnlyUseSmartCard parameter specifies whether smartcard-based certificates are required for Outlook on the web message signing and decryption. Valid values are:
-OWASenderCertificateAttributesToDisplay	String	The OWASenderCertificateAttributesToDisplay parameter controls which certificate attributes are displayed when signature verification proceeds despite a mismatch between the sender's email address and the email...
-OWASignedEmailCertificateInclusion	Boolean	The OWASignedEmailCertificateInclusion parameter specifies whether the sender's encryption certificate is excluded from a signed email message in Outlook on the web. Valid values are:
-OWASigningAlgorithms	String	The OWASigningAlgorithms parameter specifies the list of symmetric encryption signing algorithms that are used by Outlook on the web to sign messages with the S/MIME control. Valid values are:
-OWATripleWrapSignedEncryptedMail	Boolean	The OWATripleWrapSignedEncryptedMail parameter specifies whether signed and encrypted email messages in Outlook on the web are triple-wrapped. Valid values are:
-OWAUseKeyIdentifier	Boolean	The OWAUseKeyIdentifier parameter specifies whether a certificate's key identifier is used to encode the asymmetrically encrypted token in Outlook on the web.
-OWAUseSecondaryProxiesWhenFindingCertificates	Boolean	The OWAUseSecondaryProxiesWhenFindingCertificates parameter specifies whether alternative proxies are used during the certificate search in Outlook on the web.
-NoSignOnReply	Boolean	This parameter is available only in the cloud-based service.
-SMIMECertificateIssuingCA	Byte[]	The SMIMECertificateIssuingCA parameter specifies the serialized certificate store (SST) that contains the Certificate Authority (CA) signing and intermediate certificate information.
-WhatIf	SwitchParameter	The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.