Commands › Exchange Online
Test-ClientAccessRule
> [!NOTE] > Client access rules were deprecated for all Exchange Online organizations in September 2025. For more information, see Update on Client Access Rules Deprecation in Exchange Online. This cmdlet is functional only in Exchange Server 2019 or later. Use the Test-ClientAccessRule cmdlet to test how client access rules affect access to your organization. If any of the client properties you specify for this cmdlet match any client access rules, the rules are returned in the results.
Quick start script
# Test-ClientAccessRule — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org
# 2. Run and inspect
Test-ClientAccessRule -AuthenticationType <ClientAccessAuthenticationMethod> -Protocol <ClientAccessProtocol> -RemoteAddress <IPAddress> | Format-List
# 3. Export for evidence / drift tracking
Test-ClientAccessRule | Export-Clixml .\ClientAccessRule-$(Get-Date -Format yyyyMMdd).xmlSyntax
Test-ClientAccessRule -AuthenticationType <ClientAccessAuthenticationMethod> -Protocol <ClientAccessProtocol> -RemoteAddress <IPAddress> -RemotePort <Int32> -User <MailboxIdParameter>
[-Confirm]
[-OAuthClaims <Hashtable>]
[-WhatIf]
[<CommonParameters>]Parameters (8)
| Parameter | Type | Required | What it controls |
|---|---|---|---|
| -AuthenticationType | ClientAccessAuthenticationMethod | yes | The AuthenticationType parameter specifies the client authentication type to test. |
| -Protocol | ClientAccessProtocol | yes | The Protocol parameter specifies the client protocol to test. |
| -RemoteAddress | IPAddress | yes | The RemoteAddress parameter specifies the client IP address to test. Valid input for this parameter is an IP address. For example, 192.168.1.50. |
| -RemotePort | Int32 | yes | The RemotePort parameter specifies the client TCP port to test. Valid input for this parameter is an integer from 1 to 65535. |
| -User | MailboxIdParameter | yes | The User parameter specifies the user account to test. |
| -Confirm | SwitchParameter | The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding. | |
| -OAuthClaims | Hashtable | The OAuthClaims parameter specifies the OAuth claims token of a middle-tier app. | |
| -WhatIf | SwitchParameter | The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch. |
Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.