MicrosoftDocs · Chris Davis (chrisda) · Jun 12, 2026 · Jun 12, 2026 · Jun 17, 2026 · Jun 17, 2026
diff --git a/exchange/docs-conceptual/app-only-auth-powershell-v2.md b/exchange/docs-conceptual/app-only-auth-powershell-v2.md
@@ -1,20 +1,22 @@
 ---
-title: App-only authentication in Exchange Online PowerShell and Security & Compliance PowerShell
-ms.date: 03/11/2026
+title: App-only authentication for unattended scripts
+ms.date: 07/31/2026
 ms.audience: Admin
 ms.topic: article
 ms.service: exchange-online
 ms.reviewer:
 ms.localizationpriority: high
+ai-usage: ai-assisted
 ms.collection: Strat_EX_Admin
-ms.custom:
+ms.custom: msecd-doc-authoring-1015
 ms.assetid:
-description: "Learn how to configure app-only authentication (also known as certificate based authentication or CBA) using the Exchange Online PowerShell V3 module in scripts and other long-running tasks."
+description: "Learn how to configure certificate-based app-only authentication for unattended scripts in the Exchange Online PowerShell module."
+#customer intent: As an admin, I want to configure app-only authentication so that unattended PowerShell scripts don't require user credentials.
 ---
 
-# App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell
+# App-only authentication for unattended scripts
 
-Auditing and reporting scenarios in Microsoft 365 often involve unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell. In the past, unattended sign in required you to store the username and password in a local file or in a secret vault accessed at run-time. But, as we all know, storing user credentials locally isn't a good security practice.
+Auditing and reporting scenarios in Microsoft 365 often involve unattended scripts in [Exchange Online PowerShell](exchange-online-powershell.md), [Security & Compliance PowerShell](scc-powershell.md), and [Microsoft Defender for Office 365 PowerShell](defender-office-365-powershell-overview.md). In the past, unattended sign in required you to store the username and password in a local file or in a secret vault accessed at run-time. But, as we all know, storing user credentials locally isn't a good security practice.
 
 Certificate based authentication (CBA) or app-only authentication as described in this article supports unattended script and automation scenarios by using Microsoft Entra apps and certificates.
 
@@ -25,11 +27,16 @@ Certificate based authentication (CBA) or app-only authentication as described i
 > - The features and procedures described in this article require the following versions of the Exchange Online PowerShell module:
 >   - **Exchange Online PowerShell (Connect-ExchangeOnline)**: Version 2.0.4 or later.
 >   - **Security & Compliance PowerShell (Connect-IPPSSession)**: Version 3.0.0 or later.
+>   - **Defender for Office 365 PowerShell (Connect-DefenderForOffice365)**: Version 3.10.2-Preview1 or later.
 >
 >   For instructions on how to install or update the module, see [Install and update the Exchange Online PowerShell module](exchange-online-powershell-v2.md#install-and-update-the-exchange-online-powershell-module). For instructions on how to use the module in Azure Automation, see [Manage modules in Azure Automation](/azure/automation/shared-resources/modules).
 >
 > - CBA or app-only authentication is available in Office 365 operated by 21Vianet in China.
 >
+> - Defender for Office 365 PowerShell isn't currently available in Office 365 operated by 21Vianet.
+>
+> - App-only Defender for Office 365 PowerShell connections use Microsoft Entra role assignments. Unified RBAC role assignments for service principals aren't currently supported.
+>
 > - REST API connections in the Exchange Online PowerShell V3 module require the PowerShellGet and PackageManagement modules. For more information, see [PowerShellGet for REST-based connections in Windows](exchange-online-powershell-v2.md#powershellget-for-rest-api-connections-in-windows).
 >
 > - If the procedures in this article don't work for you, verify you don't have preview versions of the PackageManagement or PowerShellGet modules installed by running the following command: `Get-InstalledModule PackageManagement -AllVersions; Get-InstalledModule PowerShellGet -AllVersions`.
@@ -104,6 +111,12 @@ The following examples show how to use the Exchange Online PowerShell module wit
     Connect-IPPSSession -CertificateThumbPrint "012THISISADEMOTHUMBPRINT" -AppID "36ee4c6c-0812-40a2-b820-b22ebd02bce3" -Organization "contosoelectronics.onmicrosoft.com"
     ```
 
+  - <u>Defender for Office 365 PowerShell</u>:
+
+    ```powershell
+    Connect-DefenderForOffice365 -CertificateThumbPrint "012THISISADEMOTHUMBPRINT" -AppID "36ee4c6c-0812-40a2-b820-b22ebd02bce3" -Organization "contosoelectronics.onmicrosoft.com"
+    ```
+
 - **Connect using a certificate object**:
 
   The certificate doesn't need to be installed on the computer where you're running the command. You can store the certificate object remotely. The certificate is fetched when the script is run.
@@ -120,6 +133,12 @@ The following examples show how to use the Exchange Online PowerShell module wit
     Connect-IPPSSession -Certificate <%X509Certificate2 Object%> -AppID "36ee4c6c-0812-40a2-b820-b22ebd02bce3" -Organization "contosoelectronics.onmicrosoft.com"
     ```
 
+  - <u>Defender for Office 365 PowerShell</u>:
+
+    ```powershell
+    Connect-DefenderForOffice365 -Certificate <%X509Certificate2 Object%> -AppID "36ee4c6c-0812-40a2-b820-b22ebd02bce3" -Organization "contosoelectronics.onmicrosoft.com"
+    ```
+
 - **Connect using a local certificate**:
 
   > [!NOTE]
@@ -137,6 +156,12 @@ The following examples show how to use the Exchange Online PowerShell module wit
     Connect-IPPSSession -CertificateFilePath "C:\Users\navin\Desktop\automation-cert.pfx" -CertificatePassword (Get-Credential).password -AppID "36ee4c6c-0812-40a2-b820-b22ebd02bce3" -Organization "contosoelectronics.onmicrosoft.com"
     ```
 
+  - <u>Defender for Office 365 PowerShell</u>:
+
+    ```powershell
+    Connect-DefenderForOffice365 -CertificateFilePath "C:\Users\navin\Desktop\automation-cert.pfx" -CertificatePassword (Get-Credential).password -AppID "36ee4c6c-0812-40a2-b820-b22ebd02bce3" -Organization "contosoelectronics.onmicrosoft.com"
+    ```
+
 ## Set up app-only authentication
 
 An initial onboarding is required for authentication using application objects. Application and service principal are used interchangeably, but an application is like a class object while a service principal is like an instance of the class. For more information, see [Application and service principal objects in Microsoft Entra ID](/entra/identity-platform/app-objects-and-service-principals).

diff --git a/exchange/docs-conceptual/connect-to-defender-for-office-365-powershell.md b/exchange/docs-conceptual/connect-to-defender-for-office-365-powershell.md
@@ -0,0 +1,129 @@
+---
+title: Connect to Microsoft Defender for Office 365 PowerShell
+ms.date: 07/31/2026
+ms.audience: Admin
+ms.topic: how-to
+ms.reviewer:
+ms.localizationpriority: high
+ai-usage: ai-assisted
+ms.collection: Strat_EX_Admin
+ms.custom: msecd-doc-authoring-1015
+ms.assetid:
+description: "Learn how to connect to Microsoft Defender for Office 365 PowerShell to manage Defender portal features by using Defender Unified RBAC permissions."
+#customer intent: As a security admin, I want to connect to Microsoft Defender for Office 365 PowerShell so that I can manage features by using Defender Unified RBAC permissions.
+---
+
+# Connect to Microsoft Defender for Office 365 PowerShell
+
+[Microsoft Defender for Office 365 PowerShell](defender-office-365-powershell-overview.md) provides a security-focused subset of Exchange Online PowerShell cmdlets for customers who use [Defender Unified role-based access control (RBAC)](/defender-xdr/manage-rbac) permissions in the Microsoft Defender portal. This article describes the prerequisites and connection methods and explains how to verify and disconnect the connection.
+
+## Prerequisites
+
+- The **Connect-DefenderForOffice365** cmdlet is available in version 3.10.2-Preview1 or later of the Exchange Online PowerShell module. For installation instructions and module prerequisites, see [About the Exchange Online PowerShell module](exchange-online-powershell-v2.md).
+
+- Defender for Office 365 PowerShell is available in Microsoft 365, Microsoft 365 GCC, Microsoft 365 GCC High, and Microsoft 365 DoD.
+
+- For user connections, your available cmdlets are based on your effective permissions in Defender Unified RBAC.
+
+- App-only connections use Microsoft Entra role assignments. Unified RBAC role assignments for service principals aren't currently supported.
+
+## Choose the correct PowerShell connection
+
+- Use Defender for Office 365 PowerShell instead of [Exchange Online PowerShell](connect-to-exchange-online-powershell.md) to manage features in the Defender portal when the **Email & collaboration** workload is active in [Microsoft Defender Unified RBAC](/defender-xdr/manage-rbac).
+
+- Use [Security & Compliance PowerShell](connect-to-scc-powershell.md) for Microsoft Purview compliance administration.
+
+> [!IMPORTANT]
+> If you open connections to more than one PowerShell environment in the same PowerShell window, cmdlets from the most recent connection take precedence. To avoid running a cmdlet in the wrong authorization context, use separate PowerShell windows or the _Prefix_ parameter.
+
+## Step 1: Load the Exchange Online PowerShell module
+
+> [!NOTE]
+> If the module is already installed, you can typically skip this step and run **Connect-DefenderForOffice365** without manually loading the module first.
+
+After you [install the module](exchange-online-powershell-v2.md#install-and-update-the-exchange-online-powershell-module), import it to make the connection cmdlets available:
+
+```powershell
+Import-Module ExchangeOnlineManagement
+```
+
+## Step 2: Connect and authenticate
+
+For detailed syntax and parameter information, see [Connect-DefenderForOffice365](/powershell/module/exchangepowershell/connect-defenderforoffice365).
+
+### Connect with an interactive sign-in prompt
+
+- This example connects to Defender for Office 365 PowerShell in a Microsoft 365 or Microsoft 365 GCC organization:
+
+  ```powershell
+  Connect-DefenderForOffice365 -UserPrincipalName admin@contoso.com
+  ```
+
+- This example connects in a Microsoft 365 GCC High organization:
+
+  ```powershell
+  Connect-DefenderForOffice365 -UserPrincipalName admin@contoso.us -ConnectionUri https://ps.security.protection.office365.us/PowerShell-LiveId -AzureADAuthorizationEndpointUri https://login.microsoftonline.us/organizations
+  ```
+
+- This example connects in a Microsoft 365 DoD organization:
+
+  ```powershell
+  Connect-DefenderForOffice365 -UserPrincipalName admin@adatum.mil -ConnectionUri https://ps.security.protection.office365.us/PowerShell-LiveId -AzureADAuthorizationEndpointUri https://login.microsoftonline.us/organizations
+  ```
+
+In the sign-in window that opens, enter your password, and then select **Sign in**. If the account uses multifactor authentication (MFA), complete the verification request.
+
+### Connect by using app-only authentication
+
+The following command connects by using a certificate thumbprint:
+
+```powershell
+Connect-DefenderForOffice365 -AppId 36ee4c6c-0812-40a2-b820-b22ebd02bce3 -CertificateThumbprint 012THISISADEMOTHUMBPRINT -Organization contoso.onmicrosoft.com
+```
+
+For the configuration steps and other certificate methods, see [App-only authentication for unattended scripts](app-only-auth-powershell-v2.md).
+
+> [!NOTE]
+> App-only connections use Microsoft Entra role assignments. Unified RBAC role assignments for service principals aren't currently supported.
+
+### Connect to a customer organization
+
+The following command connects to a customer organization by using delegated administration:
+
+```powershell
+Connect-DefenderForOffice365 -UserPrincipalName admin@contoso.com -DelegatedOrganization adatum.onmicrosoft.com -AzureADAuthorizationEndpointUri https://login.microsoftonline.com/adatum.onmicrosoft.com
+```
+
+For more information about delegated administration, see [Introduction to granular delegated admin privileges (GDAP)](/partner-center/gdap-introduction).
+
+## How do you know you connected successfully?
+
+If you don't receive any errors, you connected successfully. Run the following command to identify Microsoft Defender for Office 365 connections:
+
+```powershell
+Get-ConnectionInformation | Where-Object {$_.IsMdoSecuritySession -eq $true}
+```
+
+You can also run a Microsoft Defender for Office 365 cmdlet available to your assigned Unified RBAC permissions and review the results.
+
+## Step 3: Disconnect when you're finished
+
+To disconnect the Defender for Office 365 PowerShell session, run the following command:
+
+```powershell
+Disconnect-ExchangeOnline
+```
+
+To silently disconnect without a confirmation prompt, run the following command:
+
+```powershell
+Disconnect-ExchangeOnline -Confirm:$false
+```
+
+## Related content
+
+- [Microsoft Defender for Office 365 PowerShell overview](defender-office-365-powershell-overview.md)
+- [Connect to Exchange Online PowerShell](connect-to-exchange-online-powershell.md)
+- [Connect to Security & Compliance PowerShell](connect-to-scc-powershell.md)
+- [About the Exchange Online PowerShell module](exchange-online-powershell-v2.md)
+- [Microsoft Defender Unified RBAC](/defender-xdr/manage-rbac)
diff --git a/exchange/docs-conceptual/connect-to-exchange-online-powershell.md b/exchange/docs-conceptual/connect-to-exchange-online-powershell.md
@@ -1,20 +1,25 @@
 ---
 title: Connect to Exchange Online PowerShell
-ms.date: 07/11/2025
+ms.date: 07/31/2026
 ms.audience: Admin
 ms.topic: article
 ms.reviewer:
 ms.localizationpriority: high
+ai-usage: ai-assisted
 ms.collection: Strat_EX_Admin
-ms.custom:
+ms.custom: msecd-doc-authoring-1015
 ms.assetid:
-description: "Learn how to use the Exchange Online PowerShell V3 module to connect to Exchange Online PowerShell with modern authentication and/or multifactor authentication (MFA)."
+description: "Learn how to connect to Exchange Online PowerShell by using the Exchange Online PowerShell module with modern authentication and multifactor authentication (MFA)."
+#customer intent: As an Exchange admin, I want to connect to Exchange Online PowerShell so that I can manage email and security features in my cloud-based organization from the command line.
 ---
 
 # Connect to Exchange Online PowerShell
 
 This article contains instructions for how to connect to Exchange Online PowerShell using the Exchange Online PowerShell module with or without multifactor authentication (MFA).
 
+> [!NOTE]
+> If you use [Microsoft Defender Unified RBAC](/defender-xdr/manage-rbac) permissions for features in the Defender portal, [connect to Microsoft Defender for Office 365 PowerShell](connect-to-defender-for-office-365-powershell.md) instead.
+
 > [!TIP]
 > The connection instructions in this article also apply to [the Built-in security add-on for on-premises mailboxes](/exchange/standalone-eop/standalone-eop).
 
@@ -159,7 +164,7 @@ The connection examples in the following sections use modern authentication, and
 
 ### Connect to Exchange Online PowerShell without a sign in prompt (unattended scripts)
 
-For complete instructions, see [App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell](app-only-auth-powershell-v2.md).
+For complete instructions, see [App-only authentication for unattended scripts](app-only-auth-powershell-v2.md).
 
 ### Connect to Exchange Online PowerShell in customer organizations
 
@@ -416,7 +421,7 @@ This section attempts to compare older connection methods the Exchange Online Po
     Connect-ExchangeOnline -CertificateFilePath "C:\Users\navin\Desktop\automation-cert.pfx" -CertificatePassword (ConvertTo-SecureString -String "<Password>" -AsPlainText -Force) -AppID "36ee4c6c-0812-40a2-b820-b22ebd02bce3" -Organization "contoso.onmicrosoft.com"
     ```
 
-  For more information, see [App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell](app-only-auth-powershell-v2.md).
+  For more information, see [App-only authentication for unattended scripts](app-only-auth-powershell-v2.md).
 
 - **Basic authentication**:
 

diff --git a/exchange/docs-conceptual/connect-to-scc-powershell.md b/exchange/docs-conceptual/connect-to-scc-powershell.md
@@ -1,20 +1,25 @@
 ---
 title: Connect to Security & Compliance PowerShell
-ms.date: 06/04/2026
+ms.date: 07/31/2026
 ms.audience: Admin
 ms.topic: article
 ms.reviewer:
 ms.localizationpriority: high
+ai-usage: ai-assisted
 ms.collection: Strat_EX_Admin
-ms.custom:
+ms.custom: msecd-doc-authoring-1015
 ms.assetid:
-description: "Learn how to use the Exchange Online PowerShell V3 module to connect to Security & Compliance PowerShell with modern authentication and/or multifactor authentication (MFA)."
+description: "Learn how to connect to Security & Compliance PowerShell with modern and multifactor authentication (MFA) in the Exchange Online PowerShell module."
+#customer intent: As a compliance admin, I want to connect to Security & Compliance PowerShell so that I can manage Microsoft Purview compliance features.
 ---
 
 # Connect to Security & Compliance PowerShell
 
 This article contains instructions for how to connect to Security & Compliance PowerShell using the Exchange Online PowerShell module with or without multifactor authentication (MFA).
 
+> [!NOTE]
+> Use Security & Compliance PowerShell for Microsoft Purview compliance administration. If you use [Microsoft Defender Unified RBAC](/defender-xdr/manage-rbac) permissions for features in the Defender portal, [connect to Microsoft Defender for Office 365 PowerShell](connect-to-defender-for-office-365-powershell.md) instead.
+
 The Exchange Online PowerShell module uses modern authentication for connecting to Exchange Online PowerShell and Security & Compliance PowerShell. For more information about the Exchange Online PowerShell module, see [About the Exchange Online PowerShell module](exchange-online-powershell-v2.md).
 
 To connect to Security & Compliance PowerShell for automation, see [App-only authentication for unattended scripts](app-only-auth-powershell-v2.md).
@@ -125,7 +130,7 @@ For detailed syntax and parameter information, see [Connect-IPPSSession](/powers
 
 ### Connect to Security & Compliance PowerShell without a sign in prompt (unattended scripts)
 
-For complete instructions, see [App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell](app-only-auth-powershell-v2.md).
+For complete instructions, see [App-only authentication for unattended scripts](app-only-auth-powershell-v2.md).
 
 ### Connect to Security & Compliance PowerShell in customer organizations