Skip to content
RevoDocs

PowerShell console

Run PowerShell against a customer's Microsoft 365 tenant from the browser, with Microsoft Graph and Exchange Online ready, in a sandbox that reaches only Microsoft. Who can open one, how long it lasts, and what's recorded.

Updated

On this page

The PowerShell console is a PowerShell 7 terminal in the browser, already signed in to one customer's Microsoft 365 tenant. Use it for what the Microsoft 365 pages don't cover: a bulk change, a one-off report, a setting only a cmdlet reaches. Open it from the customer's Microsoft 365 page, PowerShell tab.

What's in it

  • Microsoft Graph PowerShell: Microsoft.Graph.Authentication, .Users, .Groups, .Identity.DirectoryManagement and .Identity.SignIns (2.41.2). It's connected when the console opens: try Get-MgUser -Top 10 or Get-MgSubscribedSku.
  • Exchange Online PowerShell (ExchangeOnlineManagement 3.10.1), connected when your workspace's app has Exchange management for this tenant (see Exchange). Try Get-Mailbox -ResultSize 10.

Nothing else can be installed: Install-Module fails, because the console can only reach Microsoft's sign-in, Graph and Exchange Online endpoints. It can't reach the internet, your network or Revo itself.

Who can open one

  • People with the Open a PowerShell console permission: owners and admins by default. It's never given to a person limited to selected customers.
  • You confirm two-factor authentication: if you haven't entered a code from your authenticator app in the last 15 minutes, Revo asks for one when you open the console. Two-factor must be on for your account.
  • RevoCloud is on for the customer, and its Microsoft 365 tenant is connected with your workspace's app.
  • API tokens can't open a console.

How the console signs in

Revo asks Microsoft for short-lived access tokens for this one tenant, with your workspace's Microsoft 365 app, and hands them to the console. Your app's client secret never enters the console. The console acts as the app, not as you: it can do what the app is allowed to do in the tenant, which is read-only unless your workspace turned on Management access (Settings → Integrations → Microsoft 365) and the customer's administrator consented to it.

How long it lasts

  • A console closes after 60 minutes (the tokens' life), after 15 minutes without typing (a minute before, it warns), when you sign out, or when you lose the permission. Typing exit or End console closes it too.
  • Closing the page doesn't close the console: open the tab again in the same browser to reconnect. A console opened in another browser can't be joined; end it to open one here.
  • One console per person per customer, and three per workspace at once.

What's recorded

  • Everything typed and everything shown is recorded, up to 1 MB per console (output past 768 KB isn't, but typing always is). Workspace owners read transcripts under Console sessions on the PowerShell tab; each read is in the audit log.
  • Opening and closing a console are in the audit log: who, which customer and tenant, how long, and why it ended.
  • Don't paste secrets you wouldn't want an owner to read later.

Exchange Online

Exchange Online PowerShell needs the app to hold Exchange management (Exchange.ManageAsApp) in the tenant, and the Exchange Administrator role. Turn on Management access for your workspace, then have the customer's administrator consent again. Until then the console connects Microsoft Graph only and says so when it opens.

Demo tenants

The demo workspace's tenants aren't connected to Microsoft 365. Their console opens anyway, with a note saying so: PowerShell itself works, so you can try the console, but Microsoft 365 cmdlets have no tenant to reach.