Run Microsoft 365 PowerShell in Your Browser with PowerShell Mode

PowerShell mode opens a PowerShell 7 terminal in your browser that is already connected to Exchange Online, Security & Compliance, and more.

Before you begin

  • The powershell.run permission. Only administrators have it by default; you can add it to a custom role.
  • The PowerShell Mode setting turned on in the Configuration Matrix (it is on by default)
  • A Microsoft 365 account with the admin roles you need for the commands you plan to run

What PowerShell mode is, and what it is not

PowerShell mode is a terminal for managing your Microsoft 365 directory. It is not a shell on your session hosts or on any other machine you manage: commands run in a temporary sandbox that Atlas creates for your session, not on your VMs. To run scripts on session hosts, use the Script Repository; to work on a managed device, use Atlas Reach.

Commands run with your own Microsoft 365 permissions. Exchange and Microsoft Entra apply your own admin roles, and Microsoft's audit logs record your name. Atlas never gives the terminal its own app identity.

Start a session

  1. Go to Microsoft 365 → PowerShell.
  2. Click Start session. Atlas reuses your existing Microsoft sign-in, so you are not asked to sign in again.
  3. Wait while Atlas starts a fresh sandbox. This usually takes one to two minutes.
  4. When the status reads Connected, click the terminal and start typing. Above the terminal, Atlas shows the account you are signed in as and whether Exchange Online, Security & Compliance, and Microsoft Graph each connected.

Grant consent the first time

Exchange Online needs no extra consent. Microsoft Graph does: the first time PowerShell mode is used in your directory, the session may start without Graph and the page shows Grant consent. Click it to open the Microsoft Entra consent screen once, where an administrator can consent for the whole organization. Your own Entra roles still limit what you can do with Graph.

If Security & Compliance shows Not connected, your directory has nothing consented for it yet. The terminal still starts, with Exchange Online and Graph available.

End a session

Type exit, click End session, or close the tab. The sandbox is deleted as soon as the session ends. A session also ends on its own:

  • after 20 minutes without activity;
  • after 60 minutes in total, or sooner if your Microsoft sign-in expires first.

Nothing is kept between sessions. Each new session starts from a clean sandbox, so save any output you need before you end it.

Home tenant only

PowerShell mode works only in the Microsoft Entra directory you signed in to Atlas with. If you manage several customer tenants, you cannot use it to run commands in their directories. It works in commercial Microsoft 365, GCC, and GCC High; Atlas connects to the right endpoints for your cloud automatically.

Turn it on or off

  • Who can use it: grant or remove the powershell.run permission. People without it do not see PowerShell in the sidebar.
  • Where it is allowed: switch PowerShell Mode on or off in the Configuration Matrix, globally or for a single tenant. Turning it off blocks new sessions.

Auditing

Atlas records an audit entry when a session starts and another when it ends. The end entry includes why the session ended, how long it lasted, which services were connected, and a transcript of the terminal output. The transcript is capped in size, and anything that looks like an access token is removed from it.

Requirements for your deployment

Sandboxes are created in your Atlas deployment's own resource group. New deployments are set up for this automatically. On an older deployment, PowerShell mode may need:

  • the Azure Container Instances Contributor Role for the Atlas App Service's managed identity on its resource group;
  • the Microsoft.ContainerInstance resource provider registered on the subscription;
  • outbound access to pull the sandbox image from ghcr.io.
RG=<atlas-resource-group>; APP=<atlas-app-service-name>
az role assignment create \
  --assignee "$(az webapp identity show -g "$RG" -n "$APP" --query principalId -o tsv)" \
  --role "Azure Container Instances Contributor Role" \
  --scope "$(az group show -n "$RG" --query id -o tsv)"
az provider register --namespace Microsoft.ContainerInstance

If something is missing, the PowerShell page shows the Azure error and the command that fixes it. The commands above grant the role and register the provider; run them in Azure Cloud Shell.

Troubleshooting

  • Your Microsoft sign-in has expired: sign out of Atlas, sign in again, then start PowerShell.
  • Your browser is signed in to Microsoft with a different account than Atlas: use the same account in both, then try again.
  • PowerShell needs your one-time consent: click Grant consent, or ask an administrator to consent for the organization.
  • PowerShell isn't available: the reason is shown on the page. PowerShell mode may be turned off for your tenant, or the deployment requirements above may be missing.
  • You do not see PowerShell in the sidebar: you do not have the powershell.run permission. Ask an administrator.

Next steps