Client Access Rule syntax

Question

Hi

Looking to block access to Exchange Online PowerShell via a client access rule for all users with exception of IT staff and need to be cautious to not lock everyone out of the tenant. Can anyone advise if the below syntax looks right to block all users with exception of specific accounts. This is cloud only, no hybrid:

New-ClientAccessRule -Name "Deny Access to RemotePowerShell" -Action DenyAccess -AnyOfProtocols RemotePowerShell -Enabled $true -UsernameMatchesAnyOfPatterns * -ExceptUsernameMatchesAnyOfPatterns *user1,*user2 -Priority 8 -Scope Users

Thanks in advance

Answer 1

You can use the Test-ClientAccessRule to check this. As a best practice, you should add a default "allow Remote PowerShell" rule and scope it to at least few users.

Answer 2

Thank you Michev. The plan was to create an allow rule with priority 1 to allow access to 2 IT staff and then create the deny rule.