Exchange Mailbox Features: Enabling or Disabling by OU

When you need to enable or disable specific mailbox features — OWA, ActiveSync, IMAP, POP — for a whole department or site, doing it mailbox-by-mailbox in the EAC is slow. Exchange PowerShell lets you target every mailbox in a given Organizational Unit in one pass.

Example — Disable IMAP and POP for an OU

Get-User -OrganizationalUnit "contoso.com/Sales" -ResultSize Unlimited | Get-Mailbox | Set-CASMailbox -ImapEnabled $false -PopEnabled $false

Example — Re-enable OWA for the Same OU

Get-User -OrganizationalUnit "contoso.com/Sales" -ResultSize Unlimited | Get-Mailbox | Set-CASMailbox -OWAEnabled $true

Get-User -OrganizationalUnit scopes the pipeline to accounts in that specific OU (not sub-OUs unless you target the parent and the child accounts happen to live directly under it), Get-Mailbox filters that down to only the objects that actually have a mailbox, and Set-CASMailbox applies the client access settings. Swap in -ActiveSyncEnabled $false or any of the other Set-CASMailbox switches as needed for your specific feature. Always test the Get-User -OrganizationalUnit ... | Get-Mailbox portion on its own first (without piping into Set-CASMailbox) to confirm it returns exactly the mailboxes you expect before making the change.

Doing This in Exchange Online (Updated for 2026)

The -OrganizationalUnit parameter is technically recognised in Exchange Online PowerShell too, but it only does anything useful in hybrid/directory-synced tenants where an on-prem OU structure is mirrored in via Azure AD Connect — a cloud-only tenant has no real OU hierarchy for it to filter against. Microsoft’s current recommended approach for bulk-targeting mailboxes by department or site in EXO is a dynamic distribution group filtered on an attribute like Department (e.g. New-DynamicDistributionGroup -RecipientFilter "(Department -eq 'Sales')"), or filtering directly with Get-Mailbox -Filter on the same attribute and piping into Set-CASMailbox as before.

Resources

• Exchange