In Microsoft 365, how to remove an invalid S/MIME configuration

Question

In Microsoft 365, how to remove an invalid S/MIME configuration

Serge Caron 65

I have a user in a tenant migrated from an On Premises Exchange 2016 that has invalid entries in his mailbox configuration.

How do I remove the certificates (UserSMimeCertificate, UserCertificate) in this mailbox.

For a healthy mailbox I have :

PS C:\Users\ThisUser> Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop

PS C:\Users\ThisUser> Get-MailBox ThisUser | fl *user*

ExchangeUserAccountControl : None

UserPrincipalName : ******@thisdomain.tld

UserSMimeCertificate : {}

UserCertificate : {}

IsAgenticUser : False

UserIdentityParent :

I don't see an interface in Exchange 365 where I can remove the obsolete certificates in my target user.

0 comments

1 answer

Your answer

Answer 1

Use Exchange PowerShell to clear those attributes; there is no GUI in Exchange Online for this.

Connect to Exchange Online:

   Connect-ExchangeOnline -ShowBanner:$false

To clear S/MIME certificates on a mailbox (UserSMimeCertificate / UserCertificate):
```
   Set-Mailbox -Identity "ThisUser" -UserSMimeCertificate $null -UserCertificate $null
```
This sets both multi-valued properties to empty, matching the healthy mailbox output where they show as {}.

If the object is a mail user (no mailbox, only mail-enabled user), use Set-MailUser instead:

   Set-MailUser -Identity "ThisUser" -UserSMimeCertificate $null -UserCertificate $null

Verify the result:
```
   Get-Mailbox "ThisUser" | fl *user*
```
or, for a mail user:
```
   Get-MailUser "ThisUser" | fl *user*
```
The UserSMimeCertificate and UserCertificate fields should now be empty ({}).

If there are related per-mailbox user configuration items that are corrupted (for example, S/MIME-related user configuration objects), they can be removed and will be recreated automatically when the feature is used again:

Remove-MailboxUserConfiguration -Identity "<ConfigName>" -Mailbox "ThisUser"

Use Get-MailboxUserConfiguration first (not shown in context) to discover the exact configuration names to remove.

References: