Mailbox permissions report
Documentation: Microsoft Learn
Inspect a mailbox’s access rights and inherited permissions with Get-EXOMailboxPermission before preparing a permissions report.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
$Mailbox = "shared@example.com"
Get-EXOMailboxPermission -Identity $Mailbox | Where-Object User -ne "NT AUTHORITY\SELF" | Select-Object User,AccessRights,IsInherited,Deny- Stage 1$Mailbox
Positional values or no named parameters - Stage 2Where-Object
-ne - Stage 3Select-Object
Positional values or no named parameters
How it works
Inspect a mailbox’s access rights and inherited permissions with Get-EXOMailboxPermission before preparing a permissions report. Where-Object drops the NT AUTHORITY\SELF entry that exists on every mailbox and carries no information, and the projection keeps the grantee with AccessRights, IsInherited, and the Deny flag.
Adapting it
Loop this across a mailbox list and add a calculated property carrying the mailbox identity, because the single-mailbox output does not name which mailbox it describes once several results are combined.
Requirements
ExchangeOnlineManagement module with a Connect-ExchangeOnline session.
If the result is unexpected
Mailbox permissions do not explain all delegate capabilities.
FullAccess, SendAs and SendOnBehalf are different permissions with different discovery paths.
- Check each permission type for a known delegate rather than relying on a single mailbox-permission list.
Validate the result
The output labels the permission type, mailbox and trustee.
Keep the check reliable
Keep permission types separate in reports and verify changes against the corresponding property or command.
