How to export mailbox permissions in Exchange Online

Before you start

Use an account in a role group that can read mailbox settings. Microsoft lists Organization Management and Recipient Management for mailbox settings in Exchange Online, and says members of View-Only Management can view the configuration of those features.

The script reads permissions as Exchange holds them when it runs, so the CSV is a snapshot. It keeps direct, allowed Full Access entries and leaves out inherited entries, denials, NT AUTHORITY\SELF (each user's access to their own mailbox) and every other permission type. Soft-deleted and inactive mailboxes need a switch to be returned, so they are not included. The examples read and export and change nothing.

Option 1

Export mailbox permissions with PowerShell

Install the module once, then connect, read each mailbox's permissions and export the Full Access grants. Any error stops the script before it writes a partial CSV.

# Install once, if the module is not already installed.
Install-Module ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline
try {
    $mailboxes = Get-EXOMailbox -ResultSize Unlimited
    $report = @(foreach ($mailbox in $mailboxes) {
        $identity = $mailbox.UserPrincipalName
        if (-not $identity) { throw "No user principal name for $($mailbox.DisplayName)." }
        foreach ($entry in Get-EXOMailboxPermission -Identity $identity) {
            $direct = -not $entry.IsInherited -and -not $entry.Deny
            if ($direct -and $entry.AccessRights -contains 'FullAccess' -and
                $entry.User -ne 'NT AUTHORITY\SELF') {
                [pscustomobject]@{
                    Mailbox = $mailbox.DisplayName
                    MailboxAddress = $mailbox.PrimarySmtpAddress.ToString()
                    MailboxType = $mailbox.RecipientTypeDetails
                    Trustee = $entry.User
                    AccessRights = ($entry.AccessRights -join ', ')
                }
            }
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'No direct Full Access permissions were found.'
    } else {
        $report | Sort-Object Mailbox, Trustee |
            Export-Csv -Path './mailbox-full-access.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) Full Access permissions exported."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

The CSV has 1 row for each mailbox and trustee. Get-EXOMailbox returns 1000 mailboxes unless told otherwise, so the script passes -ResultSize Unlimited. To narrow it, add -RecipientTypeDetails SharedMailbox or a -Filter to that command; to see every entry, remove the conditions on $entry. The script does not ask Exchange for entries left behind by deleted accounts.

Check a single mailbox

Reconnect with Connect-ExchangeOnline, then read 1 mailbox. The export above disconnects when it finishes.

# Run while connected to Exchange Online. Replace the example mailbox.
Get-EXOMailboxPermission -Identity 'person@example.com' |
    Where-Object { $_.AccessRights -contains 'FullAccess' } |
    Select-Object Identity,User,AccessRights,IsInherited,Deny

This also shows the inherited and denied entries the export drops, with IsInherited and Deny beside each.

Option 2

Check mailbox delegation in the admin centre

1. Open the Exchange admin centre for the correct tenant.
2. Go to Recipients > Mailboxes and select the mailbox. Room and equipment mailboxes are under Recipients > Resources.
3. Select Mailbox delegation.
4. Read the names under Read and manage (Full Access).
5. Close the pane without choosing Edit, Save or Delete, so nothing changes.

This suits 1 mailbox, such as before an offboarding. It does not suit an export, since the admin centre shows 1 mailbox at a time.

Common questions

Does Full Access let a person send email as the mailbox?

No. Microsoft describes Full Access as opening the mailbox and working with its contents, without sending from it. Send As and Send on behalf are separate permissions. Altivane has a report for each beside Full Access.

Why is a person who can read a mailbox missing from the export?

The export keeps direct entries, so someone with access through a group appears as the group, not as its members. Mail can also reach a person with no permission at all, through forwarding: see how to find mailbox forwarding in Exchange Online.

Why did a check of 1 mailbox return permissions for many?

Microsoft warns that a $null or non-existent -Identity value returns all objects, as if none was given. Check the name is right and not blank. The export script stops on a blank user principal name for this reason.