Entra / Microsoft 365 · Exchange Online
Report permissions on mailboxes
Quick and simple script to generate a report of non-standard permissions applied to Exchange Online user and shared mailboxes.
Connect & set up
Run these once per session. All scopes are read-only unless the script makes changes.
Connect-ExchangeOnline -ShowBanner:$false
Run it
The main script. Copy it, or download the .ps1 and run it from your console.
CLSWrite-Host "Fetching mailboxes"$Mbx = Get-ExoMailbox -RecipientTypeDetails UserMailbox, SharedMailbox -Properties RecipientTypeDetails -ResultSize UnlimitedIf ($Mbx.Count -eq 0) { Write-Error "No mailboxes found. Script exiting..." -ErrorAction Stop }# We have some mailboxes, so we can process them...CLS$Report = [System.Collections.Generic.List[Object]]::new() # Create output file$ProgressDelta = 100/($Mbx.count); $PercentComplete = 0; $MbxNumber = 0ForEach ($M in $Mbx) {$MbxNumber++$MbxStatus = $M.DisplayName + " ["+ $MbxNumber +"/" + $Mbx.Count + "]"Write-Progress -Activity "Processing mailbox" -Status $MbxStatus -PercentComplete $PercentComplete$PercentComplete += $ProgressDelta# REST cmdlet equivalent# $Permissions = Get-ExoMailboxPermission -Identity $M.UserPrincipalName | ? {$_.User -Like "*@*" }$Permissions = Get-MailboxPermission -Identity $M.UserPrincipalName | ? {$_.User -Like "*@*" }If ($Null -ne $Permissions) {# Grab each permission and output it into the reportForEach ($Permission in $Permissions) {$ReportLine = [PSCustomObject] @{Mailbox = $M.DisplayNameUPN = $M.UserPrincipalNamePermission = $Permission | Select -ExpandProperty AccessRightsAssignedTo = $Permission.UserMailboxType = $M.RecipientTypeDetails }$Report.Add($ReportLine) }}}$Report | Sort -Property @{Expression = {$_.MailboxType}; Ascending= $False}, Mailbox | Export-CSV c:\temp\MailboxPermissions.csv -NoTypeInformationWrite-Host "All done." $Mbx.Count "mailboxes scanned. Report of non-standard permissions available in c:\temp\MailboxPermissions.csv"
Attribution
Author
Office365itpros