With Microsoft Outlook, users can assign permissions to other users in the same organization. The same goes to Microsoft 365 tenant administrators. They can also grant mailbox privileges to other identities. How can you keep an overview of that? Who has given whom what kind of mailbox permissions? I will show you now how you can retrieve all Microsoft 365 tenant mailbox permissions of all users.

To get an permisson overview we need to connect to our Microsoft 365 tenant with PowerShell.

Connect to Microsoft 365 / Exchange Online

First we need to connect to our tenant. Run the commands below to open a PowerShell session to your Microsoft cloud.

Install-Module -Name ExchangeOnlineManagement -Force -AllowClobber

Connect-ExchangeOnline -UserPrincipalName user@domain.com -ShowProgress $true

Fine. Let’s move on.

Nice. Which brings me to the second part of this blog post: Fetching all mailbox permissions.

List All Mailbox Permissions

Get-ExoMailbox -ResultSize Unlimited |

Get-ExoMailboxPermission |

Where-Object {($_.user.tostring() -notlike "*SELF*") ` -and ($_.user.tostring() -notlike "*S-*") ` -and $_.IsInherited -eq $false -and $_.Identity ` -notlike "*discovery*"} |

Select-Object -Property Identity,User,AccessRights 

Here is the one-liner that makes it happen. I have to confess, it’s only a one-liner when you use a 21:9 widescreen monitor ;-). However, let’s do it.

Feel free to add Export-Csv or other useful Export- or Out- cmdlets at the end of the code for storing your results to a file.

Hope that was helpful and informative.