How to Get an Exchange Online Mailbox Permissions Report

Using PowerShell to Get Mailbox Permissions Report

In Exchange Online, the native tool for getting a summary of users who have access to other users’ mailboxes is PowerShell. Using the Get-MailboxPermission PowerShell command, you can check which users have what type of permissions to access other mailboxes. However, this command does not list all mailbox permissions. For instance, to see ‘Send on Behalf’ rights, you must use different syntax. Similarly, if you need to see the permissions of a specific security group, you must add the Get-ADGroupMember cmdlet to the script.

The steps below explain the PowerShell method:

1. Connect to Office 365 PowerShell by running the PowerShell ISE as Administrator and executing the following command:

Install-Module -Name ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName paul@adminabc.onmicrosoft.com



2. To identify a specific mailbox to get permissions use the following command:
   Get-Mailbox -Identity ‘Adam_Smith@adminabc.onmicrosoft.com'
3. To get the permissions of the specific mailbox defined at step 2:
   Get-MailboxPermission -Identity ‘Adam_Smith@adminabc.onmicrosoft.com'
4. To view information about ‘Send As’ permissions:
   Get-EXORecipientPermission -Identity ‘Adam_Smith@adminabc.onmicrosoft.com'
5. To report on mailboxes with the ‘Send on Behalf’ permission:
   Get-Mailbox-Identity ‘Adam_Smith@adminabc.onmicrosoft.com'|?{$_.GrantSendOnBehalfTo}|Select-object Name,GrantSendOnBehalfTo
6. To Export / Get Output to CSV format run the following script
   Connect-ExchangeOnline -UserPrincipalName paul@adminabc.onmicrosoft.com
$P = Get-Mailbox -Identity ‘Adam_Smith@adminabc.onmicrosoft.com'
$Q = Get-MailboxPermission -Identity ‘Adam_Smith@adminabc.onmicrosoft.com'
$R = Get-EXORecipientPermission -Identity ‘Adam_Smith@adminabc.onmicrosoft.com'
$S = Get-Mailbox -Identity ‘Adam_Smith@adminabc.onmicrosoft.com'|?{$_.GrantSendOnBehalfTo}|Select-object Name,GrantSendOnBehalfTo
$P, $Q, $R, $S| out-file 'C:\data\Test.csv'

7. Review the report:
   

Using Lepide Auditor for Exchange

The native method for reporting on Exchange Online Mailbox Permissions is both complex and time consuming.

Lepide Auditor for Exchange gives complete visibility into your Exchange Online mailbox permissions using the Permissions by Mailbox Report. This predefined report provides complete audit information quickly and easily without the need for any PowerShell scripting expertise.

Below is an example of the Permissions by Mailbox report:

To run the report:

• From the Permissions & Privileges screen, click on the Permissions by Mailbox report
• Select Exchange Online from the Exchange Server(s) filter
• Click Generate Report
• Click on a mailbox to see who has access