1. Connect to Office 365 PowerShell by running the PowerShell ISE as Administrator and executing the following command:
Set-ExecutionPolicy RemoteSigned
2. Request Windows PowerShell credentials by running the following command:
$Cred = Get-Credential
Enter your account and passwordand then click OK.
3. Create a session using the following command, modifying the –ConnectionUri parameter based on your Exchange Online location:
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri
https://outlook.office365.com/PowerShell-liveid/ -Credential$Cred -Authentication Basic –AllowRedirection
4. Connect to Exchange Online:
Import-PSSession$Session -DisableNameChecking
5. Generate user permissions report, do one of the following:
To get a full summary of users’ permissions, use the following Get-Mailbox command:
Get-Mailbox -resultsize unlimited | Get-MailboxPermission | Select Identity, User, Deny, AccessRights, IsInherited| Export-Csv -Path "c:\temp\mailboxpermissions.csv" –NoTypeInformation
If you need a report on a specific user, use the -identity parameter instead of -resultsize unlimited.
To filter users having full access, use the parameter where {($_.accessrights -contains "FullAccess")}:
Get-Mailbox -resultsize unlimited | Get-MailboxPermission| where {($_.accessrights -contains "Fullaccess")} | Select AccessRights,Deny,InheritanceType,User,Identity,IsInherited | Export-Csv -Path "c:\temp\fullaccess.csv" -NoTypeInformation
By default, you will get a full list of users, including non-owner access. To get information about direct user permissions only, use either {($_.user -ne "NT AUTHORITY\SELF")} or {($_.user -like '*@*')}:
Get-Mailbox -resultsize unlimited | Get-MailboxPermission | Select Identity, User, Deny, AccessRights, IsInherited| Where {($_.user -ne "NT AUTHORITY\SELF")}| Export-Csv -Path "c:\temp\NonOwnerPermissions.csv" -NoTypeInformation
To view information about “Send As” permissions, use the Get-RecipientPermission cmdlet:
Get-Mailbox -resultsize unlimited | Get-RecipientPermission| where {($_.trustee -ne "NT AUTHORITY\SELF")}|select Identity,Trustee,AccessControlType,AccessRights,IsInherited | Export-Csv -Path "c:\temp\sendaspermissions.csv" –NoTypeInformation
To report on mailboxes with the “Send on Behalf” permission, use the following script:
$GrantSendOn= Get-Mailbox-resultsize unlimited| where {($_.GrantSendOnBehalfTo -ne "")}
$Out=foreach ($user in $GrantSendOn.GrantSendOnBehalfTo) {
$obj= New-Object System.Object
$obj|Add-MemberNoteProperty eMail$GrantSendOn.WindowsEmailAddress
$obj|Add-Member NoteProperty DisplayName $GrantSendOn.DisplayName
$obj|Add-Member NoteProperty User $user
$obj }
$Out| Export-Csv -Path "c:\temp\sendonbehalfpermissions.csv" –NoTypeInformation
6. Review report:
How to Report Exchange Online Mailbox Permissions - Native Auditing
7. Terminate your session by using the following command:
Remove-PSSession$Session
