Getting shared mailboxes with no delegates in Powershell

%3CLINGO-SUB%20id%3D%22lingo-sub-319207%22%20slang%3D%22en-US%22%3EGetting%20shared%20mailboxes%20with%20no%20delegates%20in%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-319207%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20quite%20new%20to%20powershell%20and%20am%20just%20wondering%20if%20there's%20a%20way%20to%20get%20all%20of%20the%20shared%20mailboxes%20in%20Office%20365%20that%20haven't%20got%20any%20delegates%20on%20them%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3ESalim%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-319207%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-321155%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20shared%20mailboxes%20with%20no%20delegates%20in%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-321155%22%20slang%3D%22en-US%22%3E%3CP%3EWell%2C%20here's%20a%20quick%20sample%20of%20what%20you%20can%20do%20with%20PowerShell%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EGet-Mailbox%20-RecipientTypeDetails%20SharedMailbox%20%7Cselect%20PrimarySmtpAddress%2C%40%7Bn%3D%22FullAccess%22%3Be%3D%7B%20(Get-MailboxPermission%20%24_.PrimarySmtpAddress%20%7C%20%3F%20%7B(%24_.User%20-ne%20%22NT%20AUTHORITY%5CSELF%22)%20-and%20(%24_.IsInherited%20-ne%20%24true)%20-and%20(%24_.AccessRights%20-match%20%22FullAccess%22)%20-and%20-not%20(%24_.User%20-like%20%22S-1-5*%22)%7D).User%20-join%20%22%2C%22%20%7D%7D%20%7C%3F%20%7B!%24_.FullAccess%7D%3C%2FPRE%3E%0A%3CP%3EIt's%20a%20one-liner%2C%20so%20a%20bit%20ugly%2C%20but%20should%20get%20the%20job%20done.%20Do%20note%20that%20it%20will%20take%20a%20long%20time%20to%20run%20if%20you%20have%20a%20large%20number%20of%20mailboxes.%20Also%20it%20doesn't%20cover%20any%20folder-level%20permissions%2C%20if%20you%20want%20these%20included%20best%20go%20with%20a%20full-blown%20script.%20I%20have%20few%20samples%20posted%20on%20the%20TechNet%20Gallery%2C%20you%20can%20easily%20adapt%20them.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-320401%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20shared%20mailboxes%20with%20no%20delegates%20in%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-320401%22%20slang%3D%22en-US%22%3EHi%20Vasil%2C%3CBR%20%2F%3E%3CBR%20%2F%3EYeah%20definitely%20but%20I%20don't%20think%20a%20message%20trace%20would%20be%20the%20way%20to%20go.%20I'm%20not%20looking%20to%20delete%20them%20before%20checking%20with%20the%20site%20users%20and%20that's%20why%20I'd%20like%20to%20see%20a%20list%20of%20shared%20mailboxes%20that%20are%20just%20sitting%20there%20in%20365%20that%20nobody%20has%20been%20delegated%20access%20to.%20I%20doubt%20it'd%20be%20a%20large%20number%20but%20we%20have%20too%20many%20shared%20mailboxes%20for%20me%20to%20go%20through%20all%20of%20them%20one%20by%20one.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-320162%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20shared%20mailboxes%20with%20no%20delegates%20in%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-320162%22%20slang%3D%22en-US%22%3E%3CP%3EHm%2C%20for%20this%20scenario%20perhaps%20a%20better%20way%20will%20be%20to%20do%20a%20message%20trace%20instead%3F%20I%20mean%20you%20might%20have%20shared%20mailboxes%20that%20nobody%20can%20access%20(no%20permissions%20granted)%2C%20however%20they%20might%20still%20be%20receiving%20messages%2C%20isn't%20thing%20something%20you%20want%20to%20account%20for%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-319755%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20shared%20mailboxes%20with%20no%20delegates%20in%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-319755%22%20slang%3D%22en-US%22%3EI'm%20referring%20to%20shared%20mailboxes%20that%20are%20just%20sitting%20there%20with%20nobody%20having%20access%20to%20them%20whatsoever.%20Just%20need%20to%20clear%20out%20shared%20mailboxes%20that%20aren't%20being%20used.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-319753%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20shared%20mailboxes%20with%20no%20delegates%20in%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-319753%22%20slang%3D%22en-US%22%3E%3CBLOCKQUOTE%3E%3CHR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F72542%22%20target%3D%22_blank%22%3E%40adam%20deltinger%3C%2FA%3E%26nbsp%3Bwrote%3A%3CBR%20%2F%3EHi!%3CBR%20%2F%3EI%E2%80%99m%20not%20able%20to%20write%20anything%20right%20now%20but%20I%20found%20maybe%20a%20little%20workaround%20script%20in%20this%20post%20here%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fsocial.technet.microsoft.com%2FForums%2Fen-US%2Fc4372940-51c6-4c72-8414-424793fd9ac0%2Flist-shared-mailbox-with-no-users-assigned-no-delegates%3Fforum%3Donlineservicesexchange%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsocial.technet.microsoft.com%2FForums%2Fen-US%2Fc4372940-51c6-4c72-8414-424793fd9ac0%2Flist-shared-mailbox-with-no-users-assigned-no-delegates%3Fforum%3Donlineservicesexchange%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EAdam%3CHR%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CP%3EHi%20Adam%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20that%20I'll%20give%20it%20a%20try!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-319235%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20shared%20mailboxes%20with%20no%20delegates%20in%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-319235%22%20slang%3D%22en-US%22%3E%3CP%3EDelegates%20can%20have%20a%20different%20meaning%2C%20are%20you%20referring%20to%20granting%20mailbox-level%20access%20(Full%20access)%20or%20folder-level%20access%3F%20For%20both%20of%20these%20scenarios%20you%20can%20easily%20use%20PowerShell%20to%20get%20a%20list%20of%20%22undelegated%22%20mailboxes%2C%20but%20the%20cmdlets%20you%20will%20have%20to%20use%20are%20a%20bit%20different.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-319213%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20shared%20mailboxes%20with%20no%20delegates%20in%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-319213%22%20slang%3D%22en-US%22%3EHi!%3CBR%20%2F%3EI%E2%80%99m%20not%20able%20to%20write%20anything%20right%20now%20but%20I%20found%20maybe%20a%20little%20workaround%20script%20in%20this%20post%20here%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fsocial.technet.microsoft.com%2FForums%2Fen-US%2Fc4372940-51c6-4c72-8414-424793fd9ac0%2Flist-shared-mailbox-with-no-users-assigned-no-delegates%3Fforum%3Donlineservicesexchange%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsocial.technet.microsoft.com%2FForums%2Fen-US%2Fc4372940-51c6-4c72-8414-424793fd9ac0%2Flist-shared-mailbox-with-no-users-assigned-no-delegates%3Fforum%3Donlineservicesexchange%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EAdam%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-826769%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20shared%20mailboxes%20with%20no%20delegates%20in%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-826769%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3BI%20can't%20get%20your%20command%20above%20to%20work%3F%3C%2FP%3E%3CP%3EIt%20returns%20the%20PrimarySMTPAddress%20for%20accounts%20where%20there%20are%20real%20users%20with%20FullAccess%20permission%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-969216%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20shared%20mailboxes%20with%20no%20delegates%20in%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-969216%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20don't%20think%20that%20would%20return%20anything%20that%20is%20null.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1259559%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20shared%20mailboxes%20with%20no%20delegates%20in%20Powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1259559%22%20slang%3D%22en-US%22%3E%3CP%3EExcellent%2C%20thanks%20for%20sharing!%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi,

 

I'm quite new to powershell and am just wondering if there's a way to get all of the shared mailboxes in Office 365 that haven't got any delegates on them?

 

Thanks

Salim

10 Replies
Highlighted
Hi!
I’m not able to write anything right now but I found maybe a little workaround script in this post here:

https://social.technet.microsoft.com/Forums/en-US/c4372940-51c6-4c72-8414-424793fd9ac0/list-shared-m...

Adam
Highlighted

Delegates can have a different meaning, are you referring to granting mailbox-level access (Full access) or folder-level access? For both of these scenarios you can easily use PowerShell to get a list of "undelegated" mailboxes, but the cmdlets you will have to use are a bit different.

Highlighted

@adam deltinger wrote:
Hi!
I’m not able to write anything right now but I found maybe a little workaround script in this post here:

https://social.technet.microsoft.com/Forums/en-US/c4372940-51c6-4c72-8414-424793fd9ac0/list-shared-m...

Adam

Hi Adam,

 

Thanks for that I'll give it a try!

Highlighted
I'm referring to shared mailboxes that are just sitting there with nobody having access to them whatsoever. Just need to clear out shared mailboxes that aren't being used.
Highlighted

Hm, for this scenario perhaps a better way will be to do a message trace instead? I mean you might have shared mailboxes that nobody can access (no permissions granted), however they might still be receiving messages, isn't thing something you want to account for?

Highlighted
Hi Vasil,

Yeah definitely but I don't think a message trace would be the way to go. I'm not looking to delete them before checking with the site users and that's why I'd like to see a list of shared mailboxes that are just sitting there in 365 that nobody has been delegated access to. I doubt it'd be a large number but we have too many shared mailboxes for me to go through all of them one by one.
Highlighted

Well, here's a quick sample of what you can do with PowerShell:

 

Get-Mailbox -RecipientTypeDetails SharedMailbox |select PrimarySmtpAddress,@{n="FullAccess";e={ (Get-MailboxPermission $_.PrimarySmtpAddress | ? {($_.User -ne "NT AUTHORITY\SELF") -and ($_.IsInherited -ne $true) -and ($_.AccessRights -match "FullAccess") -and -not ($_.User -like "S-1-5*")}).User -join "," }} |? {!$_.FullAccess}

It's a one-liner, so a bit ugly, but should get the job done. Do note that it will take a long time to run if you have a large number of mailboxes. Also it doesn't cover any folder-level permissions, if you want these included best go with a full-blown script. I have few samples posted on the TechNet Gallery, you can easily adapt them.

 

Highlighted

@Vasil Michev I can't get your command above to work?

It returns the PrimarySMTPAddress for accounts where there are real users with FullAccess permission

Highlighted

@Vasil Michev 

I don't think that would return anything that is null.

Highlighted

Excellent, thanks for sharing! @Vasil Michev