How to get mailbox permission changes in Office 365

Monitoring Microsoft 365 (previously Office 365) mailbox permissions in Exchange Online is vital for security and compliance. Unapproved modifications can expose data or interrupt operations, yet manually scouring audit logs for who did what, and when changes occurred is an arduous, complex, and time-consuming process for administrators.

With a streamlined auditing system that clearly displays all changes made, administrators can easily enforce the principle of least privilege and gain the control needed to neutralize potential security threats swiftly. In this page, we will see how to track Microsoft 365 mailbox permission changes with the native tools, and how to do it easily, swiftly, and efficiently with ManageEngine M365 Manager Plus, a dedicated Microsoft 365 administration tool.

Method 1: How to get mailbox permission changes using the Microsoft Purview compliance portal

Prerequisites

You must be assigned at least the Audit Reader role to access and run audit log searches in the Microsoft Purview compliance portal.

Steps

1. Log in to the Microsoft Purview compliance portal and select Audit from the sidebar or the main menu.
2. Configure the Start and End fields with the required dates.
3. In the Activities - operation names drop-down, enter the following:
   • Add-MailboxPermission, Remove-MailboxPermission
4. In the Users field, type the mailboxes you want to investigate. You can leave this blank to search all mailboxes.
5. Click Search to generate the Microsoft 365 mailbox permission change report. This displays the mailboxes where permission changes occurred.

Method 2: Get mailbox permission changes using the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell

Prerequisites

Before using Exchange Online PowerShell, please verify that:

1. The Exchange Administrator role is applied to the account you use to sign in to Exchange Online PowerShell.
2. You are connected to the Exchange Online module
   1. To check if the ExchangeOnlineManagement PowerShell module is installed, use this script:
      Copy

                                              Install-Module ExchangeOnlineManagement -Scope CurrentUser
                                              Update-Module ExchangeOnlineManagement
                                          

   2. Connect to Exchange Online PowerShell with this script:
      Copy

                                              Connect-ExchangeOnline
                                          

The Search-MailboxAuditLog cmdlet was used previously to parse through audit logs and find mailbox permission changes made by administrators and delegates. However, the Search-MailboxAuditLog cmdlet is deprecated.

You will have to use its replacement, the Search-UnifiedAuditLog cmdlet, to get mailbox permission changes for a specific mailbox:

                               Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) -RecordType ExchangeAdmin -Operations "Add-MailboxPermission", "Remove-MailboxPermission" -FreeText "shared.mailbox@yourdomain.com"
                            

Supported parameters

The following table contains some key parameters that can be used with the Search-UnifiedAuditLog cmdlet to audit your Microsoft 365 mailbox permissions.

Use case for the Search-UnifiedAuditLog cmdlet

Scenario: A compliance officer needs a report of all permission changes made to any mailbox in the organization over the last 30 days.

This is the cmdlet you will have to run to generate the mailbox permission changes report across the organization:

$StartDate = (Get-Date).AddDays(-30)
$EndDate = Get-Date

$permissionChanges = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -RecordType ExchangeAdmin -Operations "Add-MailboxPermission", "Remove-MailboxPermission" -ResultSize 5000

$results = foreach ($entry in $permissionChanges) {
    $auditData = $entry.AuditData | ConvertFrom-Json
    if ($auditData.ObjectModified -like "*RecipientTypeDetails SharedMailbox*") {
        [PSCustomObject]@{
            Date = $auditData.CreationTime
            User = $auditData.UserId
            Action = $auditData.Operation
            Mailbox = $auditData.ObjectId
            TargetUser = ($auditData.Parameters | Where-Object { $_.Name -eq 'User' }).Value
            Permissions = ($auditData.Parameters | Where-Object { $_.Name -eq 'AccessRights' }).Value
        }
    }
}

$results | Export-Csv -Path "C:\Reports\SharedMailbox_PermissionChanges_Last30Days.csv" -NoTypeInformation

                            

Method 3: How to get the mailbox permission changes report using M365 Manager Plus

1. Log in to M365 Manager Plus and click the Reports tab.
2. Navigate to Other Services > Compliance Reports, and select the Mailbox Permission Changes report.
3. You can now see which users have changed the mailbox permissions. Click Details in the Parameters column and check the User field to see who has modified their permissions.
4. Click Export As and select a file format (CSV, PDF, XLSX, or HTML) to export your Microsoft 365 mailbox permissions report.

Monitor your Exchange Online mailboxes and more

M365 Manager Plus simplifies the complex task of auditing Microsoft 365 mailbox permissions, giving you complete visibility and control over your Exchange Online environment.

Important tips

Frequently asked questions