How to get shared mailbox permissions in Office 365

Shared mailboxes are vital for team collaboration, but they can easily become a security risk. Without clear visibility into who has access to what, sensitive information in a shared mailbox could be exposed to unauthorized users, leading to data breaches and compliance failures. Knowing exactly who holds Full Access, Send As, or specific folder-level permissions is critical.

Exporting a shared mailbox permissions report allows you to audit access rights, ensure the principle of least privilege is being followed, and provide clear documentation for compliance checks. With a clear list, you can filter, share, and manage permissions effectively to secure your organization's data.

Method 1: How to view shared mailbox permissions using the Exchange admin center

Prerequisites

You have the Exchange Administrator role assigned.

Steps

1. Sign in to the Exchange admin center and navigate to Recipients > Mailboxes.
2. Select a shared mailbox from the list.
3. In the details pane that opens, select the Delegation tab.
4. Here, you can view users with Send As, Send on Behalf, and Full Access permissions.

Limitations to consider

• The Exchange admin center does not provide a way to export the list of users who are assigned these shared mailbox permissions.
• You will have to click through each mailbox individually to get the list of users who are assigned shared mailbox permissions.

To do either of these, you will have to use Exchange Online PowerShell or a Microsoft 365 reporting tool such as M365 Manager Plus.

Method 2: How to get a list of shared mailboxes using Exchange Online PowerShell (Get-EXOMailbox)

Prerequisites

Before using Exchange Online PowerShell, please verify that:

1. The Exchange Administrator or Global Administrator role is applied to the account you use to sign in to Exchange Online PowerShell.
2. You are connected to the Exchange Online module
   1. To check if the ExchangeOnlineManagement PowerShell module is installed. use this script:
   Copy

   Install-Module ExchangeOnlineManagement -Scope CurrentUser
   Update-Module ExchangeOnlineManagement

   2. Connect to Exchange Online PowerShell with this script:
   Copy

   Connect-ExchangeOnline

Use Get-Mailbox to export Microsoft 365 shared mailbox permissions

The Get-Mailbox cmdlet allows you to retrieve all permission types such as Full Access, Send As, and Send on Behalf for all shared mailboxes at once, and export the data for auditing and review.

Each permission type has its own syntax requirements. Below are the cmdlets to list mailboxes delegated with these permissions.

Full access:

Get-Mailbox |?{$_.RecipientTypeDetails -eq "<identity> "} | Get-MailboxPermission|?{$_.User -ne 'nt authority./self'} |Select-Object Identity,User,AccessRights

Send as:

Get-Mailbox |?{$_.RecipientTypeDetails -eq "<identity>"} | Get-RecipientPermission | where {($_.Trustee -ne 'nt authority./self') -and ($_.Trustee -ne 'Null sid')} | select Identity,Trustee,AccessRights

Send on behalf:

Get-Mailbox |?{$_.RecipientTypeDetails -eq "<identity>" -and $_.GrantSendOnBehalfTo -ne $null }| Select PrimarySmtpAddress,GrantSendOnBehalfTo,RecipientTypeDetails

To view the current settings for a user, use the Get-MailboxAutoReplyConfiguration cmdlet.

Supported parameters

The following table contains parameters that can be used with the Get-Mailbox cmdlet to provide details on your shared mailbox permissions.

An example use case: Export Microsoft 365 shared mailbox permissions to CSV

For organization-wide audits, it’s often necessary to export all shared mailbox permissions to ensure access is appropriate.

This script exports a list of users with permissions on shared mailboxes in your organization into a single CSV file, for periodic reviews or compliance checks.

              $timestamp = Get-Date -Format 'yyyyMMdd-HHmmss'

              $outPath   = "C:\Reports\SharedMailboxPermissions-$timestamp.csv"

              $newline   = [Environment]::NewLine

              $shared = Get-Mailbox -ResultSize Unlimited |

              Where-Object { $_.RecipientTypeDetails -eq 'SharedMailbox' }

              # --- Full Access --- 

              $fa = Get-MailboxPermission -Identity $mailboxId | 

              Where-Object { 

              -not $_.IsInherited -and 

              -not $_.Deny -and 

              ($_.AccessRights -contains 'FullAccess') -and 

              ($_.User -notmatch 'NT AUTHORITY\\SELF|S-1-5-|ANONYMOUS LOGON') 

              } | 

              ForEach-Object { 

              [pscustomobject]@{ 

              MailboxPrimarySmtpAddress = $mailboxId 

              MailboxDisplayName = $mailboxName 

              PermissionType = 'FullAccess' 

              Grantee = $_.User.ToString() 

              GranteePrimarySmtpAddress = $null 

              AccessRights = ($_.AccessRights -join ',') 

              Inherited = $_.IsInherited 

              Deny = $_.Deny 

              } 

              } 

              # --- Send As --- 

              $sa = Get-RecipientPermission -Identity $mailboxId | 

              Where-Object { 

              -not $_.IsInherited -and 

              ($_.AccessRights -contains 'SendAs') -and 

              ($_.Trustee -notmatch 'NT AUTHORITY\\SELF|S-1-5-|NULL SID') 

              } | 

              ForEach-Object { 

              [pscustomobject]@{ 

              MailboxPrimarySmtpAddress = $mailboxId 

              MailboxDisplayName = $mailboxName 

              PermissionType = 'SendAs' 

              Grantee = $_.Trustee.ToString() 

              GranteePrimarySmtpAddress = $null 

              AccessRights = ($_.AccessRights -join ',') 

              Inherited = $_.IsInherited 

              Deny = $false 

              } 

              } 

              # --- Send on Behalf --- 

              $sob = @() 

              if ($m.GrantSendOnBehalfTo) { 

              foreach ($u in $m.GrantSendOnBehalfTo) { 

              $rec = Get-Recipient $u -ErrorAction SilentlyContinue 

              if ($rec) { 

              $sob += [pscustomobject]@{ 

              MailboxPrimarySmtpAddress = $mailboxId 

              MailboxDisplayName = $mailboxName 

              PermissionType = 'SendOnBehalf' 

              Grantee = $rec.DisplayName 

              GranteePrimarySmtpAddress = $rec.PrimarySmtpAddress 

              AccessRights = 'SendOnBehalf' 

              Inherited = $false 

              Deny = $false 

              } 

              } 

              } 

              } 

              $fa + $sa + $sob 

              } 

              # Ensure output folder exists 

              $folder = Split-Path $outPath -Parent 

              if (-not (Test-Path $folder)) { New-Item -ItemType Directory -Path $folder | Out-Null } 

              $results | Sort-Object MailboxPrimarySmtpAddress, PermissionType, Grantee | 

              Export-Csv -Path $outPath -NoTypeInformation -Encoding UTF8
 
"Permissions report successfully saved to: $outPath

            

Method 3: How to export Microsoft 365 shared mailbox permissions using M365 Manager Plus

1. Log in to M365 Manager Plus and click the Reports tab.
2. Navigate to Exchange Online > Other Exchange Reports, and select the Shared Mailbox Permissions report.
3. Click Export As and select your desired file format (CSV, PDF, XLSX, HTML) to export your shared mailbox permissions report.

Monitor your Exchange Online shared mailboxes and more

M365 Manager Plus simplifies the complex task of auditing shared mailbox permissions, giving you complete visibility and control over your Exchange Online environment.

Important tips

Frequently asked questions