How to remove mailbox permissions in Microsoft 365

Mailbox permissions determine who can access, send as, or manage another user’s mailbox in Exchange Online. Over time, users may accumulate access they no longer require due to role changes, project completion, or offboarding. If these permissions are not reviewed and removed promptly, they increase the risk of unauthorized mailbox access and complicate audits.

This article explains how to remove Exchange Online mailbox permissions using native tools such as the Exchange Admin Center (EAC) and Exchange Online PowerShell, and how to remove mailbox permissions for multiple mailboxes in just a few clicks using ManageEngine M365 Manager Plus, a dedicated Microsoft 365 administration tool.

Method 1: How to remove mailbox permissions using the Exchange admin center

Prerequisites

You have the Exchange Administrator role assigned for the account you use to sign in to EAC.

Steps

1. Sign in to the Exchange admin center and navigate to Recipients > Mailboxes.
2. Select a shared mailbox from the list.
3. In the details pane that opens, select the Delegation tab.
4. Click Edit below the Send As, Send on Behalf, and Full Access permissions to modify them.
5. Select the user(s) that you want to remove mailbox permissions for, and click Delete.

Limitation to consider

The Exchange admin center only allows you to remove mailbox permissions for one mailbox at a time. You will have to use Exchange Online PowerShell or a third-party Microsoft 365 administration tool, like M365 Manager Plus, to remove mailbox permissions for multiple mailboxes in a single operation.

Method 2: How to remove mailbox permissions using Exchange Online PowerShell

Prerequisites

Before using Exchange Online PowerShell, verify that:

1. The Exchange Administrator role is applied to the account you use to sign in to Exchange Online PowerShell.
2. You are connected to the Exchange Online PowerShell module.
   1. To check if the Exchange Online PowerShell module is installed, use this script:
      Copy

      Get-Module -ListAvailable ExchangeOnlineManagement
                                          

   2. If it does not return a value, you will have to install the module. To install the Exchange Online PowerShell module, execute this script:
      Copy

      Install-Module ExchangeOnlineManagement -Scope CurrentUser
                                          

   3. To connect to Exchange Online PowerShell, run this script:
      Copy

      Connect-ExchangeOnline
                                          

PowerShell cmdlets to remove mailbox permissions

Each type of mailbox permission requires their own cmdlet to remove them using Exchange Online PowerShell. Below are the cmdlets to remove the specific mailbox permissions.

Remove Full Access permission using Remove-MailboxPermission

The Full Access permission allows a user to open the mailbox and view its contents, but it does not provide rights to send mail using the delegated mailbox. You can remove the Full Access mailbox permission using Remove-MailboxPermission, as shown in the script.

Remove-MailboxPermission -Identity "MailboxName" -User "UserName" -AccessRights FullAccess -InheritanceType All

Remove Send As permission using Remove-RecipientPermission

The Send As permission allows a user to send emails that appear to come directly from the mailbox owner. You have to use the Remove-RecipientPermission cmdlet to remove the Send As permission over the delegated mailbox.

Remove-RecipientPermission -Identity "MailboxName" -Trustee "UserName" -AccessRights SendAs

Remove Send on Behalf permission using Set-Mailbox

The Send on Behalf permission allows a user to send emails with the on behalf of tag. The Set-Mailbox cmdlet is used to remove the Send on Behalf permission of the mailbox.

Set-Mailbox -Identity "MailboxName" -GrantSendOnBehalfTo @{remove="UserName"}

Supported parameters

The following table contains the parameters used when you remove mailbox permissions using Exchange Online PowerShell.

Method 3: How to remove mailbox permissions using M365 Manager Plus

Steps

1. Log in to M365 Manager Plus and navigate to the Management tab > Exchange Online > Mailbox Management and select Mailbox Delegation.
2. Select the checkboxes next to the permissions that you want to modify, and select the Remove Permission radio button.
3. Select Users/Groups from whom the mailbox permissions have to be revoked.
4. Type in the name of the mailboxes from which you want to remove the permissions in the Select Mailbox(es) field and click Find.
5. After finalizing the list of mailboxes you want to remove permissions for, click Apply.

Monitor your Exchange Online mailboxes and more

M365 Manager Plus simplifies the complex task of managing and tracking your Exchange Online mailbox permissions, giving you complete visibility and control over your Exchange Online environment.

Important tips

Frequently asked questions