Export Shared Mailbox Permission Report to CSV using PowerShell

What is Shared Mailbox in Office 365? 

Shared Mailbox allows a group of users to view and send emails from a common email address. I.e., any member of the shared mailbox can respond to an email that sent to a shared mailbox. And any response sent by its members appears as it sent from the shared mailbox rather than the individual person.  

Shared Mailbox is useful for help and support, reception desk, or any function that is shared by multiple people. 

 

Shared Mailbox and its Member: 

Since Shared Mailbox has no owner, it doesn’t have its own password. So, users cannot access it directly. You need to add users as members to access the Shared Mailbox. A member can access Shared Mailbox by log in to his mailbox.  

Member can ‘send as’ or ‘send on behalf of’ the Shared Mailbox based on the permission given by the administrator. 

 

How to get Shared Mailbox and its Members? 

To get Shared Mailbox members, you need to find users’ permission on Shared Mailbox. A user with full access permission on Shared mailbox considered as its member. Apart from that Shared Mailbox can have delegates. Shared mailbox delegates can be retrieved using following rights: Send As and Send on Behalf.   

  1. Full Access – Allows the delegate to open, view and modify Shared Mailbox content but doesn’t allow to send email. 
  2. Send As – Allows the delegate to send email as Shared Mailbox. In this case, the recipient has no indication about that the mail was sent by delegate. 
  3. Send on Behalf – Allows delegate to send email on belhaf of shared maiilbox. The recipient can identify the delegate by seeing e-mail’s from address (<Delegate> on behalf of <Shared Mailbox>). 

You can get Shared Mailbox permissions from Exchange Admin Center (EAC), but it’s per mailbox based. To be more scalable, you can get the permissions through PowerShell. The user rights of a Shared Mailbox are retrieved from PowerShell cmdlets Get-MailboxGet-MailboxPermission, and Get-RecipientPermission 

Microsoft does not have a good report to show which users have full access, send as, and send on behalf permission on Shared Mailbox. So, we built the following PowerShell script to fetch you a nicely formatted Shared Mailbox permissions report. And this script supports more advanced filtering options too. 

 

You can download the script from TechNet Gallery 

 

Script Highlights: 
  • The script display only “Explicitly assigned permissions” to mailboxes which means it will ignore “SELF” permission that each user on his mailbox and inherited permission. 
  • Exports output to CSV file. 
  • The script can be executed with MFA enabled account also. 
  • You can choose to either “export permissions of all mailboxes” or pass an input file to get permissions of specific mailboxes alone. 
  • Allows you to filter output using your desired permissions like Send-as, Send-on-behalf or Full access. 
  • This script is scheduler friendly. I.e., credentials can be passed as a parameter instead of saving inside the script 

 

Export Shared Mailbox Permission Report Using PowerShell: 

Since the script supports both MFA enabled account and non-MFA account, it requires a different approach for each method.  

How to: Execute ‘Shared Mailbox Permission’ PowerShell Script:  

For non-MFA account, you can run the script as you run normally. 

 

How to: Execute ‘Shared Mailbox Permission’ PowerShell Script with MFA:  

To execute the script with MFA enabled account, you need to mention -MFA switch during script execution. 

To know more about how to connect Exchange Online PowerShell with MFA, refer to our blog Connect Exchange Online PowerShell with MFA. 

 

Sample Output: 

The exported report stores the most required attributes like Display Name, User Principal Name, Primary SMTP Address, Email Aliases, Access Type, and User with Access. 

The output will look similar to the below screenshot. 

Shared Mailbox Permission Report

 

More Use-cases:

You can use params/switches to get a more granular report. 

  • Export Permissions for single/list of Shared Mailboxes 
  • Export Shared Mailbox full access permission 
  • List Shared Mailbox send as permission 
  • Export Shared Mailbox send on behalf permission to CSV 
  • Export Shared mailbox members to CSV 
  • Schedule Shared Mailbox permission report 

 

Export Shared Mailbox Permissions for Single/List of Shared Mailbox: 

You can use –MBNamesFile param to export permissions of a Shared Mailbox from the input list called “SharedMB.txt”.  

To get permissions of specific mailboxes, pass an input file with a Display Name/ Alias/ Distinguished Name/ Canonical DN/ Email Address or GUID of Shared Mailboxes. 

./GetSharedMailboxPermissions.ps1 -MBNamesFile C:/SharedMB.txt 

The mailbox names CSV File must follow the format below: Identity of mailboxes separated by new line without header. 

Export shared mailbox membership

If the input file has non-shared mailbox, then it will show error. you can refer our previous blog to export all mailbox permissions report.

 

Export Shared Mailbox Full Access Permissions to CSV 

You can use -FullAccess switch param to export mailbox full access permission to CSV file. The script displays only “explicitly assigned permissions” to mailboxes, which means it will ignore inherited permission. 

 

Export Shared Mailbox SendAs Permission to CSV 

 -SendAs param used to filter output that only displays mailboxes, which has send-as permission delegated. 

 

Export Shared Mailbox Sendonbehalf Permission to CSV 

To export Shared Mailbox members who have send on behalf permission, execute the script with SendOnBehalf switch param. 

 

List Shared Mailboxes and Members: 

To export all Shared Mailboxes with its members, run the script as follows. The output lists all members with their permissions on Shared Mailbox. 

 

Export more Granular ‘Shared Mailbox Permission Report’: 

By default, this PowerShell script supports multiple advanced filtering options. You can use one or more filters during execution time. 

The above output lists users who have full access and send as permission on Shared Mailboxes. 

 

Schedule Shared Mailbox Permission Report: 

Since this script is scheduler-friendly, you can schedule script in Windows Task Scheduler by explicitly mentioning the credential. 

 

I hope this blog is helpful to you. If you need more attributes or enhancements, please mention them in the comment section. We will help you to edit this script.