Commands › Exchange Online

Get-ADPermission

Exchange Online ExchangeOnlineManagement Get-*

Get permissions on an Active Directory object.

Quick start script

# Get-ADPermission — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-ADPermission -Identity <ADRawEntryIdParameter> | Format-List

# 3. Export for evidence / drift tracking
Get-ADPermission | Export-Clixml .\ADPermission-$(Get-Date -Format yyyyMMdd).xml

Syntax — 2 parameter sets

Owner

Get-ADPermission [-Identity] <ADRawEntryIdParameter>
 [-Owner]
 [-DomainController <Fqdn>]
 [<CommonParameters>]

AccessRights

Get-ADPermission [-Identity] <ADRawEntryIdParameter>
 [-User <SecurityPrincipalIdParameter>]
 [-DomainController <Fqdn>]
 [<CommonParameters>]

Parameters (4)

Parameter	Type	Required	What it controls
-Identity	ADRawEntryIdParameter	yes	The Identity parameter specifies the identity of the object for which you're retrieving permissions. You can retrieve the permissions for any Active Directory object using its distinguished name (DN). If the object...
-DomainController	Fqdn		The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-Owner	SwitchParameter		The Owner switch returns the owner of the Active Directory object. You don't need to specify a value with this switch.
-User	SecurityPrincipalIdParameter		The user parameter filters the results who has permissions on the Active Directory object. You can specify the following types of users or groups (security principals) for this parameter:

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.