Commands › Exchange Online

Get-MailboxPermission

Exchange Online ExchangeOnlineManagement Get-*

Retrieve permissions on a mailbox. **Note**: In Exchange Online PowerShell, we recommend that you use the Get-EXOMailboxPermission cmdlet instead of this cmdlet. For more information, see Connect to Exchange Online PowerShell.

Quick start script

# Get-MailboxPermission — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-MailboxPermission -Identity <MailboxIdParameter> | Format-List

# 3. Export for evidence / drift tracking
Get-MailboxPermission | Export-Clixml .\MailboxPermission-$(Get-Date -Format yyyyMMdd).xml

Syntax — 2 parameter sets

Owner

Get-MailboxPermission [-Identity] <MailboxIdParameter> [-Owner]
 [-Credential <PSCredential>]
 [-DomainController <Fqdn>]
 [-GroupMailbox]
 [-IncludeUserWithDisplayName]
 [-ReadFromDomainController]
 [-ResultSize <Unlimited>]
 [-UseCustomRouting]
 [<CommonParameters>]

AccessRights

Get-MailboxPermission [-Identity] <MailboxIdParameter> [-User <SecurityPrincipalIdParameter>] [-SoftDeletedMailbox]
 [-Credential <PSCredential>]
 [-DomainController <Fqdn>]
 [-GroupMailbox]
 [-IncludeSoftDeletedUserPermissions]
 [-IncludeUnresolvedPermissions]
 [-IncludeUserWithDisplayName]
 [-ReadFromDomainController]
 [-ResultSize <Unlimited>]
 [-UseCustomRouting]
 [<CommonParameters>]

Parameters (13)

Parameter	Type	Required	What it controls
-Identity	MailboxIdParameter	yes	The Identity parameter specifies the mailbox you want to view. You can use any value that uniquely identifies the mailbox. For example:
-Credential	PSCredential		The Credential parameter specifies the username and password that's used to run this command. Typically, you use this parameter in scripts or when you need to provide different credentials that have the required permissions.
-DomainController	Fqdn		This parameter is available only in on-premises Exchange.
-GroupMailbox	SwitchParameter		This parameter is available only in the cloud-based service.
-IncludeSoftDeletedUserPermissions	SwitchParameter		This parameter is available only in the cloud-based service.
-IncludeUnresolvedPermissions	SwitchParameter		This parameter is available only in the cloud-based service.
-IncludeUserWithDisplayName	SwitchParameter		This parameter is available only in the cloud-based service.
-Owner	SwitchParameter		The Owner switch returns the owner information for the mailbox that's specified by the Identity parameter. You don't need to specify a value with this switch.
-ReadFromDomainController	SwitchParameter		The ReadFromDomainController switch specifies that information should be read from a domain controller in the user's domain. You don't need to specify a value with this switch.
-ResultSize	Unlimited		The ResultSize parameter specifies the maximum number of results to return. If you want to return all requests that match the query, use unlimited for the value of this parameter. The default value is 1000.
-SoftDeletedMailbox	SwitchParameter		This parameter is available only in the cloud-based service.
-UseCustomRouting	SwitchParameter		This parameter is available only in the cloud-based service.
-User	SecurityPrincipalIdParameter		The User parameter filters the results by who has permissions to the mailbox that's specified by the Identity parameter. You can specify the following types of users or groups (security principals) for this parameter:

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.