Commands › Exchange Online

Remove-ADPermission

Exchange Online ExchangeOnlineManagement Remove-*

Remove permissions from an Active Directory object.

Quick start script

# Remove-ADPermission — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-ADPermission
$before | Format-List

# 3. Make the change (dry run first)
Remove-ADPermission -Identity <ADRawEntryIdParameter> -Instance <ADAcePresentationObject> -User <SecurityPrincipalIdParameter> -WhatIf
Remove-ADPermission -Identity <ADRawEntryIdParameter> -Instance <ADAcePresentationObject> -User <SecurityPrincipalIdParameter>

# 4. Verify and diff
$after = Get-ADPermission
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax — 3 parameter sets

AccessRights

Remove-ADPermission [-Identity] <ADRawEntryIdParameter> -User <SecurityPrincipalIdParameter>
 [-AccessRights <ActiveDirectoryRights[]>]
 [-ChildObjectTypes <ADSchemaObjectIdParameter[]>]
 [-Confirm]
 [-Deny]
 [-DomainController <Fqdn>]
 [-ExtendedRights <ExtendedRightIdParameter[]>]
 [-InheritanceType <ActiveDirectorySecurityInheritance>]
 [-InheritedObjectType <ADSchemaObjectIdParameter>]
 [-Properties <ADSchemaObjectIdParameter[]>]
 [-WhatIf]
 [<CommonParameters>]

Owner

Remove-ADPermission [-Identity] <ADRawEntryIdParameter>
 [-Confirm]
 [-DomainController <Fqdn>]
 [-WhatIf]
 [<CommonParameters>]

Instance

Remove-ADPermission [[-Identity] <ADRawEntryIdParameter>] -Instance <ADAcePresentationObject>
 [-AccessRights <ActiveDirectoryRights[]>]
 [-ChildObjectTypes <ADSchemaObjectIdParameter[]>]
 [-Confirm]
 [-Deny]
 [-DomainController <Fqdn>]
 [-ExtendedRights <ExtendedRightIdParameter[]>]
 [-InheritanceType <ActiveDirectorySecurityInheritance>]
 [-InheritedObjectType <ADSchemaObjectIdParameter>]
 [-Properties <ADSchemaObjectIdParameter[]>]
 [-User <SecurityPrincipalIdParameter>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (13)

Parameter	Type	Required	What it controls
-Identity	ADRawEntryIdParameter	yes	The Identity parameter specifies the object from which the permission should be removed.
-Instance	ADAcePresentationObject	yes	The Instance parameter enables you to pass an entire object to the command to be processed. It's mainly used in scripts where an entire object must be passed to the command.
-User	SecurityPrincipalIdParameter	yes	The User parameter specifies whose permissions are being removed from the Active Directory object. You can specify the following types of users or groups:
-AccessRights	ActiveDirectoryRights[]		The AccessRights parameter specifies the rights that you want to remove from the user on the Active Directory object. Valid values include:
-ChildObjectTypes	ADSchemaObjectIdParameter[]		The ChildObjectTypes parameter specifies what type of object the permission should be removed from.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Deny	SwitchParameter		The Deny switch specifies that the permissions you're removing are Deny permissions. You don't need to specify a value with this switch.
-DomainController	Fqdn		The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-ExtendedRights	ExtendedRightIdParameter[]		The ExtendedRights parameter specifies the extended rights to remove.
-InheritanceType	ActiveDirectorySecurityInheritance		The InheritanceType parameter specifies how permissions are inherited. Valid values are:
-InheritedObjectType	ADSchemaObjectIdParameter		The InheritedObjectType parameter specifies what kind of object inherits this access control entry (ACE).
-Properties	ADSchemaObjectIdParameter[]		The Properties parameter specifies what properties the object contains.
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.