Commands › Exchange Online

Remove-MailboxPermission

Exchange Online ExchangeOnlineManagement Remove-*

Remove permissions from a user's mailbox or from an Exchange Server 2016, Exchange Server 2019 or Exchange Online mail user.

Quick start script

# Remove-MailboxPermission — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-MailboxPermission
$before | Format-List

# 3. Make the change (dry run first)
Remove-MailboxPermission -Identity <MailboxIdParameter> -AccessRights <MailboxRights[]> -Instance <MailboxAcePresentationObject> -WhatIf
Remove-MailboxPermission -Identity <MailboxIdParameter> -AccessRights <MailboxRights[]> -Instance <MailboxAcePresentationObject>

# 4. Verify and diff
$after = Get-MailboxPermission
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax — 5 parameter sets

AccessRights

Remove-MailboxPermission [-Identity] <MailboxIdParameter> -AccessRights <MailboxRights[]> -User <SecurityPrincipalIdParameter>
 [-BypassMasterAccountSid]
 [-Confirm]
 [-Deny]
 [-DomainController <Fqdn>]
 [-GroupMailbox]
 [-IgnoreDefaultScope]
 [-InheritanceType <ActiveDirectorySecurityInheritance>]
 [-SoftDeletedMailbox]
 [-WhatIf]
 [<CommonParameters>]

Instance

Remove-MailboxPermission [[-Identity] <MailboxIdParameter>] -Instance <MailboxAcePresentationObject>
 [-AccessRights <MailboxRights[]>]
 [-Confirm]
 [-Deny]
 [-DomainController <Fqdn>]
 [-GroupMailbox]
 [-IgnoreDefaultScope]
 [-InheritanceType <ActiveDirectorySecurityInheritance>]
 [-User <SecurityPrincipalIdParameter>]
 [-WhatIf]
 [<CommonParameters>]

Owner

Remove-MailboxPermission [[-Identity] <MailboxIdParameter>]
 [-BypassMasterAccountSid]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-GroupMailbox]
 [-IgnoreDefaultScope]
 [-WhatIf]
 [<CommonParameters>]

ClearAutoMapping

Remove-MailboxPermission [-Identity] <MailboxIdParameter> [-ClearAutoMapping]
 [-BypassMasterAccountSid]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-IgnoreDefaultScope]
 [-WhatIf]
 [<CommonParameters>]

1 more parameter sets — see the parameter table below.

Parameters (15)

Parameter	Type	Required	What it controls
-Identity	MailboxIdParameter	yes	The Identity parameter specifies the mailbox where you are removing permissions. You can use any value that uniquely identifies the mailbox: For example:
-AccessRights	MailboxRights[]	yes	The AccessRights parameter specifies the permission that you want to remove from the user on the mailbox. Valid values are:
-Instance	MailboxAcePresentationObject	yes	This parameter is available only in on-premises Exchange.
-User	SecurityPrincipalIdParameter	yes	The User parameter specifies whose permissions are being removed from the specified mailbox. You can specify the following types of users or groups (security principals) for this parameter:
-ClearAutoMapping	SwitchParameter	yes	This parameter is functional only in the cloud-based service.
-ResetDefault	SwitchParameter	yes	This parameter is functional only in the cloud-based service.
-BypassMasterAccountSid	SwitchParameter		This parameter is available only in the cloud-based service.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Deny	SwitchParameter		The Deny switch specifies that the permissions you're removing are Deny permissions. You don't need to specify a value with this switch.
-DomainController	Fqdn		This parameter is available only in on-premises Exchange.
-GroupMailbox	SwitchParameter		This parameter is available only in the cloud-based service.
-IgnoreDefaultScope	SwitchParameter		The IgnoreDefaultScope switch tells the command to ignore the default recipient scope setting for the Exchange PowerShell session, and to use the entire forest as the scope. You don't need to specify a value with this switch.
-InheritanceType	ActiveDirectorySecurityInheritance		The InheritanceType parameter specifies whether permissions are inherited to folders within the mailbox. Valid values are:
-SoftDeletedMailbox	SwitchParameter		This parameter is available only in the cloud-based service.
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.