Commands › Exchange Online

Remove-PublicFolderAdministrativePermission

Exchange Online ExchangeOnlineManagement Remove-*

Remove administrative permissions for a public folder or a public folder hierarchy.

Quick start script

# Remove-PublicFolderAdministrativePermission — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-PublicFolderAdministrativePermission
$before | Format-List

# 3. Make the change (dry run first)
Remove-PublicFolderAdministrativePermission -Identity <PublicFolderIdParameter> -AccessRights <MultiValuedProperty> -Instance <PublicFolderAdministrativeAceObject> -WhatIf
Remove-PublicFolderAdministrativePermission -Identity <PublicFolderIdParameter> -AccessRights <MultiValuedProperty> -Instance <PublicFolderAdministrativeAceObject>

# 4. Verify and diff
$after = Get-PublicFolderAdministrativePermission
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax — 2 parameter sets

Identity

Remove-PublicFolderAdministrativePermission [-Identity] <PublicFolderIdParameter> -AccessRights <MultiValuedProperty> -User <SecurityPrincipalIdParameter>
 [-Confirm]
 [-Deny]
 [-DomainController <Fqdn>]
 [-InheritanceType <ActiveDirectorySecurityInheritance>]
 [-Server <ServerIdParameter>]
 [-WhatIf]
 [<CommonParameters>]

Instance

Remove-PublicFolderAdministrativePermission [[-Identity] <PublicFolderIdParameter>] -Instance <PublicFolderAdministrativeAceObject>
 [-AccessRights <MultiValuedProperty>]
 [-Confirm]
 [-Deny]
 [-DomainController <Fqdn>]
 [-InheritanceType <ActiveDirectorySecurityInheritance>]
 [-Server <ServerIdParameter>]
 [-User <SecurityPrincipalIdParameter>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (10)

Parameter	Type	Required	What it controls
-Identity	PublicFolderIdParameter	yes	The Identity parameter specifies the GUID or public folder name that represents a specific public folder. You can also include the path using the format TopLevelPublicFolder\\PublicFolder.
-AccessRights	MultiValuedProperty	yes	The AccessRights parameter specifies the rights being removed. Valid values include:
-Instance	PublicFolderAdministrativeAceObject	yes	The Instance parameter specifies whether to pass an entire object to the command to be processed. It is mainly used in scripts where an entire object must be passed to the command.
-User	SecurityPrincipalIdParameter	yes	The User parameter specifies whose admin permissions are being removed from the specified public folder. You can specify the following types of users or groups (security principals) for this parameter:
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Deny	SwitchParameter		The Deny switch specifies that the permissions you're removing are Deny permissions. You don't need to specify a value with this switch.
-DomainController	Fqdn		The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-InheritanceType	ActiveDirectorySecurityInheritance		The InheritanceType parameter specifies the type of inheritance. Valid values are:
-Server	ServerIdParameter		The Server parameter specifies the Exchange server where you want to run this command. You can use any value that uniquely identifies the server. For example:
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.