Commands › Exchange Online
Remove-RecipientPermission
Remove SendAs permission from users in a cloud-based organization.
Quick start script
# Remove-RecipientPermission — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org
# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-RecipientPermission
$before | Format-List
# 3. Make the change (dry run first)
Remove-RecipientPermission -Identity <RecipientIdParameter> -AccessRights <MultiValuedProperty> -Trustee <SecurityPrincipalIdParameter> -WhatIf
Remove-RecipientPermission -Identity <RecipientIdParameter> -AccessRights <MultiValuedProperty> -Trustee <SecurityPrincipalIdParameter>
# 4. Verify and diff
$after = Get-RecipientPermission
Compare-Object ($before | Out-String) ($after | Out-String)Syntax
Remove-RecipientPermission [-Identity] <RecipientIdParameter> -AccessRights <MultiValuedProperty> -Trustee <SecurityPrincipalIdParameter>
[-Confirm]
[-Deny]
[-MultiTrustees <MultiValuedProperty>]
[-SkipDomainValidationForMailContact]
[-SkipDomainValidationForMailUser]
[-SkipDomainValidationForSharedMailbox]
[-WhatIf]
[<CommonParameters>]Parameters (10)
| Parameter | Type | Required | What it controls |
|---|---|---|---|
| -Identity | RecipientIdParameter | yes | The Identity parameter specifies the target recipient. The user or group specified by the Trustee parameter can no longer operate on this recipient. |
| -AccessRights | MultiValuedProperty | yes | The AccessRights parameter specifies the permission that you want to remove from the trustee on the target recipient. The only valid value for this parameter is SendAs. |
| -Trustee | SecurityPrincipalIdParameter | yes | The Trustee parameter specifies whose Send As permissions are being removing from the specified target recipient. You can specify the following types of users or groups (security principals) for this parameter: |
| -Confirm | SwitchParameter | The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding. | |
| -Deny | SwitchParameter | {{ Fill Deny Description }} | |
| -MultiTrustees | MultiValuedProperty | {{ Fill MultiTrustees Description }} | |
| -SkipDomainValidationForMailContact | SwitchParameter | The SkipDomainValidationForMailContact switch skips the check that confirms the proxy addresses of the external contact specified by the Identity parameter are in an accepted domain of the organization. You don't... | |
| -SkipDomainValidationForMailUser | SwitchParameter | The SkipDomainValidationForMailUser switch skips the check that confirms the proxy addresses of the mail user specified by the Identity parameter are in an accepted domain of the organization. You don't need to... | |
| -SkipDomainValidationForSharedMailbox | SwitchParameter | The SkipDomainValidationForSharedMailbox switch skips the check that confirms the proxy addresses of the shared mailbox specified by the Identity parameter are in an accepted domain of the organization. You don't... | |
| -WhatIf | SwitchParameter | The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch. |
Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.