Commands › Exchange Online

Set-MailboxIRMAccess

Exchange Online ExchangeOnlineManagement Set-*

Block delegate access to IRM-protected messages in other mailboxes (shared mailboxes or user mailboxes where delegates have Full Access permission).

Quick start script

# Set-MailboxIRMAccess — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-MailboxIRMAccess
$before | Format-List

# 3. Make the change
Set-MailboxIRMAccess -Identity <MailboxIdParameter> -AccessLevel <IRMAccessLevel> -User <SecurityPrincipalIdParameter>

# 4. Verify and diff
$after = Get-MailboxIRMAccess
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-MailboxIRMAccess -AccessLevel <IRMAccessLevel> [-Identity] <MailboxIdParameter> -User <SecurityPrincipalIdParameter> [<CommonParameters>]

Parameters (3)

Parameter	Type	Required	What it controls
-Identity	MailboxIdParameter	yes	The Identity parameter specifies the mailbox that you want to modify. You can use any value that uniquely identifies the mailbox. For example
-AccessLevel	IRMAccessLevel	yes	The AccessLevel parameter specifies what delegates can do to IRM-protected messages in the mailbox that's specified by the Identity parameter.
-User	SecurityPrincipalIdParameter	yes	Note: Delegates that you specify with this parameter must already have Full Access permission to the mailbox. For more information, see [Manage permissions for recipients in Exchange...

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.