Mailbox permissions are commonly checked during compliance and security audits because they control who can read or send emails on behalf of other users. Otherwise, too many unnecessary or outdated delegations may remain unnoticed. To properly maintain access, administrators need a reliable way to check all mailbox delegations in their Microsoft 365 environment.
Mailbox Permissions in Exchange Online
Mailbox delegation consists of three distinct permission types:
- Full Access: Allows a delegate to open and access another user’s mailbox.
- Send As: Allows a delegate to send emails that appear to come from the mailbox owner.
- Send on Behalf: Allows a delegate to send emails on behalf of the mailbox owner (the sender is identified as “Delegate on behalf of Owner”).
The primary challenge in mailbox delegation reviews is asymmetry: You can easily see who has access to a particular mailbox, but there is no way to easily see what mailboxes a particular user has access to. To answer that question, you must iterate through all mailbox permissions in the entire organization.
Let’s look at the available options to list mailbox permissions in Microsoft 365.
How to List All Mailbox Delegate Permissions in Microsoft 365
Below are the native methods admins can rely on to check mailbox delegations in their Microsoft 365 environment.
1. Using Microsoft 365 Admin Center:
Sometimes you only need to check one or two mailboxes. Here’s the quickest way:
- Sign in to the Microsoft 365 admin center. Navigate to Users > Active users.
- Click on the mailbox you want to check. Go to the Mail tab.
- Under Mailbox permissions, you can select the required permission link to access the delegates.
Drawback:
- You cannot generate a consolidated report for the entire tenant; permissions must be viewed one mailbox at a time.
2. Using Exchange Admin Center:
This method allows viewing delegation directly from the mailbox properties, but only one mailbox at a time.
- Sign in to the Exchange Admin Center.
- Go to Recipients > Mailboxes.
- Select a mailbox and click Delegation in the properties pane to see all assigned permissions.
Drawback:
- Similar to the standard Admin Center, the EAC does not support generating a single, tenant-wide delegation report.
- In hybrid environments, certain permissions like “Send As” do not automatically sync and may not be viewable or manageable correctly via the cloud-based EAC.
3. Using PowerShell:
For any serious bulk reporting, PowerShell is a practical option. Here’s a PowerShell script to export a mailbox permission report using PowerShell.
#1. Connect to Exchange Online
Connect-ExchangeOnline
#2. Define an array to hold all results
$FullPermissionReport = @()
#3. Get all mailboxes (User, Shared, etc.)
Write-Host "Retrieving mailboxes..." -ForegroundColor Cyan
$Mailboxes = Get-Mailbox -ResultSize Unlimited
$TotalMailboxes = $Mailboxes.Count
$CurrentMailbox = 0
$ProgressPreference = "Continue"
Write-Host "Processing $TotalMailboxes mailboxes..." -ForegroundColor Cyan
foreach ($MB in $Mailboxes) {
$CurrentMailbox++
$MBIdentity = $MB.UserPrincipalName
# Display progress bar
Write-Progress -Activity "Processing Mailbox Permissions" `
-Status "Processing ($CurrentMailbox of $TotalMailboxes): $MBIdentity" `
-PercentComplete (($CurrentMailbox / $TotalMailboxes) * 100)
# Get Full Access Permissions
$FullAccess = Get-MailboxPermission -Identity $MBIdentity | Where-Object {
($_.User -notlike "*NT AUTHORITY\SELF*") -and ($_.IsInherited -eq $false)
}
# Get Send As Permissions
$SendAs = Get-RecipientPermission -Identity $MBIdentity | Where-Object {
($_.Trustee -notlike "*NT AUTHORITY\SELF*") -and ($_.Trustee -ne "Null sid")
}
# Get Send on Behalf Permissions
$SendOnBehalf = $MB.GrantSendOnBehalfTo
# 4. Consolidate results into a custom object for each delegate
foreach ($FA in $FullAccess) {
$FullPermissionReport += [PSCustomObject]@{
Mailbox = $MBIdentity
Delegate = $FA.User
PermissionType = "Full Access"
}
}
foreach ($SA in $SendAs) {
$FullPermissionReport += [PSCustomObject]@{
Mailbox = $MBIdentity
Delegate = $SA.Trustee
PermissionType = "Send As"
}
}
foreach ($SOB in $SendOnBehalf) {
$FullPermissionReport += [PSCustomObject]@{
Mailbox = $MBIdentity
Delegate = $SOB
PermissionType = "Send on Behalf"
}
}
}
# Clear the progress bar
Write-Progress -Activity "Processing Mailbox Permissions" -Completed
Write-Host "`nProcessing complete! Found $($FullPermissionReport.Count) permission entries." -ForegroundColor Green
#5. Output the final consolidated list
$FullPermissionReport | Out-GridView
# To save to a file instead, use:
# $FullPermissionReport | Export-Csv -Path "C:\AllMailboxPermissions.csv" -NoTypeInformationThe script may take several minutes or even hours to complete. But eventually you’ll see the result set in a GridView, allowing you to, e.g., identify mailboxes with stale permissions:
Drawbacks:
- Requires familiarity with the Exchange Online PowerShell module and manual steps to export results to a usable format like CSV.
- For large tenants (thousands of mailboxes), scripts can be extremely slow and may encounter “I/O issues” or timeout errors.
- The result set is not interactive, and changing or removing permissions will require additional scripting.
Automate Mailbox Delegation Reporting with EasyEntra
EasyEntra addresses these limitations by automatically collecting mailbox delegation data across the entire tenant. It aggregates Full Access, Send As, and Send on Behalf permissions into a single, centralized report, eliminating the need for manual PowerShell scripts.
Key Benefits:
- EasyEntra retrieves delegation information from all mailboxes automatically.
- The report can be filtered by mailbox, delegate, or permission type to quickly find specific delegations.
- Export the complete delegation report for audit or compliance purposes.
- Remove unnecessary or outdated mailbox delegations directly from the report interface.
This eliminates the need for repeated PowerShell executions and reduces the operational overhead associated with manual delegation reviews.
In addition to visibility, EasyEntra helps identify obsolete or risky delegations, including permissions tied to deleted users or orphaned SID-based entries that are not easily visible in the Microsoft 365 or Exchange Admin Centers. These stale permissions often remain unnoticed during normal operations but are frequently flagged during security reviews.
For detailed instructions on creating a mailbox delegation report in EasyEntra, visit:
https://easyentra.com/knowledge-base/how-to/how-to-create-a-report-delegated-access-to-mailboxes/
