During our many EasyEntra pre-sale meetings, we often hear requests from organizations looking to delegate specific areas of administration to non-IT staff or administrative workers.
A common example is the need to allow someone to configure mailbox folder permissions – or calendar delegation in particular – without requiring them to use PowerShell.
This scenario introduces two distinct challenges:
Limiting permissions in Exchange Online
You need a way to give users the right to modify folder permissions – without exposing the broader Exchange Online admin surface.Making calendar permission management user-friendly
Administrative workers should be able to handle these tasks without having to run complex PowerShell scripts.
In this article, we break down exactly how you can solve these challenges.
1. Limiting Permissions in Exchange Online
Create Custom Admin Roles and a Role Group
The first part of the solution is to configure Exchange Online so that delegated users receive only the permissions they need. This involves creating custom roles that contain only the CmdLets necessary for folder permission management (Get-MailboxFolderPermission, Set-MailboxFolderPermission, etc.), bundling the Exchange Admin Roles in a Role Group, and assigning the Role Group to your staff via a mail-enabled security group.
This approach ensures:
- Least-privilege access.
- A controlled, auditable delegation model.
- Easy assignment or removal of the custom role.
The overall process is illustrated here:
Start with existing EXO roles
Built-in roles often contain many cmdlets, making them too broad for safe delegation.
Create new inherited roles
Clone the built-in roles and remove all cmdlets except those required for mailbox folder or calendar permission management.
Combine the custom roles into one Role Group
Bundle the limited roles together to form a single, clearly defined delegated permission set.
Assign the Role Group to a mail-enabled security group
Add delegated users (who do not need to be mail-enabled) to this group so they inherit only the restricted permissions defined by the assigned Role Group.
Maintain access through group membership
Grant or revoke delegated permissions simply by adding or removing users from the security group.
Using PowerShell to Configure Exchange Online Delegation
With the overall approach in place, the next step is implementing it. Below is the PowerShell script that creates the custom roles, builds the role group, and assigns it to a mail-enabled security group – giving you a complete, least-privilege delegation setup in Exchange Online.
For standard mailbox folder (including calendar) delegation, you actually need five different PowerShell cmdlets:
Get-MailboxFolderPermissionAdd-MailboxFolderPermissionSet-MailboxFolderPermissionRemove-MailboxFolderPermissionGet-MailboxFolderStatistics
The first four cmdlets let you view, add, modify, and remove folder permissions. The fifth cmdlet, Get-MailboxFolderStatistics, is essential for resolving the actual folder path in environments where default folders are localized (for example, Inbox → Posteingang in German).
From a role perspective, these cmdlets are split across two standard Exchange admin roles:
All cmdlets except
Set-MailboxFolderPermissionlive in the Mail Recipients role.Set-MailboxFolderPermissionis only available in the Mail Recipient Creation role.
To give our delegated users the full set of folder-permission capabilities without all the extra admin power those roles normally include, we:
Create two custom management roles, each inheriting from one of these standard roles.
Strip away every cmdlet we don’t need, leaving only the five listed above.
Combine both custom roles into a single Role Group that we can safely assign to a mail-enabled security group.
The script below automates exactly that process.
# Connect with Exchange Online using an org admin account
Connect-ExchangeOnline
# Create a mail-enabled security group for delegation
$group = "MailboxFolderDelegation"
New-DistributionGroup $group -Alias $group -Description "Members can manage mailbox folder permissions" -PrimarySmtpAddress $group@azure.skrubbeltrang.com -Type Security
# The CmdLets we need for the new role
$keepCmdlets = @(
'Get-MailboxFolderPermission',
'Add-MailboxFolderPermission',
'Set-MailboxFolderPermission',
'Remove-MailboxFolderPermission',
'Get-MailboxFolderStatistics'
)
# Two roles needed to inherit two different parents
$roleA = "Mailbox Folder Permissions A"
$roleB = "Mailbox Folder Permissions B"
# Create the two base management roles
# This parent role has 'Get-MailboxFolderPermission', 'Add-MailboxFolderPermission', 'Remove-MailboxFolderPermission', and 'Get-MailboxFolderStatistics'
New-ManagementRole -Name $roleA -Parent "Mail Recipients"
# This parent role has 'Set-MailboxFolderPermission'
New-ManagementRole -Name $roleB -Parent "Mail Recipient Creation"
# Remove every CmdLet except what we need from Role A
$entriesA = Get-ManagementRoleEntry -Identity "$roleA\*"
$entriesA |
Where-Object { $keepCmdlets -notcontains $_.Name } |
ForEach-Object {
Remove-ManagementRoleEntry -Identity "$($_.Role)\$($_.Name)" -Confirm:$false
}
# Verify permissions of Role A before moving on
Get-ManagementRoleEntry -Identity "$roleA\*" | ft
# Remove every CmdLet except what we need from Role B
$entriesB = Get-ManagementRoleEntry -Identity "$roleB\*"
$entriesB |
Where-Object { $keepCmdlets -notcontains $_.Name } |
ForEach-Object {
Remove-ManagementRoleEntry -Identity "$($_.Role)\$($_.Name)" -Confirm:$false
}
# Verify permissions of Role B before moving on
Get-ManagementRoleEntry -Identity "$roleB\*" | ft
# Create the Admin Role Group based on the two roles we defined
$roleGroupName = "Mailbox Folder Permissions Management"
New-RoleGroup `
-Name $roleGroupName `
-Roles $roleA, $roleB `
-Description "This role group grants delegated access to manage mailbox folder permissions, including calendar sharing and delegation scenarios. It is intended for helpdesk personnel who require the ability to view, add, modify, and remove mailbox folder permissions as part of their support responsibilities."
# Assign the new role group to our mail-enabled security group
Add-RoleGroupMember -Identity $roleGroupName -Member $groupYou can verify the new Admin Roles and Role Group in the Exchange Admin Center:
2. Managing Folder Permissions Without PowerShell
Making Delegation Practical for Non-IT Staff
Once the correct permissions are in place, the next challenge is how delegated staff actually perform the task. PowerShell is extremely capable, but it’s rarely the right tool for first-line support or non-IT administrative staff who only need to make quick, ad-hoc changes to calendar or mailbox folder permissions.
For many organizations, this becomes a bottleneck:
- PowerShell syntax must be learned and remembered
- Mistyping a single character can cause errors or, worse, unintended changes
- It’s difficult to safely expose PowerShell to non-technical staff
- Senior IT ends up handling routine permission updates that shouldn’t require escalation
To bridge this gap, some teams turn to free hobby projects or build their own PowerShell-based GUI wrappers around the necessary cmdlets. These can work and are great learning tools – but “free” is often only true on paper. In practice, they require:
- Development time
- Ongoing maintenance
- Internal documentation and training
- Troubleshooting when something breaks
- Someone with PowerShell expertise to support the tool
- Handover headaches on employee turnover
For smaller organizations or those with very simple needs, this might be acceptable. But for companies that want reliable delegation with minimal overhead, a more robust solution is often preferred.
This is where a tool like EasyEntra can help.
EasyEntra provides a clean, guided user interface where delegated staff can manage mailbox folder and calendar permissions without ever touching PowerShell. It’s fully documented, actively maintained, and supported – so first-line staff can update permissions quickly while IT retains full oversight.
A few practical benefits:
- Non-IT staff can work confidently in a safe UI
- Routine tasks stop escalating to senior IT
- Everything runs on Microsoft’s standard security and auditing model – no custom roles, no proprietary security layers, and no vendor lock-in
EasyEntra is free for tenants with fewer than 25 licensed users.
For larger environments, pricing is available here.
Whichever route you choose, the goal is the same: make everyday permission updates easy, safe, and efficient – without requiring staff to become PowerShell experts.
