Adding Calendar Permissions in Microsoft 365 and Exchange with PowerShell

Need to manage calendar access in Exchange? PowerShell is the preferred way to manage access to calendars in user and shared mailboxes that are hosted on on-premises Exchange Server or on Microsoft 365. Our guide explains how to use PowerShell to list, add, and remove calendar permissions in Exchange mailboxes.

Contents

Introduction to Calendar Permissions in Exchange

Calendar in a Microsoft 365 and Exchange Server mailbox is a pre-configured system folder that is displayed in a special calendar view in Outlook/OWA. Users in an Exchange organization can view, create or edit items in other users’ calendars if they have been granted permission to access them.

Default calendar permissions in Outlook and OWA

By default, users can only view Free/Busy information in other users’ calendars. Each user can grant and revoke permissions to their calendar to other users from within the Outlook client interface. For detailed mailbox folder-level calendar permissions (such as assigning specific AccessRights to a user’s Calendar folder), Exchange Online PowerShell provides more granular control than the Exchange admin center.

PowerShell Cmdlets for Calendar Permissions

The following PowerShell cmdlets can be used to manage permissions for Calendar (and other mailbox folders):

Get-MailboxFolderPermission — list current calendar permissions;
Add-MailboxFolderPermission — grant calendar permissions to a user or group;
Set-MailboxFolderPermission — modify existing permissions;
Remove-MailboxFolderPermission — remove calendar permissions;
Get-MailboxCalendarFolder — get calendar folder information.

Connecting to Exchange Online and On-Premises Exchange with PowerShell

Connect to your Microsoft 365 or on-premises Exchange Server tenant from the PowerShell console in order to use these cmdlets.

PowerShell version. For new Exchange Online automation, we recommend using PowerShell 7.6 or later. Windows PowerShell 5.1 remains supported by the Exchange Online PowerShell module. You need to make sure you are using a supported version of PowerShell before installing/updating the module.

Use the Exchange Online PowerShell module to connect to Microsoft 365 (Exchange Online) tenant:

Install-Module ExchangeOnlineManagement -Scope CurrentUser

Get-InstalledModule ExchangeOnlineManagement

Connect-ExchangeOnline -UserPrincipalName kirill@theitbros.onmicrosoft.com -ShowProgress $true

set room calendar permissions office 365 powershell

In order to update an existing installation of the ExchangeOnlineManagement module, run the following command:

Update-Module ExchangeOnlineManagement

If you are logged on locally to an on-premises Exchange Server, open the Exchange Management Shell (EMS) to run Exchange PowerShell cmdlets. For supported on-premises Exchange deployments, you should use the Exchange Management Shell (EMS) or Exchange Management Tools provided with Exchange Server Subscription Edition (SE). Exchange Server 2016 and 2019 reached end of support on October 14, 2025. Exchange 2010 and earlier are also out of support and you should treat them as legacy environments.
Legacy Exchange environments: If you still manage such a legacy environment, you may encounter the legacy Exchange PowerShell snap-in:
```
Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn
```
Note that this method is provided for legacy environments only and we don’t recommend it for new/supported Exchange deployments.

Authentication for unattended automation

For unattended scripts and scheduled automation, Exchange Online PowerShell supports app-only authentication with a managed identity or a certificate:

Connect-ExchangeOnline `
-ManagedIdentity `
-Organization "contoso.onmicrosoft.com"

Or, using a certificate:

Connect-ExchangeOnline `
-AppId "<application-id>" `
-CertificateThumbprint "<certificate-thumbprint>" `
-Organization "contoso.onmicrosoft.com"

Keep in mind that these methods require the appropriate Microsoft Entra app config and Exchange Online permissions.

Required Exchange permissions

In order to manage calendar folder permissions, the account must have the appropriate Exchange RBAC permissions for the requested operation. In enterprise environments, you should use the least-privileged role/role group that provides the required access instead of broad admin roles. In case a cmdlet fails with an authorization error, you should check the roles available for the cmdlet and the roles assigned to the account:

Get-ManagementRole -Cmdlet Add-MailboxFolderPermission

Get-ManagementRole -Cmdlet Set-MailboxFolderPermission

Get-ManagementRoleAssignment -RoleAssignee admin@contoso.com

The required permissions depend on the cmdlet and operation being performed.

View Mailbox Calendar Permissions with PowerShell

Note that you should use UPN (user@domain.com) as the primary and recommended identifier for all mailbox operations.

The Get-MailboxFolderPermission cmdlet lists the existing calendar permissions for the specified mailbox. Specify the mailbox name and the Calendar folder name as the cmdlet arguments:

$mailbox = "cyril@domain.com"
Get-MailboxFolderPermission "$mailbox`:\Calendar"

Get-MailboxCalendarFolder retrieving calendar folder info

In this case, only the default permission AvailabilityOnly is assigned to a Calendar folder. This allows other users to see Free/Busy information in the calendar.

Using Get-EXOMailboxFolderPermission in Exchange Online

Note that our examples below demonstrate the basic method. For really large tenants, you should add logging, result export, retry/backoff handling, and batching for production automation.

In case you are managing Exchange Online, you can also use the REST-based Get-EXOMailboxFolderPermission cmdlet:

Get-EXOMailboxFolderPermission `
-Identity cyril@theitbros.com:\Calendar

This cmdlet is available in the Exchange Online PowerShell module and is optimized for retrieving mailbox folder permissions in Exchange Online.

How to Get Calendar Folder Info

You can use the Get-MailboxCalendarFolder cmdlet in order to view calendar folder settings and properties:

Get-MailboxCalendarFolder -Identity cyril@theitbros.com

You can retrieve detailed info about a calendar folder using the following command:

Get-MailboxCalendarFolder -Identity cyril@theitbros.com |
Format-List

This cmdlet can be useful when you are troubleshooting calendar config issues or reviewing calendar folder settings.

Note. The name of the folder in which the calendar is stored may differ depending on the mailbox language settings. If this command returns that ‘username:\calendar’ cannot be found, it is most likely that the user has Outlook language settings other than English. Appropriately, the Calendar folder name can be different (calendar\kalender\calendario\calendrier\календарь). For example, to view calendar permissions for the Dutch Language (nl-NL) use the command:
Get-MailboxFolderPermission user@domain.com:\Agenda
Check the calendar folder path with the following command:
(Get-EXOMailboxFolderStatistics user@domain.com -FolderScope Calendar |
Where-Object FolderType -eq 'Calendar').FolderPath

Handling transient errors in large Exchange Online tenants

Keep in mind that bulk operations against Exchange Online can encounter transient failures, throttling, or temporary service errors. The try/catch blocks used in the examples below prevent a single failed mailbox from terminating the entire operation, but they do not retry failed requests. In case you are working with large production tenant, you should add retry with exponential backoff, logging, and a final report of mailboxes that could not be processed.

For example, you can use a small retry helper for operations that may fail temporarily:

function Invoke-WithRetry {
param(
[Parameter(Mandatory)]
[scriptblock]$ScriptBlock,

[int]$MaxRetries = 4,

[int]$InitialDelaySeconds = 2
)

for ($attempt = 1; $attempt -le $MaxRetries; $attempt++) {
try {
return & $ScriptBlock
}
catch {
if ($attempt -eq $MaxRetries) {
throw
}

$delay = $InitialDelaySeconds * [math]::Pow(2, $attempt - 1)

Write-Warning "Attempt $attempt failed. Retrying in $delay seconds..."
Start-Sleep -Seconds $delay
}
}
}

You should use the helper around Exchange Online operations that should be retried:

Invoke-WithRetry {
Get-EXOMailboxFolderPermission `
-Identity "$upn`:\Calendar" `
-ErrorAction Stop
}

The helper retries any exception raised by the wrapped command. You should refine the retry logic to target only transient errors (such as throttling and temporary service failures), while handling permanent errors (such as authorization failures, invalid parameters, and missing mailboxes) without retries.

List Default Mailbox Calendar Permissions in Exchange with Get-EXOMailbox

You can get the list of default mailbox calendar permissions in your organization using following command:

Get-EXOMailbox -ResultSize Unlimited -PageSize 500 |
ForEach-Object {

$upn = $_.UserPrincipalName

try {
Invoke-WithRetry {
    Get-EXOMailboxFolderPermission `
        -Identity "$upn`:\Calendar" `
        -ErrorAction Stop
} |
Where-Object { $_.User -eq "Default" } |
Select-Object `
@{Name="Mailbox";Expression={$upn}},
Identity,
User,
AccessRights
}
catch {
Write-Warning "Failed to read calendar permissions for $upn : $($_.Exception.Message)"
}
}

How can I find calendars a specific user has access to?

You can find all the calendars in your organization that a particular user has been granted access to. In this example, we want to display a list of user mailboxes whose calendars are allowed to be accessed by a user named Muller:

$delegate = "muller@domain.com"

Get-EXOMailbox -ResultSize Unlimited |
ForEach-Object {
$upn = $_.UserPrincipalName

try {
Invoke-WithRetry {
Get-EXOMailboxFolderPermission `
-Identity "$upn`:\Calendar" `
-User $delegate `
-ErrorAction Stop
} |
Select-Object `
@{Name="Mailbox";Expression={$upn}},
Identity,
User,
AccessRights
}
catch {
Write-Warning "Failed for $upn : $($_.Exception.Message)"
}
}

Note that depending on environment, the User field may contain UPN, alias, or domain\user format.

PageSize controls the number of mailbox objects returned per page. The appropriate value depends on the size of the tenant and the workload; you should not treat it as a universal performance setting.

The Mailbox and Identity columns identify the mailbox and calendar folder, while the User column shows the user who has permissions on the calendar. The AccessRights field displays the assigned calendar permissions.

Understanding Outlook Calendar Permissions

When managing calendar and Outlook folder permissions, you can use the following predefined permission levels:

Owner — gives full control of the mailbox folder: read, create, modify, delete items/folders, and manage permissions;
PublishingEditor — read, create, modify, and delete items/subfolders (all permissions, except the right to change permissions);
Editor — read, create, modify, and delete items (can’t create subfolders);
PublishingAuthor — create, and read all items/subfolders. You can modify and delete only items that you have created;
Author — create and read items. Edit and delete own items;
NonEditingAuthor — full read access, and create items. You can delete only your own items;
Reviewer — read folder items only;
Contributor — create items and folders (can’t read items);
AvailabilityOnly — read Free/Busy time from the calendar;
LimitedDetails — view the availability, subject and location of appointments in the calendar;
None — no permissions to access the folder.

You can also use granular permissions to fine-tune the access rights to the mailbox calendar:

CreateItems;
CreateSubfolders;
DeleteAllItems;
DeleteOwnedItems;
EditAllItems;
EditOwnedItems;
FolderContact;
FolderOwner;
FolderVisible;
ReadItems.

The Permission Level roles described above are just a set of granular permissions. For example, the Editor role is a set of the following individual permissions:

CreateItems
DeleteAllItems
DeleteOwnedItems
EditAllItems
EditOwnedItems
FolderVisible
ReadItems

Adding Calendar Permissions in Exchange with PowerShell

In order to grant user2 the permission to view and edit user1 calendar items, use the following command:

Add-MailboxFolderPermission -Identity user1@domain.com:\calendar -user user2@domain.com -AccessRights Editor

The same mailbox folder permission cmdlets can be used with shared mailboxes. You need to simply specify the shared mailbox address in the Identity parameter when granting, modifying, viewing, or removing calendar permissions:

Add-MailboxFolderPermission `
-Identity sharedcalendar@theitbros.com:\Calendar `
-User cyril@theitbros.com `
-AccessRights Reviewer

If some of the items in the calendar are marked as Private, you can delegate the permissions to view Private calendar items:

Add-MailboxFolderPermission `
    -Identity user1@domain.com:\Calendar `
    -User user2@domain.com `
    -AccessRights Editor `
    -SharingPermissionFlags Delegate,CanViewPrivateItems

You can assign calendar permissions to a specific user’s calendar in bulk. Create a CSV text file containing a list of users you want to grant permission to, and run the command:

Import-Csv users.csv | ForEach-Object {

    $user = $_.User
    $calendar = "user1@domain.com:\Calendar"

    try {
        $permission = Invoke-WithRetry {
    Get-EXOMailboxFolderPermission `
        -Identity $calendar `
        -User $user `
        -ErrorAction Stop
}

if ($permission) {
    Invoke-WithRetry {
        Set-MailboxFolderPermission `
            -Identity $calendar `
            -User $user `
            -AccessRights Editor `
            -ErrorAction Stop
    }

    Write-Host "Updated permissions for $user"
}
else {
    Invoke-WithRetry {
        Add-MailboxFolderPermission `
            -Identity $calendar `
            -User $user `
            -AccessRights Editor `
            -ErrorAction Stop
    }

    Write-Host "Added permissions for $user"
}
    }
    catch {
        Write-Warning "Failed for $user : $($_.Exception.Message)"
    }
}

In some cases, you may need to allow a particular user (for example, a secretary) to manage all the calendars in the organization:

Get-EXOMailbox -ResultSize Unlimited -PageSize 500 |
ForEach-Object {

    $mailbox = $_.UserPrincipalName
    $delegate = "secretary@domain.com"

    try {
    $perm = Invoke-WithRetry {
        Get-EXOMailboxFolderPermission `
            -Identity "$mailbox`:\Calendar" `
            -User $delegate `
            -ErrorAction Stop
    }

    if ($perm) {
        Invoke-WithRetry {
            Set-MailboxFolderPermission `
                -Identity "$mailbox`:\Calendar" `
                -User $delegate `
                -AccessRights Editor `
                -ErrorAction Stop
        }
    }
    else {
        Invoke-WithRetry {
            Add-MailboxFolderPermission `
                -Identity "$mailbox`:\Calendar" `
                -User $delegate `
                -AccessRights Editor `
                -ErrorAction Stop
        }
    }
}
    catch {
        Write-Warning "Failed for $mailbox : $($_.Exception.Message)"
    }
}

You can use the SendNotificationToUser parameter with Add-MailboxFolderPermission and Set-MailboxFolderPermission to generate a sharing invitation email. The option -SendNotificationToUser $true can be used only when you set one of the following permissions via the AccessRights parameter: AvailabilityOnly, LimitedDetails, Reviewer, or Editor. The following command will send a sharing invitation to the user2:

Add-MailboxFolderPermission -Identity user1@domain.com:\calendar -user user2@domain.com -AccessRights Editor -SendNotificationToUser $true

This is what the sharing invitation will look like in Outlook:

You’re invited to share this calendar.
UserName has invited you to view his or her Calendar. Click the Open button above.

Outlook calendar permissions sharing invitation

Note. You can grant access to the mailbox calendar not only for an individual user, but also for a Microsoft 365 group or a mail-enabled AD security group.

How to change or remove calendar permissions with PowerShell

You can change the Default permissions for the shared mailbox calendar folder and allow all organization users to view calendar items:

Set-MailboxFolderPermission -Identity projects@domain.com:\calendar -User Default -AccessRights Reviewer

Note that the Default principal is a built-in security principal that represents all authenticated users in the organization.

Check the current calendar permissions again with the Get-MailboxFolderPermission cmdlet. They should change:

Get-EXOMailboxFolderPermission -Identity project@domain.com:\Calendar

FolderName User AccessRights
———- —- ————
Calendar Default {Reviewer}
Calendar Anonymous {None}
Calendar user2 {Editor}

You can also assign mailbox permissions to the Exchange distribution group, rather than to an individual user:

New-DistributionGroup -Type Security -Name "Resource Calendar Owners" -Alias "grResourceCalendarAccess"

Add-MailboxFolderPermission -Identity user1@domain.com:\calendar -User grResourceCalendarAccess -AccessRights Owner

You can make this bulk calendar permissions change using a simple PowerShell script. To change the Default calendar permission for all mailboxes to Reviewer:

Get-EXOMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited -PageSize 500 |
ForEach-Object {
   try {
    Invoke-WithRetry {
        Set-MailboxFolderPermission `
            -Identity "$($_.UserPrincipalName):\Calendar" `
            -User Default `
            -AccessRights Reviewer `
            -ErrorAction Stop
    }
}
catch {
    Write-Warning "Failed for $($_.UserPrincipalName): $($_.Exception.Message)"
}
}

This allows authenticated users in the organization to view calendar items in these mailboxes. Note that granting Reviewer permissions to the Default principal allows all authenticated users in the organization to view calendar items. You should test this config carefully before applying it organization-wide.

To revoke the calendar permissions, use the Remove-MailboxFolderPermission cmdlet.

Remove-MailboxFolderPermission -Identity user1@domain.com:\calendar -user user2@domain.com

In order to remove all custom calendar permissions, run the following command:

Get-EXOMailboxFolderPermission `
    -Identity user1@domain.com:\Calendar |
Where-Object { $_.User -notin @("Default","Anonymous") } |
ForEach-Object {
    try {
        Invoke-WithRetry {
            Remove-MailboxFolderPermission `
                -Identity $_.Identity `
                -User $_.User `
                -Confirm:$false `
                -ErrorAction Stop
        }
    }
    catch {
        Write-Warning "Failed to remove permission for $($_.User) on $($_.Identity): $($_.Exception.Message)"
    }
}

Note. Since Exchange Online V3 you got modern REST-based cmdlets such as Get-EXOMailbox and Get-EXORecipient. However, while Exchange Online provides the REST-based Get-EXOMailboxFolderPermission cmdlet for reading mailbox folder permissions, permission changes still require the traditional Add-MailboxFolderPermission, Set-MailboxFolderPermission, and Remove-MailboxFolderPermission cmdlets.

The previous example removes all custom permissions except Default and Anonymous in Exchange Online. If you want to preserve specific delegated accounts (such as a secretary mailbox), exclude them from the removal filter as shown below:

$delegate = "secretary@domain.com"

Get-EXOMailboxFolderPermission `
-Identity brett.jackson@domain.com:\Calendar |
Where-Object { $_.User -notin @("Default", "Anonymous", $delegate) } |
ForEach-Object {
try {
Invoke-WithRetry {
Remove-MailboxFolderPermission `
-Identity $_.Identity `
-User $_.User `
-Confirm:$false `
-ErrorAction Stop
}
}
catch {
Write-Warning "Failed to remove permission for $($_.User) on $($_.Identity): $($_.Exception.Message)"
}
}

When you finish managing Exchange Online, don’t forget to close the Exchange Online PowerShell session:

Disconnect-ExchangeOnline -Confirm:$false

After granting calendar permissions, users can access the shared calendar from Outlook/Outlook on the web. The exact steps depend on the Outlook client and whether the calendar belongs to a user, shared mailbox, or resource mailbox.

Exchange Online Microsoft 365 Office 365 Powershell