PowerShell is the preferred way to manage access to calendars in user and shared mailboxes that are hosted on on-premises Exchange Server or on Microsoft 365. This guide explains how to use PowerShell to list, add, and remove calendar permissions in Exchange mailboxes.
Calendar in a Microsoft 365 and Exchange Server mailbox is a pre-configured system folder that is displayed in a special calendar view in Outlook or OWA. Users in an Exchange organization can view, create or edit items in other users’ calendars if they have been granted permission to access them.
Default calendar permissions in Outlook and OWA
By default, users can only view Free/Busy information in other users’ calendars.ย Each user can grant and revoke permissions to their calendar to other users from within the Outlook client interface. For detailed mailbox folder-level calendar permissions (such as assigning specific AccessRights to a user’s Calendar folder), Exchange Online PowerShell provides more granular control than the Exchange admin center.
PowerShell Cmdlets for Calendar Permissions
The following PowerShell cmdlets can be used to manage permissions for Calendar (and other mailbox folders):
Get-MailboxFolderPermission โ list current calendar permissions;
Add-MailboxFolderPermission โ grant calendar permissions to a user or group;
If you are logged on locally to an on-premises Exchange Server, open the Exchange Management Shell (EMS) to run Exchange PowerShell cmdlets. For Exchange Server 2016 and 2019, we recommend using the Exchange Management Shell/Exchange Management Tools rather than manually loading the Exchange snap-in.
For Exchange Server 2010 and older environments, you may encounter the Exchange PowerShell snap-in method:
# For Exchange Online Disconnect-ExchangeOnline -Confirm:$false
# For on-premises (legacy PSSession) Remove-PSSession $Session
Note. Remote PowerShell (New-PSSession + Import-PSSession) is an old method in on-prem Exchange environments. We recommend you to use the ExchangeOnlineManagement module for Exchange Online instead.
View Mailbox Calendar Permissions with PowerShell
Note that you should use UPN (user@domain.com) as the primary and recommended identifier for all mailbox operations.
The Get-MailboxFolderPermission cmdlet lists the existing calendar permissions for the specified mailbox. Specify the mailbox name and the Calendar folder name as the cmdlet arguments:
In this case, only the default permission “AvailabilityOnly” is assigned to a Calendar folder. This allows other users to see Free/Busy information in the calendar.
Using Get-EXOMailboxFolderPermission in Exchange Online
If you are managing Exchange Online, you can also use the REST-based Get-EXOMailboxFolderPermission cmdlet:
This cmdlet can be useful when you are troubleshooting calendar config issues or reviewing calendar folder settings.
Note. The name of the folder in which the calendar is stored may differ depending on the mailbox language settings. If this command returns that โusername:\calendarโ cannot be found, it is most likely that the user has Outlook language settings other than English. Appropriately, the Calendar folder name can be different (calendar\kalender\calendario\calendrier\ะบะฐะปะตะฝะดะฐัั). For example, to view calendar permissions for the Dutch Language (nl-NL) use the command:
Get-MailboxFolderPermission username:\Agenda
Check the name of the calendar folder with the command:
How can I find calendars a specific user has access to?
You can find all the calendars in your organization that a particular user has been granted access to. In this example, we want to display a list of user mailboxes whose calendars are allowed to be accessed by a user named Muller:
Note that depending on environment, the User field may contain UPN, alias, or domain\user format.
PageSize 500 is a balanced value that will help to reduce round-trips while avoiding excessive memory consumption in large tenants.
The list of users whose calendars the user can access is listed in the Identity column. The AccessRights field displays the user’s calendar permissions.
Understanding Outlook Calendar Permissions
When managing calendar and Outlook folder permissions, you can use the following predefined permissions levels:
Owner โ gives full control of the mailbox folder: read, create, modify, delete items/folders, and manage permissions;
PublishingEditor โ read, create, modify, and delete items/subfolders (all permissions, except the right to change permissions);
PublishingAuthor โ create, and read all items/subfolders. You can modify and delete only items that you have created;
Author โ create and read items. Edit and delete own items;
NonEditingAuthor โ full read access, and create items. You can delete only your own items;
Reviewer โ read folder items only;
Contributor โ create items and folders (canโt read items);
AvailabilityOnly โ read Free/Busy time from the calendar;
LimitedDetails โ view the availability, subject and location of appointments in the calendar;
None โ no permissions to access folders and files.
You can also use granular permissions to fine-tune the access rights to the mailbox calendar:
CreateItems;
CreateSubfolders;
DeleteAllItems;
DeleteOwnedItems;
EditAllItems;
EditOwnedItems;
FolderContact;
FolderOwner;
FolderVisible;
ReadItems.
The Permission Level roles described above are just a set of granular permissions. For example, the Editor role is a set of the following individual permissions:
CreateItems
DeleteAllItems
DeleteOwnedItems
EditAllItems
EditOwnedItems
FolderVisible
ReadItems
Adding Calendar Permissions in Exchange with PowerShell
In order to grant user2 the permission to view and edit user1 calendar items, use the following command:
The same mailbox folder permission cmdlets can be used with shared mailboxes. You need to simply specify the shared mailbox address in the Identity parameter when granting, modifying, viewing, or removing calendar permissions:
You can assign calendar permissions to a specific userโs calendar in bulk. Create a CSV text file containing a list of users you want to grant permission to, and run the command:
You can use the SendNotificationToUser parameter with Add-MailboxFolderPermission and Set-MailboxFolderPermission to generate a sharing invitation email. The option -SendNotificationToUser $true can be used only when you set one of the following permissions via the AccessRights parameter: AvailabilityOnly, LimitedDetails, Reviewer, or Editor. The following command will send a sharing invitation to the user2:
This is what the sharing invitation will look like in Outlook:
Youโre invited to share this calendar. UserName has invited you to view his or her Calendar. Click the Open button above.
Note. You can grant access to the mailbox calendar not only for an individual user, but also for a Microsoft 365 group or a mail-enabled AD security group.
How to change or remove calendar permissions with PowerShell
You can change the Default permissions for the shared mailbox calendar folder and allow all organization users to view calendar items:
You can make this bulk calendar permissions change using a simple PowerShell script. To change the Default calendar permission for all mailboxes to Reviewer:
This will allow all your users to view all the calendars in the organization. Note that granting Reviewer permissions to the Default principal allows all authenticated users in the organization to view calendar items. You should test this config carefully before applying it organization-wide.
To revoke the calendar permissions, use the Remove-MailboxFolderPermission cmdlet.
Note. Since Exchange Online V3 you got modern REST-based cmdlets such as Get-EXOMailbox and Get-EXORecipient. However, while Exchange Online provides the REST-based Get-EXOMailboxFolderPermission cmdlet for reading mailbox folder permissions, permission changes still require the traditional Add-MailboxFolderPermission, Set-MailboxFolderPermission, and Remove-MailboxFolderPermission cmdlets.
The previous example removes all custom permissions except Default and Anonymous. If you want to preserve specific delegated accounts (such as a secretary mailbox), exclude them from the removal filter as shown below:
Now you can disconnect your PowerShell session from Microsoft 365/Exchange Server. To do this, use the following commands:
For Exchange Online:
Disconnect-ExchangeOnline -Confirm:$false
For on-prem Exchange (in case you are using remote PowerShell):
Remove-PSSession $Session
How to add a shared calendar in Outlook
In order to view other user calendars in Outlook 365/2021/2019/2016 (including room resources and shared mailbox calendars), you should switch to the calendar view and select the calendar type you want to add.
You can select a user from Address Book (Global Address List โ GAL), Open Shared Calendar (you should specify user name), Room List,and Internet (web-calendar).
For example, you want to add a calendar from the Global Address List. Find the calendar name you want to add to Outlook and click OK. The shared calendar should appear under the My Calendars in Shared Calendars section.
PowerShell makes it easy to manage folder-level permissions on users’ calendars in Microsoft 365 and on-premises Exchange Server environments.
Brian Jackson started this blog in 2011. Brian has a huge passion for WordPress and technology for over a decade. Brian enjoys blogging, movies, and hiking.
