Add/Remove Calendar Permissions in Office 365/Exchange via PowerShell

This is a tutorial on how to view, add and remove mailbox calendar permissions on Office 365 (and on-premises Exchange) for your users via PowerShell. For example, you need to grant read permissions to room mailbox calendar for a few users. You can grant room mailboxes calendar permissions for specific users or for an AD security group. In most cases, you should to assign calendar permissions to a security group. In this case in order to grant access to the specific mailbox calendar, all you have to do is add the user to the Active Directory group (without changing mailbox calendar permissions via PowerShell).

By default, in Exchange and Office 365 organization users can’t view Outlook e-mails or calendar items of other users. The only permission that is provided to all users by default is the ability to view the Free/Busy data in other user calendars (this is AvailabilityOnly role).

Users can independently grant the necessary permissions to Outlook mailbox folders and items to other users from the Outlook/OWA interface. Unfortunately, in Exchange 2016/2013 and Exchange Online (Office 365), the administrator cannot centrally manage calendar permissions from the GUI (Exchange MMC, EAC—Exchange Administration Center or Office 365 admin portal). But you can use a built-in Add-MailboxFolderPermission cmdlet, which allows you to manage user permissions on any users’ mailbox folder from PowerShell (this cmdlet first appeared in Exchange Server 2010). This cmdlet is also supported in Office 365.

Connecting Office 365/Exchange from PowerShell

First of all, you need to connect to your Office 365 or on-premises Exchange tenant.

1. Run the Windows PowerShell CLI as an Administrator;
   
2. Run the following command to save your administrator’s credentials into the PowerShell variable:

   $LiveCred = Get-Credential

3. If you are trying to connect to Office 365, specify your Office 365 tenant admin credentials;
   Note. How to connect and manage Office 365 using PowerShell.
4. Now you need to create a new session:
   For Office 365:

   $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $LiveCred -Authentication Basic –AllowRedirection

   For Exchange Server 2010, 2013, 2016 and 2019:

   $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://<your-target-exchange-server-address>/powershell/ -Credential $LiveCred

   Note. In our case when we try to run previous command to connect Exchange 2010 we’ve received an error:
   [ny-msg-02] Connecting to remote server failed with the following error message : The WinRM client cannot process the request. The WinRM client tried to use Negotiate authentication mechanism, but the destination computer (ny-msg-02:443) returned an ‘access denied’ error. Change the configuration to allow Negotiate authentication mechanism to be used or specify one of the authentication mechanisms supported by the server. To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain. To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password. Possible authentication mechanisms reported by server.

5. In our environment in order to connect to the target Exchange CAS server we should use the http connection (instead of https) and Kerberos authentication. The connection command should look like this:

   $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://ny-msg-02/powershell/ -Credential $LiveCred -Authentication Kerberos

6. Next step is to import Office 365/Exchange management commands from another session to your PowerShell console:

   Import-PSSession $Session

   Tip. It happens that when you run the Import-PSSession command, you get an error:
   Import-PSSession: Files cannot be loaded since running scripts has been disabled on this system. Provide a valid certificate with which to sign the files.
   In this case, you need to allow script executing, by setting the execution policy to RemoteSigned:

   Set-ExecutionPolicy RemoteSigned

   

Hint. If you logged in directly to the on-premises Exchange server, you can either start the Exchange Management Shell right away, or start a regular Exchange Management Shell session and load Exchange cmdlets with the command:

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn

How to Get Calendar Permissions Using PowerShell?

• You can view current calendar (folder-level) permissions of the specified mailbox by using the Get-MailboxFolderPermission cmdlet (this cmdlet is available in the cloud-based service and in on-premises Exchange):

  Get-MailboxFolderPermission username:\calendar

• Change the username to the user account you want to check calendar permissions for;
  Hint. If, when executing the following commands, you get an error:
  Get-MailboxFolderPermission : The term ‘Get-MailboxFolderPermission’ is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again
  this means that you did not complete the steps to connect to your Exchange/Office 365 tenant and did not import PowerShell Exchange cmdlets into your session. Carefully read and follow the steps from the previous paragraph.
  Note. If this command returns that ‘username:\calendar’ cannot be found, it most likely means that the user has Outlook language settings other than English. Appropriately, the Calendar folder can be called differently (calendar\kalender\calendario\calendrier\календарь). For example, for the Dutch Language (nl-NL), to view calendar permissions, use the command:

  Get-MailboxFolderPermission username:Agenda

• You can get the name of the calendar in the current user’s language configuration with the command:

  (Get-MailboxFolderStatistics username -FolderScope Calendar).Identity

  

• Check the current calendar permissions with the command:

  Get-MailboxFolderPermission brett.jackson:\calendar

• As you can see, the default AvailabilityOnly role is assigned on a calendar folder only.
  
• You can get the list of all mailbox calendars permissions in your organization using the following command:

  Get-Mailbox | ForEach-Object {Get-MailboxFolderPermission $_”:\calendar”} | Where {$_.User -like “Default”} | Select Identity, User, AccessRights

  Tip. In on premise Exchange, you can view user calendar settings in a specific mailbox database with the command:

  Get-Mailbox –database mbxdbname | ForEach-Object {get-MailboxFolderPermission $_”:\calendar”}

• Change mbxdbname to the name of your Exchange mailbox database.

Built-in Calendar and Mail Folder Access Roles

When managing calendar and mail folder permissions, you can use the following built-in Exchange roles:

• Owner — gives full control of the mailbox folder: read, create, modify and delete all items and folders. Also this role allows to manage items permissions;
• PublishingEditor — read, create, modify and delete items/subfolders (all permissions except the right to change permissions);
• Editor — read, create, modify and delete items (can’t create subfolders);
• PublishingAuthor — create, read all items/subfolders. You can modify and delete only items you create;
• Author — create and read items; edit and delete own items;
• NonEditingAuthor – full read access and create items. You can delete only your own items;
• Reviewer — read folder items only;
• Contributor — create items and folders (can’t read items);
• AvailabilityOnly — read Free/Busy info from the calendar;
• LimitedDetails;
• None — no permissions to access folder and files.

How to Set Office 365/Exchange Calendar Permissions Using PowerShell?

1. In order to grant user2 the permissions to view and edit user1 calendar items, run the following command:

   Add-MailboxFolderPermission -Identity user1@domain.com:\calendar -user user2@domain.com -AccessRights Editor

2. If you need to change the Default permissions for the calendar folder (to allow all organization users view a calendar of the specified user), run the command:

   Set-MailboxFolderPermission -Identity user1@domain.com:\calendar -User Default -AccessRights Reviewer

3. Check the current calendar permissions again using the Get-MailboxFolderPermissions cmdlet, they should change:

   Get-MailboxFolderPermission -Identity user1@domain.com:\calendar

   FolderName User AccessRights
   ———- —- ————
   Calendar Default {Reviewer}
   Calendar Anonymous {None}
   Calendar user2 {Editor}

4. You can also grant permissions to the mailbox not to an individual user, but the Exchange distribution group:

   New-DistributionGroup -Type Security -Name “Resource Calendar Owners” -Alias “grResourceCalendarAccess”
   
   add-MailboxFolderPermission -Identity user1@domain.com:\calendar -User grResourceCalendarAccess -AccessRights Owner

5. In some cases, you need to grant Reviewer permissions on a calendar folder in all user mailboxes in your Exchange organization. You can make this bulk calendar permissions change using a simple PowerShell script. To change Default calendar permission for all mailboxes to Reviewer:

   Get-Mailbox | ForEach-Object {Set-MailboxFolderPermission $_”:\calendar” -User Default -AccessRights Reviewer}

6. Also, you can prepare a CSV file with a list of users and assign them permissions to access a specific user’s calendar:

   Import-Csv users.csv | foreach { add-MailboxFolderPermission -Identity "user1@domain.com:\calendar" -User $_.alias -AccessRights Owner }

How to Add Shared Calendar in Outlook 2016?

In order to view other calendars in Outlook 2016 (including room resources, Shared calendars) switch to the calendar view and select the calendar type that you want to add to. You can select user from Address Book (Global Address List – GAL), Open Shared Calendar (you should specify user name), Room List, Internet (web-calendar).

For example, you want to add calendar from the Global Address List. Find the calendar name you want to add to Outlook and click OK, The shared calendar should appear under My Calendars in Shared Calendars section.

How to Remove and Reset Calendar Permissions via PowerShell?

1. To remove permission use Remove-MailboxFolderPermission cmdlet:

   Remove-MailboxFolderPermission -Identity user1@domain.com:\calendar –user user2@domain.com

2. If you want to reset the user’s calendar permissions to default ones, run:

   Get-MailboxFolderPermission brett.jackson:\Calendar | % { Remove-MailboxFolderPermission -Identity $_.Identity -User $_.User }

3. To exclude some “default” permissions entries from the removing script, use the following PowerShell one-liner:

   Get-MailboxFolderPermission brett.jackson:\Calendar | ? {$_.User -notmatch "^(Default|Secretary|Anonymous)$"} | % { Remove-MailboxFolderPermission -Identity $_.Identity -User $_.User.ADRecipient.ExchangeObjectId.Guid -Confirm:$false }

4. Now you can disconnect your PowerShell session from Office 365/Exchange:

   Remove-PSSession $Session

Alternative Script

Also see this PowerShell script on TechNet Gallery for setting calendar permissions in Office 365: Set Calendar Permission in Office 365 Exchange Online.