Managing Folder Permissions with PowerShell on Exchange

2.4K

In Exchange Server and Exchange Online (Microsoft 365), it is possible to grant access to another user’s mailbox at both the mailbox level and the individual folder level. The user or administrator can select the mailbox folders and access rights that should be available to other users.

Grant access to mailbox

Users can grant access to their mailbox from the Outlook on the Web (OWA) interface or from the Outlook desktop client.

1. Right-click on the target mailbox folder and select Permissions.
   

   

2. The list contains the current access permissions for this folder. In this example, no one has access except the owner.
3. Click + to grant access to another user.
4. Select the user and assign the access level.
5. Select one of the predefined roles or configure custom permissions.
   

   

6. Save the changes.

Keep in mind that Mailbox-level permissions (Full Access, Send As, Send on Behalf) are different from folder-level permissions. Folder permissions only apply to a specific mailbox folder (Inbox, Calendar, Contacts, etc.) and do not grant access to the entire mailbox.

Using PowerShell to manage folder permissions in user and shared mailboxes

Exchange administrators can use PowerShell to manage folder permissions in user and shared mailboxes.

Permissions. Users can manage folder permissions in their own mailboxes. To view or modify folder permissions in other users’ mailboxes, your account must be assigned the appropriate Exchange RBAC permissions. Keep in mind that in Exchange Online, admin roles (such as Recipient Management, Mail Recipients, Exchange Administrator, or custom role assignments) may be required depending on the operation being performed.

The following PowerShell cmdlets are available in EOL and in on-premises Exchange Server:

Get-MailboxFolderPermission

Add-MailboxFolderPermission

Set-MailboxFolderPermission

Remove-MailboxFolderPermission

Connect to your Exchange Online:

Install-Module ExchangeOnlineManagement

Connect-ExchangeOnline

For Exchange Server, you should connect using Exchange Management Shell/remote PowerShell session.

List the available folders in a user’s mailbox:

Get-MailboxFolderStatistics cyril@theitbros.com | Select FolderPath

Folder names may differ depending on mailbox language. You should always verify the actual folder path before assigning permissions (for example, the Calendar folder may appear as Calendar, Kalender, Calendrier, or Календарь depending on the mailbox locale):

Get-MailboxFolderStatistics cyril@theitbros.com |
Select Name,FolderPath

To display only user-created folders in the mailbox:

Get-MailboxFolderStatistics cyril@theitbros.com | ? {($_.FolderType -eq "User created" )}| Select FolderPath

List the current folder permissions:

Get-MailboxFolderPermission cyril@theitbros.com:\Inbox

Before using Add-MailboxFolderPermission, you can use Get-MailboxFolderPermission to check if a permission entry for the target user already exists.

Give another user access to a folder:

Add-MailboxFolderPermission -Identity cyril@theitbros.com:\Inbox -User b.busch@resource.local -AccessRights Reviewer

• -Identity — mailbox to grant privileges to
• -User — user we want to grant permission to access the mailbox
• -AccessRights — permission level

Built-in roles when assigning permissions

Select one of the built-in roles when assigning permissions:

1. Author
2. Contributor
3. Editor
4. NonEditingAuthor
5. Owner
6. PublishingAuthor
7. PublishingEditor
8. Reviewer

Or config custom permissions:

1. None
2. CreateItems
3. CreateSubfolders
4. DeleteAllItems
5. DeleteOwnedItems
6. EditAllItems
7. EditOwnedItems
8. FolderContact
9. FolderOwner
10. FolderVisible
11. ReadItems

There are two other types of permissions available for the Calendar folder:

1. AvailabilityOnly
2. LimitedDetails

Managing Default and Anonymous Permissions

To view the current permissions assigned to a calendar folder, run the command:

Get-MailboxFolderPermission cyril@theitbros.com:\Calendar

In order to allow all authenticated users in the organization to view calendar details, run the following command:

Set-MailboxFolderPermission `
-Identity cyril@theitbros.com:\Calendar `
-User Default `
-AccessRights Reviewer

Default — represents all authenticated users in the Exchange organization.
Anonymous — represents unauthenticated users (typically relevant for published calendars).

View a detailed information in the mailbox calendar

For example, to allow viewing of detailed info in the mailbox calendar (in addition to Free/Busy), use the command:

Add-MailboxFolderPermission -Identity cyril@theitbros.com:\Calendar -user b.busch@resource.local -AccessRights Editor -SendNotificationToUser $true

In addition, we used the SendNotificationToUser option, which sends an invitation email describing the assigned permissions (available in Exchange Online only).

Bulk grant read-only calendar access to multiple users

Because default folder names can be localized, the script resolves the Calendar folder path for each mailbox instead of assuming that the folder is always named Calendar.

Use the following script to bulk grant read-only calendar access to multiple users in the Exchange organization:

Get-EXOMailbox -ResultSize Unlimited | ForEach-Object {
    $mailbox = $_.PrimarySmtpAddress

    $calendar = Get-EXOMailboxFolderStatistics -Identity $mailbox -FolderScope Calendar |
    Where-Object { $_.FolderType -eq 'Calendar' } |
    Select-Object -First 1

    if ($calendar) {
    $folderPath = $calendar.FolderPath.Replace('/', '\')

    try {
        Set-MailboxFolderPermission `
            -Identity "${mailbox}:$folderPath" `
            -User Default `
            -AccessRights Reviewer `
            -ErrorAction Stop

        Write-Host "Updated: $mailbox"
    }
    catch {
        Write-Warning "Failed to update $mailbox : $($_.Exception.Message)"
    }
}
else {
        Write-Warning "Calendar folder not found for $mailbox"
    }
}

Warning. The command mentioned above modifies calendar permissions for every mailbox in the organization. You should test it on a limited set of mailboxes before applying organization-wide.

Privacy Warning. The example mentioned below changes the Default calendar permission to Reviewer for every mailbox in the organization. In many environments, the Default permission is configured as AvailabilityOnly (Free/Busy information only). When you are changing it to Reviewer, this allows all authenticated users in the Exchange organization to view calendar item details that are exposed by the Reviewer permission level. You should review your organization’s privacy and compliance requirements before applying this change.

Important. This example modifies the Default calendar permission on every mailbox returned by Get-EXOMailbox. In large environments, you should consider testing on a pilot group first, exporting existing permissions for backup purposes, and limiting the scope to specific mailbox sets instead of using all mailboxes in the organization.

Also, keep in mind that the Get-EXOMailboxFolderStatistics cmdlet requires the ExchangeOnlineManagement module (EXO V2/V3).

Note. When processing large numbers of mailboxes, Exchange Online may throttle bulk permission changes. For production deployments, you should consider processing mailboxes in batches and adding retry and error-handling logic for transient failures.

Connecting to the shared folder in Outlook

Now the user can connect to the shared folder in Outlook.

1. In OWA, right click on the Folders group in the left sidebar, and select Add shared folder.
   
2. Type the account name or email of the mailbox you want to access, and then click Add.
3. A connected mailbox will appear in the list of folders, where the user will be able to see the items that they have access to.
   

   

4. In Outlook for Desktop, to open a shared folder, go to File > Account Settings > Change > More Settings > Open these additional mailboxes > Add.
   

   

Change permissions assigned to mailbox folder

To change the permissions assigned to a mailbox folder, use the Set-MailboxFolderPermission cmdlet. In the following example, we will grant multiple granular permissions to a user. Separate the permissions with commas:

Set-MailboxFolderPermission -Identity cyril@theitbros.com:\Inbox -User b.busch@resource.local -AccessRights ReadItems,FolderVisible

In case the user already has an existing permission entry, you can use Set-MailboxFolderPermission instead of Add-MailboxFolderPermission.

Remove all folder permissions for a specific user

The following command removes the specified user’s permission entry from the mailbox folder:

Remove-MailboxFolderPermission `
-Identity cyril@theitbros.com:\Inbox `
-User b.busch@resource.local `
-Confirm:$false