Exchange Shell Permissions: Granting Access to All Mailboxes

During a project migrating around 150 mailboxes to Exchange Online, part of the scope was giving team leaders a full list of every mailbox and exactly what permissions existed on it — mostly a housekeeping exercise, since some permissions had been sitting unused for years (one mailbox still had a colleague’s access granted for a two-and-a-half-year-old period of annual leave).

The command

Exchange Management Shell / PowerShell makes this a one-liner. This pulls every mailbox’s permission set and exports it straight to CSV:

Get-Mailbox | Get-MailboxPermission | Select {$_.AccessRights}, Deny, InheritanceType, User, Identity, IsInherited, IsValid | Export-Csv c:\TGH\mbx_permissions.csv

Adjusting the output

Add or remove properties from the Select list to change which columns end up in the CSV — for example, drop InheritanceType and IsInherited if you only care about direct grants, or add RunspaceId if you’re running this across multiple sessions and need to track source.

What to do with it

A plain CSV is usually enough — open it in Excel, tidy it up, and send it to whoever requested the audit. If you want something more polished or repeatable, the same export slots neatly into a Power BI report for a visual breakdown of who has access to what across the organisation. Either way, running this against your full mailbox list takes a few minutes and gives a complete, auditable picture that would otherwise take hours to compile by hand.

The Exchange Online Equivalent (2026)

The command above is written for on-premises Exchange Management Shell. If you’re running this against Exchange Online specifically (as the migration-project context in this post suggests), Microsoft’s current recommended cmdlet is Get-EXOMailboxPermission, part of the modern Exchange Online PowerShell V3 module (ExchangeOnlineManagement), rather than the classic Get-Mailbox | Get-MailboxPermission pattern. It’s built for REST-based batch retrieval instead of legacy remote PowerShell, making it materially faster and far less prone to the WinRM timeouts and throttling that the classic approach commonly hits when run against a large mailbox list in the cloud.

Resources

• Exchange Online