Exchange Mailbox Permissions: Removing Deny Access with PowerShell

Part of our PowerShell guides: every related guide in one place.

If you have Full Access rights granted on a mailbox but still can’t open it, an explicit Deny entry on that mailbox will override any Allow permission: this happens more often than you’d expect, especially on mailboxes that have had permissions layered on by different admins over time.

Check Existing Permissions

Get-MailboxPermission -Identity [Mailbox-Alias]

Look through the output for any entry showing Deny : True against the user or group that’s having access problems.

Remove the Deny Entry

Remove-MailboxPermission -Identity [Mailbox-Alias] -User [User to remove] -AccessRights FullAccess -Deny

For example, to remove a Deny entry blocking the Domain Admins group from joe.bloggs’ mailbox:

Remove-MailboxPermission -Identity joe.bloggs -User "Domain Admins" -AccessRights FullAccess -Deny

Run both commands from the Exchange Management Shell (on-prem) or an Exchange Online PowerShell session (cloud). After removing the Deny entry, access should work immediately: no mailbox restart or replication delay is normally needed for permission changes to take effect.

Doing This in Exchange Online (Updated for 2026)

Unlike Get-Mailbox, which has a read-optimized Get-EXOMailbox counterpart in the current Exchange Online PowerShell V3 module, the permission cmdlets used here don’t have an EXO-prefixed removal equivalent: Get-MailboxPermission and Remove-MailboxPermission run exactly as shown above, unchanged, against Exchange Online. There is a Get-EXOMailboxPermission cmdlet for faster read-only bulk queries across large tenants, but it has no corresponding Remove-EXO... cmdlet: actually clearing the Deny entry always goes through the standard Remove-MailboxPermission shown above, whichever environment you’re in.

Don’t Forget the Other Permission Types

A Deny entry can be layered on more than just Full Access: the same override behaviour applies to Send As (Get-RecipientPermission / Remove-RecipientPermission -AccessRights SendAs -Deny) and Send on Behalf, so if removing a Full Access Deny doesn’t fully resolve the access complaint, check those separately rather than assuming the job’s done. On-premises, allow a few minutes for the change to replicate to the domain controller your Exchange server queries against if access still seems blocked immediately after the removal; Exchange Online applies permission changes without that replication delay.

Resources

• Exchange