How to extract List of all Users Who Have Full Access, Send As and Send on Behalf to Other Exchange Mailboxes.

Question

Hi Experts,

I need the script :

How to extract List of all Users Who Have Full Access, Send As and Send on Behalf to Other Exchange Mailboxes.

It is Okay, if there is separate command for these access.

Thank you.

Answer 1

Hi @Mohammad Ashraful Haque ,
According to my research, we cannot directly obtain the permissions of the user's mailbox to other mailboxes.We can know whether each user mailbox contains the "Full Access", "Send As" and "Send on Behalf" permissions of other mailboxes through the permissions assigned to other users on each user's mailbox.

We could run the following script to get the permission between user mailbox:

Full Access:

$mailboxes = Get-Mailbox -ResultSize Unlimited -Filter ('RecipientTypeDetails -eq "UserMailbox"')  
  
foreach ($mailbox in $mailboxes)   
{ Get-MailboxPermission -Identity $mailbox.alias -ResultSize Unlimited | ?{($_.IsInherited -eq $false) -and ($_.User -ne "NT AUTHORITY\SELF") -and ($_.AccessRights -like "FullAccess")} | select Identity, User, AccessRights }  

Send As:

$mailboxes = Get-Mailbox -ResultSize Unlimited -Filter ('RecipientTypeDetails -eq "UserMailbox"')  
  
foreach ($mailbox in $mailboxes)   
{ Get-ADPermission -Identity $mailbox.alias | ? { $_.ExtendedRights -like "*send*" -and -not ($_.User -match "NT AUTHORITY") -and ($_.IsInherited -eq $false)} | select Identity,User,ExtendedRights }  

Send On Behalf:

Get-Mailbox -ResultSize Unlimited -Filter ('RecipientTypeDetails -eq "UserMailbox"') | select Alias, GrantSendOnBehalfTo  

The following screenshots in the test in lab environment:
Full Access:

Send As:

Send On Behalf:

----------

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The one for SendAs in Exchange online is the following. Code below for shared mailboxes

$mailboxes = Get-Mailbox -ResultSize Unlimited -Filter ('RecipientTypeDetails -eq "SharedMailbox"')  
foreach ($mailbox in $mailboxes)   
{ Get-RecipientPermission -Identity $mailbox.alias | Where-Object { $_.AccessRights -like "*send*" -and -not ($_.Trustee -match "NT AUTHORITY") -and ($_.IsInherited -eq $false)} | select Identity,Trustee,AccessRights }