How to export Send As permissions in Exchange Online

Before you start

Use an account that can read recipients. Microsoft lists the Organization Management and View-Only Organization Management role groups, and the Exchange Administrator, Exchange Recipient Administrator and Global Reader roles in Microsoft Entra ID.

Each CSV is a snapshot of the permissions when the script runs. The Send As script keeps direct, allowed entries and leaves out inherited entries, denials and built-in trustees such as NT AUTHORITY\SELF. The examples read and export and change nothing.

Option 1

Export Send As permissions with PowerShell

Install the module once, then connect, read the Send As entries for the whole organisation and export the direct ones. Any error stops the script before it writes a partial CSV.

# Install once, if the module is not already installed.
Install-Module ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline
try {
    $entries = Get-EXORecipientPermission -AccessRights SendAs -ResultSize Unlimited
    $report = @(foreach ($entry in $entries) {
        $direct = -not $entry.IsInherited -and $entry.AccessControlType -ne 'Deny'
        if ($direct -and $entry.Trustee -and $entry.Trustee -notlike 'NT AUTHORITY\*') {
            [pscustomobject]@{
                Recipient = $entry.Identity
                Trustee = $entry.Trustee
                AccessRights = ($entry.AccessRights -join ', ')
            }
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'No direct Send As permissions were found.'
    } else {
        $report | Sort-Object Recipient, Trustee |
            Export-Csv -Path './send-as-permissions.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) Send As permissions exported."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

The CSV has 1 row for each recipient and trustee. The cmdlet returns 1000 results unless told otherwise, so the script passes -ResultSize Unlimited. A trustee shown as a number beginning S-1-5 is a deleted account that still holds the permission.

Add Send on behalf

Exchange stores Send on behalf as the GrantSendOnBehalfTo list on each mailbox, so this script writes 1 row for each delegate.

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline
try {
    $mailboxes = Get-EXOMailbox -ResultSize Unlimited -Properties GrantSendOnBehalfTo
    $report = @(foreach ($mailbox in $mailboxes) {
        foreach ($delegate in $mailbox.GrantSendOnBehalfTo) {
            [pscustomobject]@{
                Mailbox = $mailbox.DisplayName
                MailboxAddress = $mailbox.PrimarySmtpAddress.ToString()
                MailboxType = $mailbox.RecipientTypeDetails
                Delegate = [string]$delegate
            }
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'No Send on behalf delegates were found on mailboxes.'
    } else {
        $report | Sort-Object Mailbox, Delegate |
            Export-Csv -Path './send-on-behalf.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) Send on behalf delegates exported."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

Groups keep the same list, read with Get-DistributionGroup, Get-DynamicDistributionGroup and Get-UnifiedGroup; Microsoft publishes a longer script that covers them. Add -RecipientTypeDetails SharedMailbox to limit this one to shared mailboxes.

Option 2

Check Send As in the admin centre

1. Open the Exchange admin centre for the correct tenant.
2. Go to Recipients > Mailboxes and select the mailbox. Room and equipment mailboxes are under Recipients > Resources.
3. Select Mailbox delegation and read the names under Send as and Send on behalf.
4. For a group, go to Recipients > Groups, select the group, choose Settings and open Edit manage delegates.
5. Close the pane without choosing Save or Delete, so nothing changes.

This suits 1 mailbox or group, such as before an offboarding. It does not suit an export, since the admin centre shows 1 recipient at a time.

Common questions

What if a person has both Send as and Send on behalf?

Microsoft says Send as is used. A Send as message shows no sign that the delegate sent it, while a Send on behalf message names the delegate. Review both lists together.

Why is a person who can send as a mailbox missing from the export?

The export shows the trustee as it was granted. When that is a mail-enabled security group, its members can send but do not appear. To read them, see how to export distribution group members in Exchange Online, which covers mail-enabled security groups too.

Why does a shared mailbox show no Send on behalf in the admin centre?

Microsoft lists shared mailboxes as taking Send on behalf in PowerShell only, so the admin centre does not offer it for them. Use the script above or Altivane's Send on Behalf report. For Full Access, see how to export mailbox permissions in Exchange Online.