How to find mailboxes a user can access in Exchange Online

Before you start

Use an account in a role group that can read mailbox settings. Microsoft lists Organization Management and Recipient Management for mailbox settings and recipients in Exchange Online, and says members of View-Only Management can view the configuration of those features.

Know what the script covers. It reads direct, allowed entries on mailboxes as they are when it runs: Full Access, Send As and Send on behalf. Calendar and folder permissions are not read. The examples read and export; they add or remove no permission and change nothing.

Option 1

Find mailboxes a user can access with PowerShell

Install the module once, then set the person's user principal name, connect and export the mailboxes they hold a permission on.

# Install once, if the module is not already installed.
Install-Module ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$person = 'person@example.com'
Connect-ExchangeOnline -ShowBanner:$false
try {
    $self = Get-EXOMailbox -Identity $person
    $report = [System.Collections.Generic.List[object]]::new()
    foreach ($mailbox in Get-EXOMailbox -ResultSize Unlimited) {
        $identity = $mailbox.UserPrincipalName
        if (-not $identity) { throw "No user principal name for $($mailbox.DisplayName)." }
        if ($identity -eq $self.UserPrincipalName) { continue }
        $address = $mailbox.PrimarySmtpAddress.ToString()
        foreach ($entry in Get-EXOMailboxPermission -Identity $identity) {
            $direct = -not $entry.IsInherited -and -not $entry.Deny
            $full = "$($entry.AccessRights)" -match 'FullAccess'
            if ($direct -and $full -and "$($entry.User)" -eq $person) {
                $report.Add([pscustomobject]@{ Mailbox = $address; Permission = 'Full Access' })
            }
        }
        foreach ($entry in Get-EXORecipientPermission -Identity $identity -AccessRights SendAs) {
            $direct = -not $entry.IsInherited -and $entry.AccessControlType -ne 'Deny'
            if ($direct -and "$($entry.Trustee)" -eq $person) {
                $report.Add([pscustomobject]@{ Mailbox = $address; Permission = 'Send As' })
            }
        }
    }
    $dn = $self.DistinguishedName -replace "'", "''"
    $filter = "GrantSendOnBehalfTo -eq '$dn'"
    foreach ($mailbox in Get-EXOMailbox -Filter $filter -ResultSize Unlimited) {
        $address = $mailbox.PrimarySmtpAddress.ToString()
        $report.Add([pscustomobject]@{ Mailbox = $address; Permission = 'Send on behalf' })
    }
    if ($report.Count -eq 0) {
        Write-Output "$person holds no Full Access, Send As or Send on behalf permission."
    } else {
        $report | Sort-Object Mailbox, Permission |
            Export-Csv -Path './mailboxes-user-can-access.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) permissions held by $person exported."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

The CSV has 1 row for each mailbox and permission, each mailbox by its primary SMTP address. The script compares each entry with the address you set, so set it to the person's user principal name. The Send on behalf filter runs in Exchange and needs the person's distinguished name, which the script reads from their mailbox. It stops on a blank user principal name, because a blank -Identity returns every mailbox's permissions.

Check access through a group

Reconnect with Connect-ExchangeOnline, then read 1 shared mailbox's Full Access entries. A group in the User column gives every member access.

# Run while connected to Exchange Online. Replace the example mailbox.
Get-EXOMailboxPermission -Identity 'shared@example.com' |
    Where-Object { -not $_.IsInherited } |
    Select-Object Identity, User, AccessRights, Deny

Option 2

Check mailbox delegation in the admin centre

1. Sign in to the Exchange admin centre for the correct tenant.
2. Go to Recipients > Mailboxes and select a mailbox the person may use, such as a shared mailbox.
3. Open the Delegation tab and look for the person under Send as, Send on behalf and Read and manage (Full Access).
4. Repeat for each mailbox, and close the pane without choosing Edit, so nothing changes.

This suits checking a few mailboxes. It can't show everything 1 person can open, since the admin centre lists the delegates of 1 mailbox at a time.

Common questions

Why is a mailbox the person opens every day missing?

The person probably reaches it through a group. A permission given to a mail-enabled security group names the group rather than its members, so read the mailbox's entries with the group check above and look for a group in the User column.

Does Full Access let the person send from the mailbox?

No. Microsoft says Full Access lets a delegate open the mailbox and view its contents, but not send from it. Sending needs Send As, where the message appears to come from the mailbox, or Send on behalf, where it shows the delegate sent it on the owner's behalf.

Where are calendar permissions and entries left by deleted accounts?

Neither is in this export. For calendars, see how to export calendar permissions in Exchange Online, and for permissions still held by deleted accounts, how to find orphaned mailbox permissions.