How to Add or Set MailboxFolderPermission with PowerShell

In Exchange Online we can share whole mailboxes with other users. But what if you want to share only a folder? Or only the calendar in Outlook? We can set the permissions in Outlook, but as an admin, we can also use the Add and Set MailboxFolderPermission cmdlet in PowerShell.

Changing mailbox permission is a regular task for an Office 365 admin. Calendars need to be shared internally and folder permissions need to be given or changed to co-workers. For these tasks is PowerShell really the easiest way to go.

In this article, we are going to take a look at how to use the Add and Set MailboxFolderPermission cmdlet in PowerShell.

Mailbox Folder Permissions

Before we are going to add or set mailbox folder permissions, are we first going to take a look at the different permissions. The most common way to assign permissions is to use one of the roles. Roles are a collection of permissions that you can assign.

Another option is to assign the individual permissions:

For the calendars are also two unique roles available that are really interesting to use:

Add Mailbox Folder Permissions

Before we can add mailbox folder permissions we first need to connect to Exchange Online. Make sure that you have installed the Exchange Online module in PowerShell. You can read more about connecting to Exchange Online in this article.

# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

It’s always a good idea to first list the mailbox permission before you change the permission. I have also created a complete script that will list and export all mailbox permission for you.

Get-MailboxFolderPermission -Identity alexw@lazydev.onmicrosoft.com

# Result:
FolderName           User                 AccessRights                      SharingPermissionFlags
----------           ----                 ------------                      ----------------------
Top of Informatio... Default              {None}
Top of Informatio... Anonymous            {None}

The example above didn’t return any folder permissions. But what we just have done is only show the permissions of the top (root) folder of the mailbox. This won’t show the permissions om for example the calendar of the user.

Get-MailboxFolderPermission -Identity alexw@lazydev.onmicrosoft.com:\calendar

# Result
FolderName           User                 AccessRights                      SharingPermissionFlags
----------           ----                 ------------                      ----------------------
Calendar             Default              {AvailabilityOnly}
Calendar             Anonymous            {None}
Calendar             Megan Bowen          {Editor}

 Get-EXOMailboxFolderStatistics -Identity alexw@lazydev.onmicrosoft.com | select-object Identity

Add MailboxFolderPermission

When adding permissions to a mailbox folder we can specify the following parameters:

• Identity – Mailbox we want to give permissions to
• User – The user that we want to give permission
• AccessRights – The permission level
• SharingPermissionFlags – (Calendar only) Make a user delegate and/or show private calendar items
• SendNotificationToUser – (Calendar only) Send sharing inventation to user

Add-MailboxFolderPermission -Identity alexw@lazydev.onmicrosoft.com:\calendar -User meganb -AccessRights Editor

Add-MailboxFolderPermission -Identity alexw@lazydev.onmicrosoft.com:\calendar -User meganb -AccessRights Editor -SharingPermissionFlags Delegate,CanViewPrivateItems

Add-MailboxFolderPermission -Identity alexw@lazydev.onmicrosoft.com:\marketing -User meganb -AccessRights Editor

When you give calendar permission you can also specify that you want to notify the user. To do this you will need to set the parameter SendNotificationToUser to $true

Give permission to Groups

Until now we have granted permission to a specific user. In most cases, this is more than enough, but it’s also possible to give folder permission to a mail-enabled security group.

Add-MailboxFolderPermission -Identity alexw@lazydev.onmicrosoft.com:\calendar -AccessRights Reviewer -user backoffice@lazydev.onmicrosoft.com

Change Permissions with Set MailboxFolderPermission

Changing folder permissions is done with the set-mailboxfolderpermission cmdlet. It’s sometimes a bit confusing, you might want to add additional permission for a user. But to do that, we actually have to set the permission.

The set mailboxfolderpermission cmdlet overwrites existing permissions. So we don’t have to remove the old permission first. We can use the same parameters and permissions as with the add-mailboxfolderpermission cmdlet.

For example, to change calendar permission for Megan from Editor to Reviewer we can simply do:

Set-MailboxFolderPermission -Identity alexw@lazydev.onmicrosoft.com:\calendar -User meganb -AccessRights Reviewer

Delegate permission can be added or removed by specifying the existing permission role and setting the SharingPermissionFlags parameter:

# Add Delegate permission
Set-MailboxFolderPermission -Identity alexw@lazydev.onmicrosoft.com:\calendar -User adelev -AccessRights Editor -SharingPermissionFlags delegate

# Remove Delegate permission with None
Set-MailboxFolderPermission -Identity alexw@lazydev.onmicrosoft.com:\calendar -User adelev -AccessRights Editor -SharingPermissionFlags none

Remove Mailbox Folder Permissions

We can also completely remove the permissions with PowerShell. For this we will need to specify the mailbox and user that we want to remove.

Remove-MailboxFolderPermission -Identity alexw@lazydev.onmicrosoft.com:\calendar -User meganb

By default, the cmdlet verifies if you want to remove the permissions. You can use the parameter -confirm:$false to simply remove the permissions without the need to confirm it.

Just like with adding permissions, we can also send a notification to the user when we remove the permissions:

Remove-MailboxFolderPermission -Identity alexw@lazydev.onmicrosoft.com:\calendar -User lazyadmin -Confirm:$false -SendNotificationToUser:$true

Wrapping Up

The add mailboxfolderpermission cmdlet is often used to set calendar permission. But we can also use it to set permissions on other folders in Outlook. If you want to know more about calendar permission, then make sure you read this article as well, where I explain more about room calendars.

I hope you found this article helpful, if you have any questions, just drop a comment below.