Monitor Mailbox Folder Permission Changes in Exchange Online (2024)

In Exchange Online, mailbox permissions and folder permissions determine how users can access and use mailbox contents. Here's a breakdown of the differences between mailbox permissions and mailbox folder permissions.

Mailbox Folder Permissions in Exchange Online

Scope of access: With mailbox folder permissions, users can access and manage mail content within specific folders or subfolders.

Who can manage folder permissions: Users can configure mailbox folder permissions via the Outlook client applications, and admins can do it using PowerShell.

For example, when an employee leaves the organization, share the Inbox and Sent Items folders with another user and grant the Owner permission. This allows the user to access only the emails sent or received by the employee.

Mailbox Permissions in Exchange Online

Scope of access: Mailbox permissions allow delegated users to send emails or access the entire mailbox, including all folders and mailbox items.

Who can manage mailbox permissions: Exchange Online mailbox permissions can be configured and managed by admins using the Exchange admin center or PowerShell.

For example, when an employee is on long-term leave, give mailbox permissions to another user in Office 365 with Full Access and Send As permission. This allows the user to access the employee's entire mailbox contents and send emails from their mailbox.

While users with full access permission can change any mailbox folder permissions, it is important to frequently check the mailbox permissions assigned to a user.

In order to find all the users who have access to a mailbox, we’ve compiled a complete guide on how to export mailbox permission reports.

Here’s a quick snapshot of what the guide provides!

Below are the key methods outlined in the guide to help you retrieve mailbox permissions for all users.

In addition to these, users can also set and use custom permission levels that allows them to combine read, delete, and edit access according to their specific requirements.

Monitoring these permissions is crucial for maintaining data security and compliance. However, relying on native reporting methods doesn’t provide a straightforward approach or a detailed overview of all mailbox folder permission changes. To overcome these limitations, AdminDroid simplifies tracking folder activities with a clear view of all changes and who made them.

The Mailbox Folder Changes report from AdminDroid helps Microsoft 365 admins to identify all the mailbox folder activities including the permission changes.

Handy Tip: You can use the Export option to download the filtered report in your desired format (CSV, XLS, PDF, etc.) for offline access.

Microsoft 365 users can view their mailbox folder permission levels through the Outlook client. Additionally, Exchange Online provides admins with the authority to get users' mailbox folder permissions using PowerShell for enhanced governance. Follow the steps outlined below to get mailbox folder permission in Exchange Online using PowerShell and Outlook.

Get mailbox folder permission using Outlook

Refer to the steps below to find mailbox folder permissions in your mailbox or in a mailbox where you’ve been granted delegated access.

Get mailbox folder permissions using PowerShell

As an admin, you must use Exchange Online PowerShell to get the mailbox folder permissions since this cannot be viewed using the admin centers.

Note: Replace &ltMailbox UPN&gt with the mailbox owner's email address, &ltFolder Path&gt with the folder's path, and &ltDelegated User’s UPN&gt with the email address of the delegated user.

In Outlook, you can set mailbox folder permissions to grant access to other users. Here's how to share a mailbox folder with another user.

Grant mailbox folder permissions using PowerShell

If you’re an admin you can share user's mailbox folders using PowerShell cmdlets such as Add-MailboxFolderPermission or Set-MailboxFolderPermission.

You might wonder about ‘what is the difference between Add and Set cmdlet?’ If so, the distinction is that Set-MailboxFolderPermission modifies existing mailbox folder permissions, while the Add-MailboxFolderPermission assigns new permissions.

Users with folder permissions in Microsoft 365 can access another user's mailbox folders using Outlook clients. For accessing another person's folder(s) using Outlook on the web, follow these straightforward steps.

While users with mailbox folder permissions can access other users’ folders, remember that those with broader mailbox access can view and use entire mailboxes.

In such scenarios, AdminDroid’s Mailbox Non-owner Access report helps to identify the user who accessed other users' mailboxes.

Handy Tip: Schedule this non-owner mailbox access report to receive timely email notifications about who accessed which mailboxes in Microsoft 365.

Calendars in Outlook are essential for scheduling and visualizing meetings or events. Similar to mailbox folders, calendar folders can also be shared with other users to coordinate schedules and prevent conflicts. To enable this, calendar permissions can be managed through the Outlook client or PowerShell, offering flexibility in controlling access. Here's how to manage calendar permissions in Exchange Online.

Share your calendar using Outlook on the web

Access other user's calendars via Outlook (web version)

Manage calendar permissions in Office 365 using PowerShell

While calendar permissions cannot be managed directly from any native admin centers, admins can utilize Exchange Online PowerShell to handle them. By default, any user can view other internal users’ calendars with the AvailabilityOnly scope, which shows whether the calendar owners are free/busy.