Who can use your shared mailbox?

Start with the three permission types

A mailbox such as accounts@example.com may have different people reading messages and sending replies. Review the permissions individually with the person responsible for that mailbox.

Full Access

Allows a delegate to open and manage the mailbox. It does not, on its own, allow them to send from its address.

Send As

Allows messages to appear to come from the mailbox itself.

Send on Behalf

Allows a delegate to send with their identity shown on behalf of the mailbox.

These distinctions follow Microsoft’s Exchange Online mailbox-permission guidance. When someone reports “I can open it but cannot send”, check the sending permission separately.

Create a read-only report

Our Get-SharedMailboxPermissions.ps1 script reports assignments for one shared mailbox. It does not add, remove or copy permissions.

1. Download and extract the ZIP from the resource library. Read its guide and test the beta script before using it in your environment.
2. Keep the script and M365.Common.psm1 together. Use the Exchange Online module and an authorised account with the mailbox, recipient and permission read access listed in the guide.
3. Open the extracted folder in a fresh PowerShell window and run the command below.
4. Enter the shared mailbox’s email address, review the scope, sign in through Microsoft and confirm the report.

.\Get-SharedMailboxPermissions.ps1

The new Outcomes folder contains mailbox-permissions.csv and audit.json. Save both in an approved location because they identify accounts and access assignments.

Read the report before drawing conclusions

Look at the mailbox, trustee and permission together. A trustee is the user, group or other identity named in an assignment; its presence in a row does not always mean a person can use that access.

Group assignments

The report identifies groups where it can, but does not expand their members. Check the relevant membership separately before deciding who has access.

Deny and inherited entries

These are retained and labelled. Do not count every row as an ordinary direct permission grant.

Unresolved identities

An entry the script cannot resolve may be a system identity or need further investigation. It is not automatically a former employee.

No assignments or a failed read

NoAssignments means that permission check completed with no entries. ReadFailed means the check was incomplete; inspect the error and audit before relying on it.

This is an assignment report, not an effective-access calculation. It does not expand groups or demonstrate that every listed account can successfully open or send from the mailbox.

Turn the findings into an access review

Ask the mailbox owner to confirm which people need to read, manage and send messages. Record a reason for each proposed change and identify any group membership that needs a separate check.

For example, a colleague covering holidays may need temporary access while a team group provides ongoing access. Removing one direct assignment would not necessarily remove access through that group.

Make approved changes through your normal administration process, verify the intended result and run a fresh report to retain a record. The reporting script itself makes no changes.

If this review follows an employee’s departure, use the Microsoft 365 offboarding guide to keep the account, mailbox and wider handover decisions together.