Easy-to-Use Exchange Online Mailbox Permissions Reporting

# Import Exchange Management Shell (if not already loaded)
Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn -ErrorAction SilentlyContinue

# Initialize results array
$results = @()

# Get all mailboxes
Write-Host "Retrieving all mailboxes..." -ForegroundColor Cyan
$mailboxes = Get-Mailbox -ResultSize Unlimited

# Counter for progress
$counter = 0
$totalMailboxes = $mailboxes.Count

foreach ($mailbox in $mailboxes) {
    $counter++
    Write-Progress -Activity "Processing Mailboxes" -Status "Processing $($mailbox.DisplayName)" -PercentComplete (($counter / $totalMailboxes) * 100)
    
    # Check if GrantSendOnBehalfTo has any values
    if ($mailbox.GrantSendOnBehalfTo -ne $null -and $mailbox.GrantSendOnBehalfTo.Count -gt 0) {
        
        foreach ($delegate in $mailbox.GrantSendOnBehalfTo) {
            # Get delegate details
            try {
                $delegateUser = Get-Mailbox $delegate -ErrorAction SilentlyContinue
                if ($delegateUser -eq $null) {
                    $delegateUser = Get-User $delegate -ErrorAction SilentlyContinue
                }
                
                $delegateName = if ($delegateUser) { $delegateUser.DisplayName } else { $delegate.ToString() }
                $delegateEmail = if ($delegateUser.PrimarySmtpAddress) { $delegateUser.PrimarySmtpAddress } else { "N/A" }
                
                $results += [PSCustomObject]@{
                    MailboxName = $mailbox.DisplayName
                    MailboxEmail = $mailbox.PrimarySmtpAddress
                    MailboxType = $mailbox.RecipientTypeDetails
                    DelegateName = $delegateName
                    DelegateEmail = $delegateEmail
                    PermissionType = "Send On Behalf"
                }
            }
            catch {
                Write-Warning "Error processing delegate $delegate for mailbox $($mailbox.DisplayName): $_"
            }
        }
    }
}

Write-Progress -Activity "Processing Mailboxes" -Completed

# Display results
Write-Host "`nTotal mailboxes with Send On Behalf permissions: $($results.Count)" -ForegroundColor Green

# Export to CSV
$exportPath = "C:\Temp\SendOnBehalf_Permissions_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$results | Export-Csv -Path $exportPath -NoTypeInformation -Encoding UTF8

Write-Host "Results exported to: $exportPath" -ForegroundColor Green

# Display summary
$results | Format-Table -AutoSize
    

# Check if connected to Exchange Online
try {
    Get-OrganizationConfig -ErrorAction Stop | Out-Null
    Write-Host "Connected to Exchange Online" -ForegroundColor Green
}
catch {
    Write-Host "Not connected to Exchange Online. Connecting..." -ForegroundColor Yellow
    Connect-ExchangeOnline
}

# Initialize results array
$allPermissions = @()

# Get all mailboxes
Write-Host "`nRetrieving all mailboxes..." -ForegroundColor Cyan
$mailboxes = Get-EXOMailbox -ResultSize Unlimited -Properties DisplayName, PrimarySmtpAddress, RecipientTypeDetails, GrantSendOnBehalfTo

Write-Host "Found $($mailboxes.Count) mailboxes" -ForegroundColor Green

# Counter for progress
$counter = 0
$totalMailboxes = $mailboxes.Count

foreach ($mailbox in $mailboxes) {
    $counter++
    Write-Progress -Activity "Processing Mailbox Permissions" -Status "Processing $($mailbox.DisplayName) ($counter of $totalMailboxes)" -PercentComplete (($counter / $totalMailboxes) * 100)
    
    # 1. Get Full Access Permissions
    Write-Verbose "Checking Full Access permissions for $($mailbox.DisplayName)"
    $fullAccessPerms = Get-EXOMailboxPermission -Identity $mailbox.PrimarySmtpAddress | 
        Where-Object { $_.User -notlike "NT AUTHORITY\SELF" -and $_.User -notlike "S-1-5-*" -and $_.IsInherited -eq $false -and $_.AccessRights -contains "FullAccess" }
    
    foreach ($perm in $fullAccessPerms) {
        $allPermissions += [PSCustomObject]@{
            MailboxName = $mailbox.DisplayName
            MailboxEmail = $mailbox.PrimarySmtpAddress
            MailboxType = $mailbox.RecipientTypeDetails
            DelegateName = $perm.User
            PermissionType = "Full Access"
            AccessRights = ($perm.AccessRights -join ", ")
            AutoMapping = $perm.AutoMapping
            IsInherited = $perm.IsInherited
        }
    }
    
    # 2. Get Send As Permissions
    Write-Verbose "Checking Send As permissions for $($mailbox.DisplayName)"
    $sendAsPerms = Get-EXORecipientPermission -Identity $mailbox.PrimarySmtpAddress | 
        Where-Object { $_.Trustee -notlike "NT AUTHORITY\SELF" -and $_.Trustee -notlike "S-1-5-*" -and $_.AccessRights -contains "SendAs" }
    
    foreach ($perm in $sendAsPerms) {
        $allPermissions += [PSCustomObject]@{
            MailboxName = $mailbox.DisplayName
            MailboxEmail = $mailbox.PrimarySmtpAddress
            MailboxType = $mailbox.RecipientTypeDetails
            DelegateName = $perm.Trustee
            PermissionType = "Send As"
            AccessRights = ($perm.AccessRights -join ", ")
            AutoMapping = "N/A"
            IsInherited = $perm.IsInherited
        }
    }
    
    # 3. Get Send On Behalf Permissions
    if ($mailbox.GrantSendOnBehalfTo -ne $null -and $mailbox.GrantSendOnBehalfTo.Count -gt 0) {
        Write-Verbose "Checking Send On Behalf permissions for $($mailbox.DisplayName)"
        
        foreach ($delegate in $mailbox.GrantSendOnBehalfTo) {
            $allPermissions += [PSCustomObject]@{
                MailboxName = $mailbox.DisplayName
                MailboxEmail = $mailbox.PrimarySmtpAddress
                MailboxType = $mailbox.RecipientTypeDetails
                DelegateName = $delegate
                PermissionType = "Send On Behalf"
                AccessRights = "SendOnBehalf"
                AutoMapping = "N/A"
                IsInherited = $false
            }
        }
    }
}

Write-Progress -Activity "Processing Mailbox Permissions" -Completed

# Display summary
Write-Host "`n========== SUMMARY ==========" -ForegroundColor Cyan
Write-Host "Total Mailboxes Processed: $totalMailboxes" -ForegroundColor Yellow
Write-Host "Total Permissions Found: $($allPermissions.Count)" -ForegroundColor Yellow
Write-Host "  - Full Access: $(($allPermissions | Where-Object {$_.PermissionType -eq 'Full Access'}).Count)" -ForegroundColor Green
Write-Host "  - Send As: $(($allPermissions | Where-Object {$_.PermissionType -eq 'Send As'}).Count)" -ForegroundColor Green
Write-Host "  - Send On Behalf: $(($allPermissions | Where-Object {$_.PermissionType -eq 'Send On Behalf'}).Count)" -ForegroundColor Green
Write-Host "============================`n" -ForegroundColor Cyan

# Export to CSV
$exportPath = "C:\Temp\O365_Mailbox_Permissions_Report_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"

# Create directory if it doesn't exist
$exportDir = Split-Path $exportPath -Parent
if (!(Test-Path $exportDir)) {
    New-Item -ItemType Directory -Path $exportDir -Force | Out-Null
}

$allPermissions | Export-Csv -Path $exportPath -NoTypeInformation -Encoding UTF8

Write-Host "Full report exported to: $exportPath" -ForegroundColor Green

# Display first 20 results
Write-Host "`nPreview of results (first 20):" -ForegroundColor Cyan
$allPermissions | Select-Object -First 20 | Format-Table -AutoSize