How to Find Who Changed Mailbox Folder Permissions in Exchange Online

In Exchange Online, mailbox permissions and folder permissions determine how users can access and use mailbox contents. Here's a breakdown of the differences between mailbox permissions and mailbox folder permissions.

Scope of access: With mailbox folder permissions, users can access and manage mail content within specific folders or subfolders.

Who can manage folder permissions: Users can configure mailbox folder permissions via the Outlook client applications, and admins can do it using PowerShell.

For example, when an employee leaves the organization, share the Inbox and Sent Items folders with another user and grant the Owner permission. This allows the user to access only the emails sent or received by the employee.

Scope of access: Mailbox permissions allow delegated users to send emails or access the entire mailbox, including all folders and mailbox items.

Who can manage mailbox permissions: Exchange Online mailbox permissions can be configured and managed by admins using the Exchange admin center or PowerShell.

For example, when an employee is on long-term leave, give mailbox permissions to another user in Office 365 with Full Access and Send As permission. This allows the user to access the employee's entire mailbox contents and send emails from their mailbox.

In order to find all the users who have access to a mailbox, we’ve compiled a complete guide on how to export mailbox permission reports.

Below are the key methods outlined in the guide to help you retrieve mailbox permissions for all users.

Mailbox folder permissions in Exchange Online can be set to grant various access rights, defining exactly what actions users can perform within the folders. These mailbox folder access rights range from viewing content to managing emails. Refer to the following table to see detailed folder permissions.

In addition to these, users can also set and use custom permission levels that allows them to combine read, delete, and edit access according to their specific requirements.

Monitoring these permissions is crucial for maintaining data security and compliance. However, relying on native reporting methods doesn’t provide a straightforward approach or a detailed overview of all mailbox folder permission changes. To overcome these limitations, AdminDroid simplifies tracking folder activities with a clear view of all changes and who made them.

• This report helps you observe the mailbox folder operations performed, the folders involved during the changes, and the permissions that were granted or removed.
• Filter the report based on the performed operation, performed by, mailbox folders, etc., to get your desired filtered results.

Handy Tip: You can use the Export option to download the filtered report in your desired format (CSV, XLS, PDF, etc.) for offline access.

Microsoft 365 users can view their mailbox folder permission levels through the Outlook client. Additionally, Exchange Online provides admins with the authority to get users' mailbox folder permissions using PowerShell for enhanced governance. Follow the steps outlined below to get mailbox folder permission in Exchange Online using PowerShell and Outlook.

Refer to the steps below to find mailbox folder permissions in your mailbox or in a mailbox where you’ve been granted delegated access.

As an admin, you must use Exchange Online PowerShell to get the mailbox folder permissions since this cannot be viewed using the admin centers.

Note: Replace <Mailbox UPN> with the mailbox owner's email address, <Folder Path> with the folder's path, and <Delegated User’s UPN> with the email address of the delegated user.

In Outlook, you can set mailbox folder permissions to grant access to other users. Here's how to share a mailbox folder with another user.

If you’re an admin you can share user's mailbox folders using PowerShell cmdlets such as Add-MailboxFolderPermission or Set-MailboxFolderPermission.

You might wonder about ‘what is the difference between Add and Set cmdlet?’ If so, the distinction is that Set-MailboxFolderPermission modifies existing mailbox folder permissions, while the Add-MailboxFolderPermission assigns new permissions.

Users with folder permissions in Microsoft 365 can access another user's mailbox folders using Outlook clients. For accessing another person's folder(s) using Outlook on the web, follow these straightforward steps.

While users with mailbox folder permissions can access other users’ folders, remember that those with broader mailbox access can view and use entire mailboxes.

• This report offers detailed insights such as when the mailbox was accessed, the user who accessed it, the operation performed, client IP, and more.
• Identifying unauthorized access to a mailbox by a user becomes simple with the help of this report.

Handy Tip: Schedule this non-owner mailbox access report to receive timely email notifications about who accessed which mailboxes in Microsoft 365.

Calendars in Outlook are essential for scheduling and visualizing meetings or events. Similar to mailbox folders, calendar folders can also be shared with other users to coordinate schedules and prevent conflicts. To enable this, calendar permissions can be managed through the Outlook client or PowerShell, offering flexibility in controlling access. Here's how to manage calendar permissions in Exchange Online.

While calendar permissions cannot be managed directly from any native admin centers, admins can utilize Exchange Online PowerShell to handle them. By default, any user can view other internal users’ calendars with the AvailabilityOnly scope, which shows whether the calendar owners are free/busy.