Exchange Online

How to Monitor Guest Access to User Mailboxes in Microsoft 365

Are you concerned about guest users accessing user mailboxes in Microsoft 365? Imagine a guest user retaining full access to a manager's mailbox even after the project ends. This could allow them to view organizational messages, download sensitive files, or manage the mailbox as their own. Without proper oversight, these scenarios could lead to data exposure. In this guide, we'll show you how to audit guest access to user mailboxes in Microsoft 365 to prevent such risks.

Using Windows PowerShell

Microsoft 365 Permission Required

View-only Audit Logs Role Least Privilege

Global Admin Most Privilege

Connect to the Exchange Online PowerShell module using the cmdlet below.
Windows PowerShell
```
 Connect-ExchangeOnline
```
Guest users can be assigned three types of permissions over a users' mailbox in Microsoft 365: Full Access, Send As, and Send on Behalf Of.
To identify guest users with 'Full Access' permission to user mailboxes, execute the cmdlet below.

Windows PowerShell

 $Output = @()
Get-Mailbox -RecipientTypeDetails UserMailbox | ForEach-Object {
    $FullAccessPermissions = Get-MailboxPermission -Identity $_.UserPrincipalName | Where-Object { $_.User -ne "NT AUTHORITY\SELF"}
    ForEach ($Permission in $FullAccessPermissions){
        if ($Permission.User -like "*#EXT#*"){
            $Output += New-Object PSObject -Property @{
                UserName = $_.DisplayName
                Mailbox = $_.UserPrincipalName
                GuestUser = $Permission.User
                AccessRights = $Permission | Select -ExpandProperty AccessRights
}}}}
$Output

Run the below cmdlet to get a list of guest users with 'Send As' access right to user mailboxes.

Windows PowerShell

 $Output = @()
Get-Mailbox -RecipientTypeDetails UserMailbox | ForEach-Object {
    $SendAsPermissions = Get-RecipientPermission -Identity $_.UserPrincipalName | Where-Object { $_.Trustee -ne "NT AUTHORITY\SELF"}
    ForEach ($Permission in $SendAsPermissions){
        if ($Permission.Trustee -like "*#EXT#*"){
            $Output += New-Object PSObject -Property @{
                UserName = $_.DisplayName
                Mailbox = $_.UserPrincipalName
                GuestUser = $Permission.Trustee
                AccessRights = $Permission | Select -ExpandProperty AccessRights
}}}}
$Output

Execute the below cmdlet to list all guest users with 'Send on Behalf Of' permission to user mailboxes.

Windows PowerShell

 $Output = @()
Get-Mailbox -RecipientTypeDetails UserMailbox | Where-Object { $_.GrantSendOnBehalfTo -ne $null } | ForEach-Object{
    Foreach ($ObjectID in $_.GrantSendOnBehalfTo) {
        $User = Get-User -Identity $ObjectID
        if ($User.UserPrincipalName -like "*#EXT#*"){
            $Output += New-Object PSObject -Property @{
                UserName = $_.DisplayName
                Mailbox = $_.UserPrincipalName
                GuestUser = $User.UserPrincipalName
                AccessRights = "Send on Behalf Of"
}}}}
$Output

Using AdminDroid
Simple & Quick

AdminDroid Permission Required Delegated

Any user with report access assigned by the Super Admin.

Log in to the AdminDroid Microsoft 365 reporter.
Navigate to the Guest Users with Access to Other Mailboxes report under Reports»Exchange»Mailbox Permissions»Guest Access to Others Mailboxes.

AdminDroid Exchange Online Reporter

Stay Ahead of Risks by Monitoring Guest Access to User Mailboxes in Microsoft 365!

AdminDroid's Exchange Online auditing tool provides an end-to-end solution for monitoring Microsoft 365 mailbox permissions, mailbox settings, mailbox usages, and more. With these comprehensive insights, you can effortlessly audit guest access to Microsoft 365 mailboxes to ensure your critical assets remain secure while enabling seamless collaboration.

Visualize Exchange Online Mailbox Permissions

Make use of the mailboxes permission dashboard for visualizing Send as, Send on Behalf of, and Full access permissions across all mailboxes including those assigned to guest users.

Monitor Non-owner Mailbox Access in Exchange Online

Keep track of non-owner mailbox access report to identify unauthorized guest activities on sensitive mailboxes and ensure controlled access.

Stay Alerted of Newly Granted Mailbox Permissions

Leverage AdminDroid's advanced default alert policy template to receive real-time notifications for every mailbox permission granted and effortlessly verify if the changes are authorized or not.

Control Guest Access to Shared Mailbox in Exchange Online

Review Microsoft 365 shared mailbox permission report to ensure external users have the appropriate access and their communication remains uninterrupted.

Track Guest Activities in Microsoft 365 Mailboxes

Regularly audit mailboxes accessed by guest users to monitor their activities and identify any unauthorized actions performed on mailbox items.

Audit Outbound Emails Sent via Guest Delegation

Monitor the outbound email activity report to spot external emails sent via guest permissions, ensuring mailbox rights are not misused.

In conclusion, AdminDroid's Exchange Online management tool offers a robust solution for monitoring guest permissions to user mailboxes. With its detailed reports and real-time data, admins can easily track guest access rights, detect unauthorized activities, and ensure security across the organization.

Explore a full range of reporting options

Download Live Demo

Important Tips

Enable mailbox auditing for all users to track logins and detect unauthorized guest access with delegated permissions.

Use conditional access policies to improve authentication strength for guest users and secure highly privileged mailbox access effectively.

Restrict guest users in Microsoft Entra ID from gaining excessive privileges and protect sensitive data from unnecessary exposure.

Common Errors and Resolution Steps

The following are the possible errors and troubleshooting hints while managing guest permissions to user mailboxes in Microsoft 365.

Error Remove permission operation failed.

This error occurs in the Exchange admin center when attempting to remove mailbox permission delegated to a guest user without the required admin permissions.

Fix Ensure that you have the necessary administrative permissions such as Global admin or Exchange admin to revoke mailbox permission of a guest user.

Error Write-ErrorMessage : Ex9BC9DD|Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException|User or group "<GuestUserEmail>" wasn't found. Please make sure you've typed it correctly.

This error occurs when running the 'Add-RecipientPermission' PowerShell cmdlet and the specified user doesn’t exist or doesn’t have a mailbox.

Fix Ensure that the user is a guest in your organization and has an active mailbox before assigning the permission.

Error WARNING: The appropriate access control entry is already present on the object "CN=fc34915e-2a4b-4217-9d52-0e967e8b13bd,OU=jispa.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=INDPR01A005,DC=PROD,DC=OUTLOOK,DC=COM" for account "S-1-5-21-122708444-3114493987-3236274769-54976102".

This issue occurs when you run the 'Add-MailboxPermission' cmdlet in Exchange Online PowerShell to assign already granted permissions to a guest user.

Fix Before assigning permissions, check if the user already has the delegated permission. Use the following cmdlet in Exchange Online PowerShell to verify existing mailbox permissions.

Get-MailboxPermission -Identity "<UserPrincipalName>" 
#Replace the <UserPrincipalName> with the UPN of the mailbox you want to check.

Error Write-ErrorMessage : Cannot process argument transformation on parameter 'AccessRights'. Cannot convert value "SendOnBehalfOf" to type

This error occurs when using the 'Add-RecipientPermission' cmdlet with an invalid value. The SendOnBehalfOf value cannot be used for the AccessRights parameter, as the only valid value for this parameter is SendAs.

Fix To resolve this error, use SendAs as the value for the AccessRights parameter. If you need to configure SendOnBehalfOf permissions, use the 'Set-Mailbox' cmdlet instead.

Set-Mailbox "<UserMailbox>" -GrantSendOnBehalfTo "<GuestUser>" 
#Replace the <UserMailbox> with the UPN of the mailbox and <GuestUser> with the guest's UPN to give SendOnBehalfof permission.

Exchange Online

Frequently Asked Questions

Keep Critical Mailboxes Secure by Auditing Guest Access in Exchange Online!

How to manage guest access in Microsoft 365 mailboxes?

Granting guest access to Microsoft 365 mailboxes is essential for enabling external collaborators to work efficiently with internal teams. However, it’s crucial to manage these permissions to prevent unauthorized access and compliance issues.

Let's see how to effectively manage guest access to user mailboxes in Exchange Online using PowerShell.

Steps to grant guest access to Exchange Online user mailboxes

Ensure you connect to the Exchange Online PowerShell module before proceeding.
Full Access permission allows a guest user to open and fully manage a mailbox. However, it does not include Send As or Send on Behalf Of permissions. To grant 'Full Access' permission, run the following cmdlet by replacing <UserName> with the UPN of the mailbox and <GuestUser> with the guest user's UPN.

Add-MailboxPermission –Identity "<UserName>" -User "<GuestUser>" -AccessRights FullAccess -InheritanceType All

Send As permission allows a guest user to send emails as the mailbox owner. To provide 'Send As' access, execute the cmdlet below by replacing <GuestUser> with the guest user's UPN and <UserMailbox> with the target mailbox's UPN.

Add-RecipientPermission –Identity "<UserMailbox>" -Trustee "<GuestUser>" -AccessRights SendAs

Send on Behalf of permission lets a guest user send emails on behalf of the mailbox owner. To assign this permission, execute the cmdlet below.

Set-Mailbox "<UserMailbox>" -GrantSendOnBehalfTo @{Add="<GuestUser>"}

If you want to grant guest access to a shared mailbox, replace <UserMailbox> with the UPN of the shared mailbox in the above commands. This ensures that external users have the right access to perform their roles effectively in a shared mailbox.

You can also remove any permissions granted to guest users using the following PowerShell cmdlets.

Remove-MailboxPermission: This cmdlet is used to remove 'Full Access' permission delegated.
Remove-RecipientPermission: Using this cmdlet, you can remove 'Send As' permission delegated.
Set-Mailbox: This cmdlet can also be used to revoke 'Send on Behalf of' permissions. However, the value for GrantSendOnBehalfTo must be modified.

For example, to remove Send on Behalf of permission granted to a guest user, run the following cmdlet

Set-Mailbox "<UserMailbox>" -GrantSendOnBehalfTo @{Remove="<GuestUser>"}

What are the risks of guest users accessing mailboxes in Exchange Online?

Unwanted mailbox permissions delegated to guest users may result in significant risks and compromise Microsoft 365 security. Some of these risks include:

Account Compromise: If a guest users’ account is compromised, attackers could gain access to user mailboxes. This could allow them to target other systems and sensitive data within the organization.
Data Leakage: Guest users may unintentionally share confidential information with unauthorized parties or external users, leading to potential data breaches.
Compliance Violations: Mismanaged guest permissions can result in compliance issues and damage the organization's reputation.
Phishing and Malware Risks: Guest users with mailbox access might unknowingly open phishing emails or malicious attachments. This could expose internal systems to malware attacks or lead to the theft of sensitive data.
Increased Security Vulnerabilities: Guest user accounts are harder to monitor than internal accounts. This makes it challenging to detect and prevent malicious activities.

To mitigate these risks and improve security, admins should regularly monitor guest permissions and mailbox folder permission changes in Exchange Online.

How to revoke a mailbox permission assigned to a guest user?

Excessive privileges mistakenly granted to guest users can pose significant risks to mailbox security. Identifying and revoking unnecessary permissions ensures proper access control and minimizes the risk of data exposure. In this section, we'll see how to remove mailbox permission assigned to a guest user in the Exchange admin center.

Log in to the Exchange admin center.
Navigate to Recipients»Mailboxes and select the mailbox you want to modify.
Click the Delegation tab in the flyout pane.
Choose the appropriate permissions (Full Access, Send As, Send on Behalf) and click Edit.
Locate the guest user from the list and select the Delete option.
Click Confirm to revoke the permission granted to the guest user.

Note: The changes may take up to 5 minutes to reflect in the Exchange admin center.

How to audit guest mailbox permission changes in Exchange Online?

In Microsoft 365, auditing mailbox permission changes is essential to ensure proper access control, especially when dealing with guest users. Unauthorized additions or removals of permissions to guest users can compromise mailbox security and lead to data exposure.

Audit mailbox permission changes in the Microsoft Purview Compliance portal

Navigate to the Audit page in the Microsoft Purview Compliance Portal.
Customize the date and time range as per your requirements.
Select the following operations in the Activities-friendly names field.
- Added delegate mailbox permissions, Removed delegate mailbox permissions
Then, click on Search. Once the search is completed, you can export all mailbox permissions changes.
To get all permissions delegated to guest users, add a filter to the AuditData column of the exported file using the "Text contains" option and specify "#EXT#".

Auditing mailbox permission changes in Microsoft 365 audit logs is challenging as it requires complex filtering, and the results are not user-friendly.

Streamline mailbox permission tracking in Exchange Online with AdminDroid

With AdminDroid's mailbox permission changes report, you can easily identify any unauthorized mailbox permission changes.
This report provides detailed information on all mailbox permission changes, including the authorization time, the mailbox involved, the admin who authorized the change, and more.

How to Monitor Guest Access to User Mailboxes in Microsoft 365

Using Windows PowerShell

Using AdminDroid Simple & Quick

Stay Ahead of Risks by Monitoring Guest Access to User Mailboxes in Microsoft 365!

Visualize Exchange Online Mailbox Permissions

Monitor Non-owner Mailbox Access in Exchange Online

Stay Alerted of Newly Granted Mailbox Permissions

Control Guest Access to Shared Mailbox in Exchange Online

Track Guest Activities in Microsoft 365 Mailboxes

Audit Outbound Emails Sent via Guest Delegation

Important Tips

Enable mailbox auditing for all users to track logins and detect unauthorized guest access with delegated permissions.

Use conditional access policies to improve authentication strength for guest users and secure highly privileged mailbox access effectively.

Restrict guest users in Microsoft Entra ID from gaining excessive privileges and protect sensitive data from unnecessary exposure.

Common Errors and Resolution Steps

Error Remove permission operation failed.

Error Write-ErrorMessage : Ex9BC9DD|Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException|User or group "<GuestUserEmail>" wasn't found. Please make sure you've typed it correctly.

Error Write-ErrorMessage : Cannot process argument transformation on parameter 'AccessRights'. Cannot convert value "SendOnBehalfOf" to type

Frequently Asked Questions

Keep Critical Mailboxes Secure by Auditing Guest Access in Exchange Online!

How to manage guest access in Microsoft 365 mailboxes?

Steps to grant guest access to Exchange Online user mailboxes

What are the risks of guest users accessing mailboxes in Exchange Online?

How to revoke a mailbox permission assigned to a guest user?

How to audit guest mailbox permission changes in Exchange Online?

Audit mailbox permission changes in the Microsoft Purview Compliance portal

Kickstart Your Journey With AdminDroid

Using AdminDroid
Simple & Quick

Kickstart Your Journey With
AdminDroid