How to add permission for a mailbox folder in Exchange using PowerShell

This post is inspired from a question I answered over at the Microsoft Online Services Forum at TechNet.
http://social.technet.microsoft.com/Forums/msonline/en-US/a1e21764-0c10-4e6b-94e6-fd5df5df1ed2/how-to-add-multiple-users-permissions-to-a-calendar-using-powershell?forum=onlineservicesexchange#dcd3af6e-7f50-4faf-9da8-cbe6d905d7a3

The case was something like this.

I have an organization that was recently setup in Exchange Online and they have unique circumstances in that every user in the organization needs “reviewer” access to every other users calendars.  I cannot change the default permission since new users added after this should not be able to see these calendars details.

Lets use PowerShell and prepare for such a deployment.

First I create two security groups. One containing the users that will have their mailboxes shared, and on that has access to these mailboxes. The names I have used there is complete conceptual, so in your production environment you probably your name them a bit more specific.

New-DistributionGroup -Type Security -Name "SG Users With Shared Calendar" -Alias "SG-Users-With-Shared-Calendar"
New-DistributionGroup -Type Security -Name "SG Users With Access To Shared Calendar" -Alias "SG-Users-With-Access-To-Shared-Calendar"

Then, we need to add the affected mailboxes to their respective groups. I just used Exchange admin center for this task, but there is of course possible to do the same using PowerShell and the Add-DistributionGroupMember CMDlet

Next single liner command to run is to give the second group access to the first groups calendar.

Get-DistributionGroupMember -Identity "SG Users With Shared Calendar" | foreach {Add-MailboxFolderPermission -Identity "$($_.Name):\Calendar" -User "SG-Users-With-Access-To-Shared-Calendar" -AccessRights Reviewer}

If you check the permission for a calendar owned by one of the users in the first group, you will see that it’s shared with our last security group

OWACalendarInsideOrganizationGroupReviewer

The script and way to solve this could of course be mixed up with both security groups and users to achieve the exact desired configuration, and apply to both Exchange Online and Exchange on-premises.

Below you find links to all the PowerShell CMDlets used in this post

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s