Exchange Online - Powershell to check delegate permissions and add if not present

[timbo343]

I'm wanting powershell to check all our mail enabled Office365 accounts for mailbox delegation > Sendas. If the result is negative and the user's account doesn't already contain a specific user, i would like powershell to add the user to the account.

 

This is required for our MFDs around our place so users are able to scan documents to their email accounts.

 

I think i have the correct script but i need to reverse it so that it shows the accounts that DO NOT have the user Sendas in the Trustee

 

Get-mailbox | Get-RecipientPermission -Trustee Sendas

 

This obviously lists the accounts with Sendas listed as a Trustee. How do i show those accounts that DO NOT have this user listed?

 

Thanks

[ThomL]

would this work? untested just an initial idea:

Get-mailbox | Get-RecipientPermission | where {$_.trustee -ne "Sendas"}

[timbo343]

I've tried that, instead it displays any other SendAs access permissions baring the user "Sendas"

[Mayki5]

would this work? untested just an initial idea:

Get-mailbox | Get-RecipientPermission | where {$_.trustee -ne "Sendas"}

 

I think you were close with that, just need to change the -ne to -notcontains.

That should then list everything where specifically the SendAs user is not present.

[timbo343]

I think you were close with that, just need to change the -ne to -notcontains.

That should then list everything where specifically the SendAs user is not present.

 

That doesn't work either. As mentioned above, the command is showing NT AUTHORITY\SELF. I would have thought the command you stated should show accounts that DO NOT have user sendas listed

[timbo343]

I think i've just got it:

 

Get-mailbox | Get-recipientPermission | where { -not($_.trustee -notlike “sendas") }

 

Ignore the above command - doesnt work

Edited December 13, 2018 by timbo343

[ThomL]

Tthe double negative in the where seems odd - first you say you want the recipient permissions where $_.trustee is not like "sendas" so this find all records that don't include sendas but the you flip that with the outer -not so it then inverts the account found to return account that do have "sendas" as $_.trustee

 

doesn't it? :/

[ThomL]

Get-RecipientPermission -ResultSize unlimited | where {($_.Trustee -ne "NT AUTHORITY\SELF") -and ($_.Trustee -ne "NULL SID") }

 

the above finds all sendas permissions for me, it just needs tweaking to show accounts missing permissions for the account "sendas" right?

 

nevermind, the above finds the individual send as perms but that's not what we're trying to do...

 

we need the permissions for each mailbox and then recursive check for sendas perms for the "sendas" account - if they are missing return the mailbox identity?

Edited December 13, 2018 by ThomL

[timbo343]

Get-RecipientPermission -ResultSize unlimited | where {($_.Trustee -ne "NT AUTHORITY\SELF") -and ($_.Trustee -ne "NULL SID") }

 

the above finds all sendas permissions for me, it just needs tweaking to show accounts missing permissions for the account "sendas" right?

 

nevermind, the above finds the individual send as perms but that's not what we're trying to do...

 

we need the permissions for each mailbox and then recursive check for sendas perms for the "sendas" account - if they are missing return the mailbox identity?

 

Yup to the last line

[ThomL]

I think this is the way to do it, or something like this maybe. First collect all accounts with "sendas" send as permissions in the $SendAs variable.

 

Then collect all account from Exchange Online, but remove the ones we know already have the correct permissions with the $SendAs variable - leaving just the account missing the "sendas" send as permission.

 

$missingSendAs should contain all mailboxes missing the permission.... right? Does that make sense? does this work:

 

$SendAs = Get-RecipientPermission -ResultSize unlimited | where {$_.Trustee -eq "sendas"} | select $_.identity

$missingSendAs = Get-mailbox -ResultSize unlimited | where {$_.Name -ne $SendAs.identity}

Edited December 13, 2018 by ThomL

[timbo343]

It makes sense but doesn't work.

[timbo343]

I've now got:

 

$Sendas = get-mailbox -ResultSize unlimited | Get-RecipientPermission -Trustee sendas | Select Identity, trustee

 

which saves the result showing all mailboxes that have the user "sendas" assigned to them. I now need a way to reverse this to show all accounts that do not contain the user "sendas" or compare the $sendas list to the list of all mailboxes and show those are missing from the $sendas list.

[ThomL]

The below has worked for me, make sure to update the "where {$_.Trustee -eq "[email protected]"} " part to have the email of the sendas mailbox. THe $woSendAs should contain all mailboxes missing the send as permission

 

$allMailboxes = Get-mailbox -ResultSize unlimited

 

$SendAs = Get-RecipientPermission -ResultSize unlimited | where {$_.Trustee -eq "[email protected]"} | select identity

 

$woSendAs = Compare-Object -ReferenceObject $SendAs -DifferenceObject $allMailboxes -Property identity -PassThru

Edited December 14, 2018 by ThomL

[timbo343]

That works for me too, many thanks for your help

[ThomL]

I'm sure this can be streamlined to be way more efficient and gain a lot of speed of execution - but it annoyed me and this is a working solution. I might take another look later, if anyone can make this better post it up.

[timbo343]

I have run the following code to add the user "Sendas" to the list of accounts

 

woSendAs | Add-RecipientPermission -AccessRights SendAs -Trustee sendas