Exchange | grant read-only access to shared Mailbox (Update)

Hey there,

I want to go through the steps, to set up read-only access to a shared mailbox (or any mailbox) in Exchange. In this case Exchange Online, but it should work with the on-prem Exchange as well. I want the user to be able to read and mark emails “as read”, but not delete them.

From what I could gather, this isn’t really intuitive and requires the Powershell.

Let’s start.

Setting the permissions

First, connect to your Exchange or Exchange Online.

For the on-prem Exchange just use “Exchange Management Shell”. In the case of Exchange Online, you will need to connect to Office365 first.

PS /home/user> $UserCredential = Get-Credential
## Enter you Credentials
PowerShell credential request
Enter your credentials.
User: username@random-it-blog.de
Password for user user@random-it-blog.de: *******

## Connect to Exchange Online
PS /home/user> $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

## Import the required Modules
PS /home/user> Import-PSSession $Session -DisableNameChecking

Or you could use this method. It’s easier.

“Connect-ExchangeOnline” will open the browser, where you can login with your credentials.

If you want to open a browser manually use the “-device” option. This is useful if you use something like the “Firefox Multi-Account Container” Extension.

## Install the Module
PS /home/user> Install-Module -Name ExchangeOnlineManagement

## Connect to Exchange Online
PS /home/user> Connect-ExchangeOnline

## Connect to Exchange Online with "-device"
PS /home/user> Connect-ExchangeOnline -device
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code CFE2D8TUZ to authenticate

Next, we give the user read permission to the shared mailbox. For this example, I will use “mail@random-it-blog.de” for the shared mailbox and “user@random-it-blog.de” as the user mailbox.

PS /home/user> Add-MailboxPermission -Identity mail@random-it-blog.de -user user@random-it-blog.de -AccessRights ReadPermission -InheritanceType all

Now you could add the mailbox in Outlook, but the user won’t be able to see any folders. For this, we need to set the folder permission as well.

## Add permission to the root folder
PS /home/user> Add-MailboxFolderPermission -Identity mail@random-it-blog.de:\ -User user@random-it-blog.de -AccessRights Reviewer

## Add permission to the "inbox" folder.
PS /home/user> Add-MailboxFolderPermission -Identity mail@random-it-blog.de:\Inbox -User mail@random-it-blog.de -AccessRights FolderVisible,ReadItems,EditAllItems

Repeat this process for every folder, you want to add the permission. The access rights combination of “FolderVisible,ReadItems,EditAllItems” should allow the user to read and mark emails, but not delete them.

Display information

Mailbox folders

To list the mailbox folders, you can use these commands.

This didn’t work for me on other mailboxes.

PS /home/user> Get-MailboxFolder -Identity mail@random-it-blog.de -Recurse

Name                          FolderPath                              HasSubfolders
----                          ----------                              -------------
Top of Information Store      {}                                      True
Archive                       {Archive}                               False
Calendar                      {Calendar}                              True
Birthdays                     {Calendar, Birthdays}                   False

or this one. It’s not pretty but works.

PS /home/user> Get-MailboxFolderStatistics -Identity mail@random-it-blog.de | fl FolderPath

Mailbox / Folder permissions

For the permissions on the mailbox, use this command.

## Mailbox permission
PS /home/user> Get-MailboxPermission -Identity mail@random-it-blog.de 

Identity             User                 AccessRights                                                             IsInherited Deny
--------             ----                 ------------                                                             ----------- ----
mail NT AUTHORITY\SELF    {FullAccess, ReadPermission}                                             False       False
mail NT AUTHORITY\SELF    {FullAccess, ExternalAccount, ReadPermission}                            False       False
mail user@random-it-blog.de {ReadPermission}                                                         False       False

The permissions for the folders you can get with this.

PS /home/user> Get-MailboxFolderPermission -Identity mail@random-it-blog.de:\Inbox

FolderName           User                 AccessRights                                  SharingPermissionFlags
----------           ----                 ------------                                  ----------------------
Inbox                Default              {None}                                        
Inbox                Anonymous            {None}                                        
Inbox                user       {ReadItems, EditOwnedItems, EditAllItems, Fo… 

Outlook configuration

The last step is to add the mailbox to Outlook.

After this, the user should be able to access the new mailbox.

Adding shared mailbox to OWA

Because it came up. Here is how you can add the shared folder in OWA.

Right click on “folder” and “Add shared folder or mailbox”