How to export calendar permissions in Exchange Online

Before you start

Use an account with the Exchange Administrator role or in the Organization Management role group. The admin centre steps work with a Global Reader. The script signs in as you and needs no app registration.

Know what the entries mean. A named user holds a role such as Reviewer, which reads every item, or Editor, which manages every item. Default covers signed-in people in the organisation without an entry of their own, usually at AvailabilityOnly, free and busy times only; at Reviewer or above, everyone can read the calendar. Anonymous covers people who do not sign in, usually at None. The examples read the permissions as they stand when run and change nothing.

Option 1

Export calendar permissions with PowerShell

Install the module once, then connect and read the calendar of every user, shared, room and equipment mailbox. The script reads 1 mailbox at a time, so a large tenant takes a while.

# Install once, if the module is not already installed.
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline -ShowBanner:$false
try {
    $types = 'UserMailbox', 'SharedMailbox', 'RoomMailbox', 'EquipmentMailbox'
    $mailboxes = Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails $types
    $report = @(foreach ($mailbox in $mailboxes) {
        $folder = "$($mailbox.UserPrincipalName):\Calendar"
        try {
            $entries = Get-EXOMailboxFolderPermission -Identity $folder
        } catch {
            Write-Warning "Could not read $folder. $($_.Exception.Message)"
            continue
        }
        foreach ($entry in $entries) {
            $user = [string]$entry.User.DisplayName
            if (-not $user) { $user = [string]$entry.User }
            $rights = $entry.AccessRights -join ', '
            # Default and Anonymous are on every calendar: keep them only when changed.
            if ($user -eq 'Default' -and $rights -eq 'AvailabilityOnly') { continue }
            if ($user -eq 'Anonymous' -and $rights -eq 'None') { continue }
            [pscustomobject]@{
                Mailbox      = $mailbox.DisplayName
                Address      = $mailbox.PrimarySmtpAddress
                MailboxType  = $mailbox.RecipientTypeDetails
                User         = $user
                UserType     = [string]$entry.User.UserType
                AccessRights = $rights
                Flags        = $entry.SharingPermissionFlags -join ', '
            }
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'No calendar has named users or changed Default and Anonymous entries.'
    } else {
        $report | Export-Csv -Path './calendar-permissions.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) calendar permission entries exported."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

Flags shows Delegate for an Outlook delegate and CanViewPrivateItems for someone who sees private items. A UserType of External marks sharing outside the organisation, and Unknown can mean the account no longer exists. Change $types to narrow the run.

Check 1 mailbox's calendar

Reconnect with Connect-ExchangeOnline, then read 1 calendar.

# Run while connected to Exchange Online. Replace the example mailbox.
Get-EXOMailboxFolderPermission -Identity 'person@example.com:\Calendar' |
    Format-Table User, AccessRights, SharingPermissionFlags

Add -User and a person's address to see only their entry; the command returns an error when they have none.

Option 2

Check calendar sharing in the Microsoft 365 admin centre

No admin centre lists each calendar's permissions: the Exchange admin centre's delegation covers Full Access, Send as and Send on behalf only. The Microsoft 365 admin centre shows what people may share outside the organisation.

1. Sign in to the Microsoft 365 admin centre for the correct tenant.
2. Select Show all, then go to Settings > Org Settings.
3. On the Services tab, select Calendar.
4. Read whether Let your users share their calendars with people outside of your organization who have Office 365 or Exchange is selected, and whether Allow anyone to access calendars with an email invitation is selected with a level of detail under it.
5. Close the pane without saving.

This shows what the organisation allows, not which calendars are shared or with whom. For that, export the permissions with PowerShell or a report.

Common questions

Why can a mailbox's calendar not be found?

The folder may have another name, such as when the mailbox's folder names are in another language. Run Get-EXOMailboxFolderStatistics with -Folderscope Calendar for that mailbox to see its name, and read that folder instead.

Does Full Access give someone the calendar?

Full Access opens the mailbox but does not set a calendar role, so someone can hold it and appear nowhere in this export. To export it, see how to export mailbox permissions.

Is everyone with Editor a delegate?

No. An Outlook delegate has Editor and the Delegate flag. Editor without the flag manages the items but is not a full delegate, which also covers how meeting requests are delivered. Set up delegates in Outlook, signed in as the owner.