the mailbox reached the limit of maximum allowed access control entries

Wiktor Kostrzewski 21

Hi,

I am unable to remove or add to shared mailbox permission any object

I got error :

How to fix this ?
I have hybrid environment

Accepted answer

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2022-04-29T01:41:00.19+00:00

Hi @Wiktor Kostrzewski

Here is a link with the similar issue for your reference: Unable to add full access on shared mailbox
As it has been mentioned in the error message "Clean existing entries and rearrange them leveraging groups for assigning the same permission to multiple users.",
please first check if you can remove some of the delegates from the shared mailbox, then wait some time for the information to be updated, see if you can add permissions to new objects correctly.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

1 additional answer

Wiktor Kostrzewski 21 Reputation points

2022-04-29T07:16:22.593+00:00

Hi
I removed some entries but i still get the same error.
I am worried if remove all, the error will persist
Please sign in to rate this answer.
Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2022-05-02T01:46:38.11+00:00

Thanks for the update.

How many delegates do you currently have on this mailbox?
If you still have a large amount, please try creating a mail-enabled security group and add some of the delegates as members.
Then assign the permission to this group and see if it can help with this issue.

Wiktor Kostrzewski 21 Reputation points

2022-05-02T11:04:57.57+00:00

Hi

I used this code :

Get-MailboxPermission -Identity 'XXX@X .com' -ResultSize unlimited | Select-Object Identity,User,IsInherited,AccessRights

And i only see a 120 entries so i do know why its happening ..

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2022-05-03T09:00:22.387+00:00

Hi,

This code only shows the Full access permission.
How about the result of these two cmdlets (Send as and Send on behalf of):

Get-RecipientPermission -Identity 'XXX@XXX.com' | Select Trustee, AccessRights Get-Mailbox -Identity 'XXX@XXX.com' | Select GrantSendOnBehalfTo

Wiktor Kostrzewski 21 Reputation points

2022-05-04T07:22:31.217+00:00

only 4 entries for first code
For second , one

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2022-05-05T09:32:28.54+00:00

Thanks for the information.

Please also have a check of the folder permissions.

You may use the Get-MailboxPermissionsReport.ps1 script in this link: Export mailbox folder permissions to CSV file
(Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.)
Run the code like the following to get the permissions:

.\Get-MailboxPermissionsReport.ps1 -MailboxId <the mailbox> -CsvFileName "report.csv"

Wiktor Kostrzewski 21 Reputation points

2022-05-09T07:53:24.377+00:00

Hi
I got 140 entries from this code

Wiktor Kostrzewski 21 Reputation points

2022-05-09T12:52:41.327+00:00

Hello
as this is a mailbox in hybrid mode (and this is a remote mailibox on prem) i tried to execute your code on prem but i could not , maybe there is an issue on prem so i had to check

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2022-05-11T08:34:04.36+00:00

Thanks for the information.

This script is for Exchange Online thus you cannot run it on Exchange on-premises servers.

While since it seems actually you are having a large member of delegation entries on this mailbox, if possible I would still recommend removing some first and see if it helps with this issue.
Sign in to comment