Get-EXOMailboxPermission vs Get-MailboxPermission

Jesus Chao 141

Hi,

We have an Azure Automation runbook that is getting mailbox permissions in EXO. We have about 4000 mailboxes. When we use Get-ExoMailboxPermission against all the mailboxes, the Azure Automation runbook takes well over 3 hours to complete - which causes the runbook to fail because there is a 3 hour limit on running runbooks. However, if we use the old cmdlet Get-MailboxPermission, it takes about 50 minutes.

Why is there such a huge difference in performance? It's difficult to justify transitioning to EXO cmdlets when it takes 3 times as long. Is anyone else experiencing the same?

Thanks,

1 answer

Yuki Sun-MSFT 40,856 Reputation points

2023-05-03T03:09:34.88+00:00
Hi @Jesus Chao ,

EXO cmdlets claim to be faster and reliable,(See statement in this link so it doesn't make sense to me either that it took much longer to complete in your case.

I've also tested in my lab tenant by running the cmdlets below. Although I have only a dozen of mailboxes, per my observation, EXO cmdlets are seemingly a little bit faster than the old one.

Get-EXOMailbox -ResultSize unlimited | Get-EXOMailboxPermission Get-Mailbox -ResultSize unlimited | Get-MailboxPermission

For your situation, could you try testing by running the two cmdlets exclusively in Windows PowerShell and check how it goes. This might help eliminate the impact of Azure Automation.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Jesus Chao 141 Reputation points

2023-05-03T03:14:51.38+00:00

Yuki

Please check again. I know that GET-Mailbox is not as fast as Get-ExoMailbox. But these are not the commands I speak of. I am talking about Get-ExoMailboxPermissions. Can you try that one instead???

Yuki Sun-MSFT 40,856 Reputation points

2023-05-03T03:29:40.8233333+00:00

Hi @Jesus Chao ,

I understood that you were taking about Get-EXOMailboxPermission and Get-MailboxPermission, but wondering how you managed to run Get-EXOMailboxPermission and Get-MailboxPermission against all the mailboxes without using Get-Mailbox or Get-EXOMailbox?

If possible, can you share the command you used after removing all personal information involved?

Jesus Chao 141 Reputation points

2023-05-03T03:35:05.9033333+00:00

Sorry yes. To get all the users I am using Get-exomailbox and that works fine. I store all the users in a variable and then run a for each against each user using either Get-exomailboxpermission or get-mailboxpermission. The get-mailboxpermission in this scenario is way faster. 3 hours versus 50 minutes

I can share my code when I return to work tomorrow morning.

Yuki Sun-MSFT 40,856 Reputation points

2023-05-03T05:21:09.58+00:00

Thanks @Jesus Chao for the clarification. Feel free to post back with a snippet of the code tomorrow when you are back to work.

Jesus Chao 141 Reputation points

2023-05-03T12:48:51.44+00:00

# If Type is EXO, the EXO Cmdlet will run. $type = 'EXO' $global:AllUserMailboxInfo = Get-EXOMailbox -Filter {RecipientTypeDetails -eq 'UserMailBox'} -PropertySets Minimum -ResultSize unlimited $permissions = foreach ($user in $AllUserMailboxInfo) { if ($type -eq 'EXO') {$user | Get-EXOMailboxPermission -verbose:$false} else {$user | Get-MailboxPermission -verbose:$false} }

Yuki Sun-MSFT 40,856 Reputation points

2023-05-04T07:57:25.98+00:00

Hi @Jesus Chao ,

I tested using your code and also noticed that when using $type = 'EXO', it took a bit longer.

$type = 'EXO' -------approximately 12 seconds

$type = '' -------------approximately 9 seconds

But when testing by running the following commands, EXO cmdlets are much faster in my case approx. 4s versus 8s:

$permissions = Get-EXOMailbox -Filter {RecipientTypeDetails -eq 'UserMailBox'} -PropertySets Minimum -ResultSize unlimited | Get-EXOMailboxPermission -verbose:$false $permissions = Get-EXOMailbox -Filter {RecipientTypeDetails -eq 'UserMailBox'} -PropertySets Minimum -ResultSize unlimited | Get-MailboxPermission -verbose:$false

So taken in the round, seems to me that it could be the other elements involved in your original codes that led the slowness.

Jesus Chao 141 Reputation points

2023-05-04T12:22:30.2766667+00:00

Just to be clear - if you ran into the same performance running the code I uploaded, I don't know why my original code would make a difference.

But also, if you notice, your code is using a pipe of all of the mailboxes instead of iterating through each one with a foreach. Why would there be a difference using a foreach instead of a pipe. The purpose of using the foreach is to use add-mailboxpermission for any mailbox that is missing a specific account that we have set up. But in my testing, the performance hit happens whether I am using add-maiboxpermission or not. I suppose I could use a variable and gather all the mailbox permission into a variable using the pipeline like you did and then iterating through each line. The issue then becomes how do I distinguish each entry as one user's mailbox? It seems silly to have to use additional logic when a foreach for on each mailbox should work.

If you are experiencing a difference between each one of 12 seconds versus 9 seconds, I would think that means you are seeing the same issue as I when using a foreach statement.

Jesus Chao 141 Reputation points

2023-05-04T12:41:39.2033333+00:00

Just to provide more clarity I have added a snip below. This is only to show you full context. If you remark the Add-MailboxPermission, the performance hit happens. I have included in the snip both the EXO and the non EXO

$mberrors = @() $global:AllUserMailboxInfo = Get-EXOMailbox -Filter {RecipientTypeDetails -eq 'UserMailBox'} -PropertySets Minimum -ResultSize unlimited ForEach ($user in $AllUserMailboxInfo) { #if ((Get-MailboxPermission -Identity $user.userprincipalname -User user@userdomain.com) -eq $null) #takes 50 minutes to complete for 4000 mailboxes If (($user | Get-EXOMailboxPermission -Identity $user.userprincipalname -User user@userdomain.com) -eq $null) #takes 3 hours to complete for 4000 mailboxes { #you can remark all the following and the performance is the same. included for context. Try {$user | Add-MailboxPermission -user test@test.com -AccessRights FullAccess -InheritanceType All -ErrorAction stop -verbose:$false} catch { $mberrors += "Could not add permission on $($user.userprincipalname). Error: $($_.exception.message)" } } }

Yuki Sun-MSFT 40,856 Reputation points

2023-05-08T08:55:35.8133333+00:00

Hi @Jesus Chao ,

Thanks for the clarification. I just tried submitting this into the feedback portal provided at the end of this document and let's see if we can get more information there:
https://github.com/MicrosoftDocs/office-docs-powershell/issues/10816

Yuki Sun-MSFT 40,856 Reputation points

2023-05-11T08:46:33.2066667+00:00

Hi @Jesus Chao ,

Got the suggestion of using the latest Preview version of Exchange Online PowerShell there. But per my test, EXO cmdlets still took much longer in v3.2.0-Preview3... Given this situation and due to the limitation of community support, personally I'd recommend try sending details to exocmdletpreview[at]service[dot]microsoft[dot]com as also mentioned in this document to see if they have any suggestions for this.

Jesus Chao 141 Reputation points

2023-05-12T14:13:59.24+00:00

Thanks Yuki - I have emailed them in the past on other issues but before I emailed them regarding this issue, I wanted to post something to the community to see if anyone else had similar experiences.

If the EXO cmdlet team gives me any feedback, I will post it here.

Thanks,

Rich Matheisen 44,776 Reputation points

2023-05-12T19:01:06.24+00:00

This line is creating and tearing down a pipe for each user, but not using the object in the piped object.

If (($user | Get-EXOMailboxPermission -Identity $user.userprincipalname -User user@userdomain.com) -eq $null) #takes 3 hours to complete for 4000 mailboxes

What are the results if you rewrite it like this:

If (-NOT (Get-EXOMailboxPermission -Identity $user.userprincipalname -User user@userdomain.com))

I'd also rewrite the bit of code you provided to avoid unnecessary pipes and the need to wait for the Get-EXOMailbox to return its results all at once. See if this makes a difference:

$mberrors = @() Get-EXOMailbox -Filter { RecipientTypeDetails -eq 'UserMailBox' } -PropertySets Minimum -ResultSize unlimited | ForEach-Object{ $u = $_.userprincipalname # Necessary for use in "Catch" block, but also used in Add-MailboxPermission just because it avoids another pipe If (-NOT (Get-EXOMailboxPermission -Identity $_.userprincipalname -User user@userdomain.com)){ Try { Add-MailboxPermission -Identity $u -user test@test.com -AccessRights FullAccess -InheritanceType All -ErrorAction stop -verbose:$false } catch { $mberrors += "Could not add permission on UPN '$u'. Error: $($_.exception.message)" } } }

Jesus Chao 141 Reputation points

2023-05-12T19:35:12.9666667+00:00

I kinda see what you are doing here but I guess I am not great enough in powershell to know if iterating through output results in the pipeline as opposed to using a variable and iterating through the variable would make a difference. Also I have tried to foreach WITHOUT the $user pipe and issuing the command using $user.userprincipalname directly into the Get-EXOMailboxPermission -identity and came up with the same performance results. I have not tried it though in pipeline one-liner like you stated here.

Just to be clear - the variable we feed the Get-EXOMailbox output to get all the mailbox happens way before this line of code. We actually do other commands to all mailboxes before we get to the Get-EXOMailboxPermission portion of the code occurs. So running this in a single pipeline means we are going back to the well twice which I would think would be a waste.

Rich Matheisen 44,776 Reputation points

2023-05-13T02:15:11.3366667+00:00

Using a "ForEach (<expression>)" doesn't create a pipe. It's your use of the $user variable that you're piping into the Get-EXOMailboxPermission that does that . . . for every one of the 4000 users.

It isn't clear in the code you posted that the array was created "long before" anything. It's the 1st line of code in your example.

If you want to see how long a piece of code takes to run, try running this:

$user = [PSCustomObject]@{userprincipalname = 'place UPN here'} $iterations = 1..100 $GetMbxPermWithPipe = Measure-Command { ForEach ($u in $iterations){ if (($user | Get-MailboxPermission -Identity $user.userprincipalname -User user@userdomain.com) -eq $null){} } } $GetMbxPermWithoutPipe = Measure-Command { ForEach ($u in $iterations){ if ((Get-MailboxPermission -Identity $user.userprincipalname -User user@userdomain.com) -eq $null){} } } $GetExoMbxPermWithPipe = Measure-Command { ForEach ($u in $iterations){ If (($user | Get-EXOMailboxPermission -Identity $user.userprincipalname -User user@userdomain.com) -eq $null){} } } $GetExoMbxPermWithoutPipe = Measure-Command { ForEach ($u in $iterations){ If ((Get-EXOMailboxPermission -Identity $user.userprincipalname -User user@userdomain.com) -eq $null){} } }

Divide the time for each script block by 100 to get the average execution time for each. Then add the time for the two script blocks that use a pipe. Do the same for the two that don't use a pipe. Is one total markedly different the other? Note: you may have to increase the number of iterations to get a good result.

Jesus Chao 141 Reputation points

2023-05-13T02:58:37.3633333+00:00

Yes - this is a snippet of code to just display the piece that I am having trouble with. There is no use in me displaying the entire code with bits that are irrelevant to the issue. However, I have to mention it because using a one-line pipe like your post suggests is not an option for me. I have to use a variable and I have to use a for each statement against the array variable. Besides, if there is a performance issue using a variable array and iterating through it with a foreach, I think that’s an issue. I would think you should be able to do that.

To be crystal clear on what I mean by attempting it both ways with the pipe

Method 1 using the $User | method

$mberrors = @() $global:AllUserMailboxInfo = Get-EXOMailbox -Filter {RecipientTypeDetails -eq 'UserMailBox'} -PropertySets Minimum -ResultSize unlimited ForEach ($user in $AllUserMailboxInfo) { #$user | Get-MailboxPermission -User user@userdomain.com #takes 50 minutes to complete for 4000 mailboxes $user | Get-EXOMailboxPermission -User user@userdomain.com #takes 3 hours to complete for 4000 mailboxes }

Method 2 using the direct iteration in the foreach loop and using the identity parameter.

$mberrors = @() $global:AllUserMailboxInfo = Get-EXOMailbox -Filter {RecipientTypeDetails -eq 'UserMailBox'} -PropertySets Minimum -ResultSize unlimited ForEach ($user in $AllUserMailboxInfo) { #Get-MailboxPermission -Identity $user.userprincipalname -User user@userdomain.com #takes 50 minutes to complete for 4000 mailboxes Get-EXOMailboxPermission -Identity $user.userprincipalname -User user@userdomain.com #takes 3 hours to complete for 4000 mailboxes }

Both of these methods in my testing results in the same performance result.

50 min with the Get-mailboxpermission

3 hrs with the get-exomailboxpermission.

In your example, you are asking me to use a foreach on the Get-EXOMailbox results pipeline instead of using a variable array. I am saying that it is not option on how my entire code works. More importantly, why wouldn't you be able to use a variable array and foreach that array?

Yuki has been able to duplicate this issue with only 50 mailboxes.

Have you been able to test this yourself?

Yuki Sun-MSFT 40,856 Reputation points

2023-05-15T06:40:42.7133333+00:00

If the EXO cmdlet team gives me any feedback, I will post it here.

Thanks @Jesus Chao in advance for keeping us posted : ) Meanwhile, you can keep this thread open so that community users can also join the discussion and share insights here.
Sign in to comment