Validate calendar permissions in Exchange Online

Validate calendar folder permissions separately from mailbox-level permissions. This process helps you confirm the assigned role, identify delegate flags, and distinguish calendar access from Full Access.

Prerequisites

Before you begin:

  • Open an Exchange Online PowerShell session.
  • Use an account that has permission to read mailbox and mailbox-folder permissions.
  • Identify the calendar owner's primary SMTP address.
  • Identify the user whose access you want to validate, if the review concerns one user.

The examples use these variables:

$CalendarOwner = "owner@contoso.com"
$User = "user@contoso.com"

Review the calendar access control list

Use Get-MailboxFolderPermission to return the calendar access control list:

Get-MailboxFolderPermission -Identity "${CalendarOwner}:\Calendar" |
    Format-Table User, AccessRights, SharingPermissionFlags

Confirm the following values:

  • Default is present. Its typical role is AvailabilityOnly.
  • Anonymous is present. Its typical role is None.
  • Each explicitly granted user has the intended AccessRights.
  • A complete Outlook delegate entry has Editor access and includes Delegate in SharingPermissionFlags.
  • CanViewPrivateItems appears only when the user is intended to view private calendar items.

To return one user's entry, run:

Get-MailboxFolderPermission -Identity "${CalendarOwner}:\Calendar" -User $User

Review identity details

Return additional identity properties when you need to determine whether a permission entry still maps to a directory recipient:

$Permissions = Get-MailboxFolderPermission -Identity "${CalendarOwner}:\Calendar"

$Permissions | Select-Object `
    @{Name = "DisplayName"; Expression = { $_.User.DisplayName }},
    @{Name = "PrimarySmtpAddress"; Expression = { $_.User.RecipientPrincipal.PrimarySmtpAddress }},
    @{Name = "UserType"; Expression = { $_.User.UserType }},
    @{Name = "IsGroup"; Expression = { $_.User.RecipientPrincipal.IsGroup }},
    AccessRights,
    SharingPermissionFlags |
    Format-Table -AutoSize

Interpret the output as follows:

  • UserType: Internal and IsGroup: False identifies a standard internal user entry.
  • UserType: External identifies a recipient whose access is associated with external calendar sharing.
  • UserType: Unknown or a missing recipient principal can indicate that the directory object no longer resolves.
  • IsGroup: True identifies a group entry. Don't use a group as an Outlook delegate; assign delegate access to individual users.
  • A list of individual rights instead of a named role indicates a granular permission assignment.

This validation identifies the state of the entry. Use supported permission administration or Outlook delegate configuration to make intentional changes.

Review mailbox-level Full Access

Use Get-MailboxPermission to review mailbox-level access:

Get-MailboxPermission -Identity $CalendarOwner |
    Format-Table User, AccessRights, IsInherited, Deny

Look for directly assigned FullAccess entries that affect the user you are validating. Inherited entries for Exchange and Windows system identities are expected.

Full Access and calendar folder permissions serve different purposes. The presence or absence of Full Access doesn't replace the calendar role shown by the folder permission command.

Record the validation result

Record these values for the reviewed user:

  • Calendar owner.
  • Permission identity.
  • Named role or granular rights.
  • SharingPermissionFlags.
  • User type and group status.
  • Direct mailbox-level Full Access, if present.

Compare the recorded values with the intended access before you make a change.

Related content

  • Last updated on