Managing Exchange Mailbox Permissions: Export and Import Scripts

The Problem

Managing mailbox permissions in on-premises Exchange environments can be challenging, especially when:

• Migrating to a new Exchange server
• Performing disaster recovery operations
• Auditing current permission structures
• Documenting compliance requirements
• Replicating permission structures across environments

Exchange Server stores three critical types of mailbox permissions that need to be preserved:

• Full Access – Complete access to another user’s mailbox
• Send As – Ability to send emails as another user
• Send On Behalf – Ability to send emails on behalf of another user

The Solution

I’ve developed two PowerShell scripts that work together to solve this problem comprehensively:

How It Works

Step 1: Exporting Permissions

The export script connects to your Exchange server and systematically reads all mailbox permissions. It filters out inherited and system permissions to focus only on explicitly granted access rights.

# Run on your source Exchange server
.\Export-MailboxPermissions.ps1

# Or specify a custom output location
.\Export-MailboxPermissions.ps1 -OutputPath "C:\ExchangeBackup"

Step 2: Reviewing the Export

Before importing, open the HTML report to review what permissions exist. The report includes:

• Total permission count and breakdown by type
• Sortable table showing mailbox, trusted user, and permission type
• Visual indicators for different permission types
• Easy-to-read format for auditing and compliance

Step 3: Testing the Import

Before making any changes to your target Exchange server, use the -WhatIf parameter to preview what will happen:

# Test the import without making changes
.\Import-MailboxPermissions.ps1 -CsvPath "C:\Export\MailboxPermissions_20250113_120000.csv" -WhatIf

Step 4: Importing Permissions

Once you’ve verified the import plan, run the script without -WhatIf to apply the permissions:

# Import permissions to the target Exchange server
.\Import-MailboxPermissions.ps1 -CsvPath "C:\Export\MailboxPermissions_20250113_120000.csv"

The import script intelligently handles various scenarios:

• Validation: Checks if mailboxes and users exist before applying permissions
• Duplicate Detection: Skips permissions that already exist
• Error Handling: Continues processing even if individual permissions fail
• Detailed Logging: Records success, failure, and skip status for every permission

Key Features

Export Script Features

• Processes all mailboxes in your organization automatically
• Filters out inherited and system permissions for cleaner data
• Real-time progress indicator during processing
• Dual output: CSV for importing, HTML for human review
• Comprehensive error handling and logging
• Timestamped files prevent accidental overwrites

Import Script Features

• Pre-import validation of mailboxes and users
• WhatIf mode for safe testing
• Interactive HTML report with filtering capabilities
• Color-coded status indicators (success, failed, skipped)
• Detailed error messages for troubleshooting
• Progress tracking during import operations
• Automatic duplicate detection

The HTML Reports

Both scripts generate beautiful, professional HTML reports that make it easy to understand what happened:

Export Report

The export report provides a complete overview of your permission structure with summary statistics and a sortable table of all permissions. Each permission type is color-coded for quick identification.

Import Report

The import report is interactive, allowing you to filter results by status:

• Show All: Complete list of all import operations
• Success Only: Filter to see what was successfully applied
• Failed Only: Quickly identify and troubleshoot failures
• Skipped Only: See which permissions already existed

Real-World Use Cases

1. Exchange Server Migration

When migrating from Exchange 2016 to Exchange 2019, export permissions from the old server, migrate mailboxes, then import permissions to the new server. The scripts ensure no permissions are lost during migration.

2. Disaster Recovery

Regular exports serve as backups of your permission structure. If you need to rebuild your Exchange environment, you can quickly restore all permissions from your latest export.

3. Compliance Auditing

Generate monthly HTML reports to document who has access to sensitive mailboxes. The reports provide clear evidence for compliance requirements like SOX, HIPAA, or GDPR.

4. Development/Test Environments

Clone your production permission structure to test environments to ensure accurate testing scenarios without manually recreating complex permission relationships.

Best Practices

Troubleshooting Common Issues

Mailbox Not Found Errors

If you see “Mailbox not found” errors during import, ensure the mailbox exists on the target server before importing permissions. The import script validates existence but cannot create mailboxes.

Trusted User Not Found

The user being granted permissions must exist on the destination server. Create user accounts before importing their permission grants.

Access Denied

Ensure you’re running the scripts with Exchange Organization Management or equivalent permissions. The scripts require elevated privileges to read and modify mailbox permissions.

Permission Already Exists

This is normal behavior – the script skips permissions that already exist to prevent errors. Check the “Skipped” section of the HTML report to see these entries.

Security Considerations

When working with mailbox permissions, security is paramount:

• Store CSV exports securely – they contain sensitive organizational information
• Limit access to the scripts and exports to authorized administrators only
• Review permissions before importing to prevent unauthorized access
• Use WhatIf mode to verify changes before applying them
• Maintain audit logs of all permission changes
• Regularly review and clean up unnecessary permissions

GitHub - MSB365/ExchangeHelpers

Contribute to MSB365/ExchangeHelpers development by creating an account on GitHub.