A user has access to several calendars that were shared directly with them or made available through shared mailboxes, but we need to identify the owners of those calendars. There doesn't seem to be a Microsoft 365 admin interface that performs this kind of reverse lookup. Running Get-EXOMailboxFolderPermission against the user's own mailbox only shows calendars they own, and the tenant contains around 100 mailboxes. Is there a practical way to search all mailboxes and determine which calendars grant permissions to this user?
3 Answers
For future administration, use security groups for shared calendar permissions instead of assigning users directly. Create groups for each shared resource and access level, assign the calendar permissions to those groups, and manage membership through the groups. Then the user’s effective access is much easier to review, and periodic audits can find any direct assignments that remain.
Calendar permissions are stored on the owner’s mailbox, so there isn’t really a direct reverse lookup from the user. You’ll need to loop through each mailbox, query its Calendar folder permissions, and filter for the target user. For example, enumerate the mailboxes with Get-Mailbox and run Get-EXOMailboxFolderPermission against each calendar. It may take a while across 100 mailboxes, but it should identify the calendars where that user is listed.
If this user was deleted and recreated, check whether that might be causing the problem. The old account and the replacement account can have different object IDs, even if they use the same name or address. Permissions assigned to the original identity may remain behind and make the new account appear to have access when it actually does not. Cleaning up that situation can be tedious.
That’s the approach I’d use too. It’s straightforward to script; the main drawback is the time needed to check every mailbox.