PowerShell Exchange Online: Bulk Manage Shared Mailboxes
─□✕

PowerShell Exchange Online: Bulk Manage Shared Mailboxes

PowerShell Tips Editor 5 min read
PowerShell Exchange Online: Bulk Manage Shared Mailboxes

Shared mailboxes are the workhorse of team email — support queues, department inboxes, role addresses like invoices@ or noreply@. In a tenant with hundreds of them, managing permissions through the Exchange Admin Center is painfully slow and produces no audit trail. The Exchange Online PowerShell v3 module gives you everything you need to create, convert, permission, and report on shared mailboxes at scale. This guide covers every shared mailbox operation you are likely to need in an enterprise environment.

Connecting to Exchange Online PowerShell v3 Module

The legacy Basic Auth-based EXO connection method is gone. The v3 module (ExchangeOnlineManagement version 3.x) uses modern authentication exclusively. Install or update the module before proceeding, then connect with Connect-ExchangeOnline. For unattended scripts use certificate-based app-only authentication with an app registration that has Exchange.ManageAsApp and the Exchange Administrator role.

# Install or update the EXO v3 module
Install-Module ExchangeOnlineManagement -Scope CurrentUser -Force

# Interactive connection (for admin sessions)
Connect-ExchangeOnline -UserPrincipalName [email protected]

# Certificate-based for automation
Connect-ExchangeOnline -AppId $appId `
                       -CertificateThumbprint $certThumb `
                       -Organization 'contoso.onmicrosoft.com'

# Confirm connection
Get-ConnectionInformation | Select-Object State, UserPrincipalName, TokenExpiryTime

Creating New Shared Mailboxes with New-Mailbox

Use New-Mailbox -Shared to create a shared mailbox directly. A shared mailbox does not consume a license in Exchange Online (unless it exceeds 50 GB, in which case an Exchange Online Plan 2 license is needed). Always set the -DisplayName, -Name (the friendly name in AD), and -PrimarySmtpAddress together to avoid auto-generated addresses that are hard to clean up later.

# Create a single shared mailbox
New-Mailbox -Shared `
            -Name 'Support Team' `
            -DisplayName 'Support Team' `
            -PrimarySmtpAddress '[email protected]' `
            -Alias 'support'

# Bulk create from CSV: columns Name,DisplayName,Smtp,Alias
Import-Csv .\shared-mailboxes.csv | ForEach-Object {
    New-Mailbox -Shared `
                -Name $_.Name `
                -DisplayName $_.DisplayName `
                -PrimarySmtpAddress $_.Smtp `
                -Alias $_.Alias `
                -ErrorAction Stop
    Write-Host "Created: $($_.Smtp)"
}

Granting Full Access and Send As Permissions

Full Access lets a user open and read the mailbox. Send As lets a user send email that appears to come from the shared mailbox address. These are separate permissions set with separate cmdlets. The -AutoMapping $false flag on Add-MailboxPermission prevents Outlook from automatically mounting the shared mailbox — useful when you want users to add it manually or access it via OWA only.

# Grant Full Access without auto-mapping
Add-MailboxPermission -Identity '[email protected]' `
                      -User '[email protected]' `
                      -AccessRights FullAccess `
                      -AutoMapping $false `
                      -ErrorAction Stop

# Grant Send As
Add-RecipientPermission -Identity '[email protected]' `
                        -Trustee '[email protected]' `
                        -AccessRights SendAs `
                        -Confirm:$false `
                        -ErrorAction Stop

# Grant both to a whole group from CSV
Import-Csv .\support-members.csv | ForEach-Object {
    Add-MailboxPermission -Identity '[email protected]' -User $_.UPN -AccessRights FullAccess -AutoMapping $false
    Add-RecipientPermission -Identity '[email protected]' -Trustee $_.UPN -AccessRights SendAs -Confirm:$false
}

Converting User Mailboxes to Shared

When an employee leaves, converting their mailbox to shared rather than deleting it preserves email history and allows the manager or team to access it without purchasing an additional license. The conversion is a one-cmdlet operation. After conversion, remove the user’s license in Entra ID — a shared mailbox under 50 GB does not need one.

# Convert a user mailbox to shared
Set-Mailbox -Identity '[email protected]' -Type Shared

# Verify the conversion
Get-Mailbox -Identity '[email protected]' |
    Select-Object DisplayName, RecipientTypeDetails, ProhibitSendReceiveQuota
DisplayName           RecipientTypeDetails  ProhibitSendReceiveQuota
-----------           --------------------  ------------------------
Departed User         SharedMailbox         Unlimited

Auditing All Shared Mailbox Permissions with Get-MailboxPermission

To audit who has access to what across all shared mailboxes, loop through every shared mailbox and collect both Full Access and Send As permissions into a flat list. This report is invaluable for access reviews and offboarding audits.

$sharedMailboxes = Get-Mailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited

$permReport = foreach ($mbx in $sharedMailboxes) {
    # Full Access
    Get-MailboxPermission -Identity $mbx.Identity |
        Where-Object { $_.User -notlike 'NT AUTHORITY\*' -and $_.IsInherited -eq $false } |
        Select-Object @{N='Mailbox';E={$mbx.PrimarySmtpAddress}},
                      @{N='User';E={$_.User}},
                      @{N='Permission';E={'FullAccess'}}

    # Send As
    Get-RecipientPermission -Identity $mbx.Identity |
        Where-Object { $_.Trustee -notlike 'NT AUTHORITY\*' } |
        Select-Object @{N='Mailbox';E={$mbx.PrimarySmtpAddress}},
                      @{N='User';E={$_.Trustee}},
                      @{N='Permission';E={'SendAs'}}
}

$permReport | Export-Csv -Path ".\SharedMailboxPermissions-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

Reporting Shared Mailboxes Consuming a License

Shared mailboxes over 50 GB require an Exchange Online Plan 2 license. Identifying these saves license costs and flags mailboxes that may need archiving enabled to bring them back under the threshold.

Common Errors

  • AutoMapping adds shared mailbox to Outlook automatically — sometimes unwanted. Add-MailboxPermission sets AutoMapping to $true by default. For help-desk or group-access scenarios where you do not want the mailbox appearing in every team member’s Outlook profile automatically, always specify -AutoMapping $false explicitly.
  • Set-MailboxPermission requires waiting for AD sync before taking effect in hybrid. In hybrid Exchange environments, mailbox permission changes written to Exchange Online must sync to the on-premises AD (or vice versa) before they are visible everywhere. If you are scripting a complete onboarding flow, add a check or a reasonable wait after permission changes before testing access.

Related Cmdlets / See Also

Wrapping Up

Every shared mailbox operation you regularly do in the EAC can be scripted — creation, permission grants, user-to-shared conversion, and quarterly permission audits. Establish a baseline permission export, run it monthly, and compare with Compare-Object to detect unauthorized permission changes automatically.

Send-Item -To