Automate Exchange Online Calendar Permissions with PowerShell

Introduction to automated calendar permissions management

Manual management of calendar permissions in Exchange Online represents a recurring challenge for Microsoft 365 administrators. Executive assistants, technical support teams and project coordinators regularly require specialized access to their colleagues' calendars.

PowerShell is the preferred solution for automating these repetitive tasks. This approach ensures standardization of access, a significant reduction in human errors and scalability adapted to enterprise environments.

Automation Advantage

PowerShell automation of calendar permissions reduces the time required for manual configuration by 85% according to our field observations.

Architecture of Exchange Online calendar permissions

Each Exchange Online mailbox has a hierarchical structure where the Calendar folder is a distinct container with its own ACLs (Access Control Lists).

⚡PowerShell

1Mailbox-UserPrincipalName
2└── Calendar (or localized: Calendrier/Kalender)
3    ├── Default (Anonymous)
4    ├── Reviewer (ReadItems)
5    ├── Editor (ReadItems + CreateItems + EditOwnedItems)
6    ├── Owner (FullAccess)
7    └── Delegate (SendOnBehalfOf + Meeting Management)

Available permission levels

Role	Permissions	Typical Use Case
Reviewer	Read-only access to events	Team schedule consultation
Editor	Read + create + modify	Collaborative agenda management
Owner	Full control + permission management	Complete delegation
Delegate	Manage invitations + SendOnBehalfOf	Executive assistant

Essential PowerShell cmdlets for Exchange Online

Administration of calendar permissions relies on four fundamental cmdlets from the ExchangeOnlineManagement module:

Add-MailboxFolderPermission : Initial permission assignment
Set-MailboxFolderPermission : Modify existing permissions
Get-MailboxFolderPermission : Audit and verify access
Remove-MailboxFolderPermission : Revoke permissions

Technical Prerequisites

ExchangeOnlineManagement module v3.0 minimum is required. The *-PSSession cmdlets have been deprecated since October 2022.

Initial configuration and Exchange Online connection

PowerShell module installation

Install the official Microsoft module from PowerShell Gallery:

⚡PowerShell

1Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

Connection with modern authentication

Establish a secure connection to Exchange Online:

⚡PowerShell

1Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

Verify connectivity

Validate the active connection with a test command:

⚡PowerShell

1Get-Mailbox -ResultSize 1 | Select-Object DisplayName, PrimarySmtpAddress

Practical scripts for calendar delegation

Complete delegation script

This script configures Delegate access with Editor permissions for complete calendar management:

⚡PowerShell

1# Variable configuration
2$CalendarOwner = "director@contoso.com"
3$DelegateUser = "assistant@contoso.com"
4$NotifyUser = $true
5 
6# Grant Delegate permissions
7try {
8    Add-MailboxFolderPermission `
9        -Identity "$CalendarOwner:\Calendar" `
10        -User $DelegateUser `
11        -AccessRights Editor `
12        -SharingPermissionFlags Delegate `
13        -SendNotificationToUser $NotifyUser
14    
15    Write-Host "✓ Permissions granted successfully" -ForegroundColor Green
16} catch {
17    Write-Error "Error granting permissions: $_"
18}

Bulk management via CSV

To process multiple delegations simultaneously:

⚡PowerShell

1# Import CSV file (Owner,Delegate,AccessLevel)
2$DelegationList = Import-Csv -Path "C:\Delegations.csv"
3 
4foreach ($Item in $DelegationList) {
5    try {
6        # Verify user existence
7        $OwnerExists = Get-Mailbox -Identity $Item.Owner -ErrorAction SilentlyContinue
8        $DelegateExists = Get-Mailbox -Identity $Item.Delegate -ErrorAction SilentlyContinue
9        
10        if ($OwnerExists -and $DelegateExists) {
11            Add-MailboxFolderPermission `
12                -Identity "$($Item.Owner):\Calendar" `
13                -User $Item.Delegate `
14                -AccessRights $Item.AccessLevel `
15                -ErrorAction Stop
16                
17            Write-Host "✓ $($Item.Owner) → $($Item.Delegate)" -ForegroundColor Green
18        }
19    } catch {
20        Write-Warning "Failed for $($Item.Owner): $_"
21    }
22}

Audit and verification of existing permissions

Complete audit script

⚡PowerShell

1function Get-CalendarPermissionsReport {
2    param(
3        [Parameter(Mandatory=$true)]
4        [string]$UserPrincipalName
5    )
6    
7    try {
8        $Permissions = Get-MailboxFolderPermission -Identity "$UserPrincipalName:\Calendar"
9        
10        $Report = $Permissions | Where-Object { $_.User -ne "Default" -and $_.User -ne "Anonymous" } |
11                 Select-Object @{
12                     Name = "CalendarOwner"
13                     Expression = { $UserPrincipalName }
14                 },
15                 @{
16                     Name = "DelegateUser" 
17                     Expression = { $_.User }
18                 },
19                 AccessRights,
20                 SharingPermissionFlags
21                 
22        return $Report
23    } catch {
24        Write-Error "Cannot access calendar for $UserPrincipalName : $_"
25    }
26}
27 
28# Usage
29$Report = Get-CalendarPermissionsReport -UserPrincipalName "director@contoso.com"
30$Report | Format-Table -AutoSize

Performance Optimization

For environments with more than 1000 mailboxes, use the -ResultSize parameter and implement batch processing logic.

Modify and revoke permissions

Update existing permissions

⚡PowerShell

1# Change Reviewer access to Editor
2Set-MailboxFolderPermission `
3    -Identity "director@contoso.com:\Calendar" `
4    -User "assistant@contoso.com" `
5    -AccessRights Editor

Complete revocation of access

⚡PowerShell

1# Remove all permissions
2Remove-MailboxFolderPermission `
3    -Identity "director@contoso.com:\Calendar" `
4    -User "former-assistant@contoso.com" `
5    -Confirm:$false

Managing multilingual environments

International organizations must manage calendar folder localization:

⚡PowerShell

1function Get-LocalizedCalendarFolder {
2    param([string]$UserPrincipalName)
3    
4    $PossibleNames = @("Calendar", "Calendrier", "Kalender", "Calendario")
5    
6    foreach ($Name in $PossibleNames) {
7        try {
8            $TestPath = "$UserPrincipalName:\$Name"
9            Get-MailboxFolderPermission -Identity $TestPath -ErrorAction Stop | Out-Null
10            return $Name
11        } catch {
12            continue
13        }
14    }
15    
16    throw "Unable to locate calendar folder for $UserPrincipalName"
17}
18 
19# Usage with automatic detection
20$CalendarFolder = Get-LocalizedCalendarFolder -UserPrincipalName "user@contoso.com"
21Add-MailboxFolderPermission -Identity "user@contoso.com:\$CalendarFolder" -User "delegate@contoso.com" -AccessRights Editor

Administrative best practices

Automatic documentation of changes

Centralized logging

Implement a logging system to track modifications:

⚡PowerShell

1function Write-DelegationLog {
2    param(
3        [string]$Action,
4        [string]$Owner,
5        [string]$Delegate,
6        [string]$AccessLevel
7    )
8    
9    $LogEntry = "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - $Action - Owner: $Owner - Delegate: $Delegate - Level: $AccessLevel"
10    Add-Content -Path "C:\Logs\CalendarDelegation.log" -Value $LogEntry
11}

Prior validation

Always verify account existence before assignment:

⚡PowerShell

1$OwnerMailbox = Get-Mailbox -Identity $Owner -ErrorAction SilentlyContinue
2if (-not $OwnerMailbox) {
3    throw "Owner account not found: $Owner"
4}

Error handling

Use systematic try-catch blocks with explicit messages to facilitate troubleshooting.

Security and compliance

Security Considerations

Delegate permissions grant extended privileges including SendOnBehalfOf. Systematically document these assignments for compliance audits.

Advanced use cases

Temporary delegation with expiration

⚡PowerShell

1function Set-TemporaryCalendarAccess {
2    param(
3        [string]$Owner,
4        [string]$Delegate,
5        [datetime]$ExpirationDate
6    )
7    
8    # Initial assignment
9    Add-MailboxFolderPermission -Identity "$Owner:\Calendar" -User $Delegate -AccessRights Editor
10    
11    # Schedule revocation via scheduled task
12    $TaskAction = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument "-Command Remove-MailboxFolderPermission -Identity '$Owner:\Calendar' -User '$Delegate' -Confirm:$false"
13    $TaskTrigger = New-ScheduledTaskTrigger -Once -At $ExpirationDate
14    
15    Register-ScheduledTask -TaskName "RevokeDelegation_$($Owner)_$($Delegate)" -Action $TaskAction -Trigger $TaskTrigger
16}

Automatic hierarchical delegation

⚡PowerShell

1# Assignment based on Active Directory organization chart
2$Manager = Get-AzureADUser -ObjectId "director@contoso.com"
3$DirectReports = Get-AzureADUserDirectReport -ObjectId $Manager.ObjectId
4 
5foreach ($Report in $DirectReports) {
6    Add-MailboxFolderPermission `
7        -Identity "$($Manager.UserPrincipalName):\Calendar" `
8        -User $Report.UserPrincipalName `
9        -AccessRights Reviewer
10}

Technical glossary

ACL (Access Control List) : List of permissions defining access to resources
Delegate : Specialized role allowing invitation management and sending on behalf of
SendOnBehalfOf : Permission to send messages on behalf of another user
SharingPermissionFlags : Metadata defining the sharing type (Delegate, Calendar, Contact)
UserPrincipalName (UPN) : Unique identifier in user@domain.com format
ExchangeOnlineManagement : Official PowerShell module for Exchange Online administration

Links and official resources

Introduction to automated calendar permissions management

Automation Advantage

PowerShell automation of calendar permissions reduces the time required for manual configuration by 85% according to our field observations.

Architecture of Exchange Online calendar permissions

Each Exchange Online mailbox has a hierarchical structure where the Calendar folder is a distinct container with its own ACLs (Access Control Lists).

⚡PowerShell

1Mailbox-UserPrincipalName
2└── Calendar (or localized: Calendrier/Kalender)
3    ├── Default (Anonymous)
4    ├── Reviewer (ReadItems)
5    ├── Editor (ReadItems + CreateItems + EditOwnedItems)
6    ├── Owner (FullAccess)
7    └── Delegate (SendOnBehalfOf + Meeting Management)

Available permission levels

Role	Permissions	Typical Use Case
Reviewer	Read-only access to events	Team schedule consultation
Editor	Read + create + modify	Collaborative agenda management
Owner	Full control + permission management	Complete delegation
Delegate	Manage invitations + SendOnBehalfOf	Executive assistant

Essential PowerShell cmdlets for Exchange Online

Administration of calendar permissions relies on four fundamental cmdlets from the ExchangeOnlineManagement module:

Add-MailboxFolderPermission : Initial permission assignment
Set-MailboxFolderPermission : Modify existing permissions
Get-MailboxFolderPermission : Audit and verify access
Remove-MailboxFolderPermission : Revoke permissions

Technical Prerequisites

ExchangeOnlineManagement module v3.0 minimum is required. The *-PSSession cmdlets have been deprecated since October 2022.

Initial configuration and Exchange Online connection

PowerShell module installation

Install the official Microsoft module from PowerShell Gallery:

⚡PowerShell

1Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

Connection with modern authentication

Establish a secure connection to Exchange Online:

⚡PowerShell

1Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

Verify connectivity

Validate the active connection with a test command:

⚡PowerShell

1Get-Mailbox -ResultSize 1 | Select-Object DisplayName, PrimarySmtpAddress

Practical scripts for calendar delegation

Complete delegation script

This script configures Delegate access with Editor permissions for complete calendar management:

⚡PowerShell

1# Variable configuration
2$CalendarOwner = "director@contoso.com"
3$DelegateUser = "assistant@contoso.com"
4$NotifyUser = $true
5 
6# Grant Delegate permissions
7try {
8    Add-MailboxFolderPermission `
9        -Identity "$CalendarOwner:\Calendar" `
10        -User $DelegateUser `
11        -AccessRights Editor `
12        -SharingPermissionFlags Delegate `
13        -SendNotificationToUser $NotifyUser
14    
15    Write-Host "✓ Permissions granted successfully" -ForegroundColor Green
16} catch {
17    Write-Error "Error granting permissions: $_"
18}

Bulk management via CSV

To process multiple delegations simultaneously:

⚡PowerShell

1# Import CSV file (Owner,Delegate,AccessLevel)
2$DelegationList = Import-Csv -Path "C:\Delegations.csv"
3 
4foreach ($Item in $DelegationList) {
5    try {
6        # Verify user existence
7        $OwnerExists = Get-Mailbox -Identity $Item.Owner -ErrorAction SilentlyContinue
8        $DelegateExists = Get-Mailbox -Identity $Item.Delegate -ErrorAction SilentlyContinue
9        
10        if ($OwnerExists -and $DelegateExists) {
11            Add-MailboxFolderPermission `
12                -Identity "$($Item.Owner):\Calendar" `
13                -User $Item.Delegate `
14                -AccessRights $Item.AccessLevel `
15                -ErrorAction Stop
16                
17            Write-Host "✓ $($Item.Owner) → $($Item.Delegate)" -ForegroundColor Green
18        }
19    } catch {
20        Write-Warning "Failed for $($Item.Owner): $_"
21    }
22}

Audit and verification of existing permissions

Complete audit script

⚡PowerShell

1function Get-CalendarPermissionsReport {
2    param(
3        [Parameter(Mandatory=$true)]
4        [string]$UserPrincipalName
5    )
6    
7    try {
8        $Permissions = Get-MailboxFolderPermission -Identity "$UserPrincipalName:\Calendar"
9        
10        $Report = $Permissions | Where-Object { $_.User -ne "Default" -and $_.User -ne "Anonymous" } |
11                 Select-Object @{
12                     Name = "CalendarOwner"
13                     Expression = { $UserPrincipalName }
14                 },
15                 @{
16                     Name = "DelegateUser" 
17                     Expression = { $_.User }
18                 },
19                 AccessRights,
20                 SharingPermissionFlags
21                 
22        return $Report
23    } catch {
24        Write-Error "Cannot access calendar for $UserPrincipalName : $_"
25    }
26}
27 
28# Usage
29$Report = Get-CalendarPermissionsReport -UserPrincipalName "director@contoso.com"
30$Report | Format-Table -AutoSize

Performance Optimization

For environments with more than 1000 mailboxes, use the -ResultSize parameter and implement batch processing logic.

Modify and revoke permissions

Update existing permissions

⚡PowerShell

1# Change Reviewer access to Editor
2Set-MailboxFolderPermission `
3    -Identity "director@contoso.com:\Calendar" `
4    -User "assistant@contoso.com" `
5    -AccessRights Editor

Complete revocation of access

⚡PowerShell

1# Remove all permissions
2Remove-MailboxFolderPermission `
3    -Identity "director@contoso.com:\Calendar" `
4    -User "former-assistant@contoso.com" `
5    -Confirm:$false

Managing multilingual environments

International organizations must manage calendar folder localization:

⚡PowerShell

1function Get-LocalizedCalendarFolder {
2    param([string]$UserPrincipalName)
3    
4    $PossibleNames = @("Calendar", "Calendrier", "Kalender", "Calendario")
5    
6    foreach ($Name in $PossibleNames) {
7        try {
8            $TestPath = "$UserPrincipalName:\$Name"
9            Get-MailboxFolderPermission -Identity $TestPath -ErrorAction Stop | Out-Null
10            return $Name
11        } catch {
12            continue
13        }
14    }
15    
16    throw "Unable to locate calendar folder for $UserPrincipalName"
17}
18 
19# Usage with automatic detection
20$CalendarFolder = Get-LocalizedCalendarFolder -UserPrincipalName "user@contoso.com"
21Add-MailboxFolderPermission -Identity "user@contoso.com:\$CalendarFolder" -User "delegate@contoso.com" -AccessRights Editor

Administrative best practices

Automatic documentation of changes

Centralized logging

Implement a logging system to track modifications:

⚡PowerShell

1function Write-DelegationLog {
2    param(
3        [string]$Action,
4        [string]$Owner,
5        [string]$Delegate,
6        [string]$AccessLevel
7    )
8    
9    $LogEntry = "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - $Action - Owner: $Owner - Delegate: $Delegate - Level: $AccessLevel"
10    Add-Content -Path "C:\Logs\CalendarDelegation.log" -Value $LogEntry
11}

Prior validation

Always verify account existence before assignment:

⚡PowerShell

1$OwnerMailbox = Get-Mailbox -Identity $Owner -ErrorAction SilentlyContinue
2if (-not $OwnerMailbox) {
3    throw "Owner account not found: $Owner"
4}

Error handling

Use systematic try-catch blocks with explicit messages to facilitate troubleshooting.

1function Set-TemporaryCalendarAccess {
2    param(
3        [string]$Owner,
4        [string]$Delegate,
5        [datetime]$ExpirationDate
6    )
7    
8    # Initial assignment
9    Add-MailboxFolderPermission -Identity "$Owner:\Calendar" -User $Delegate -AccessRights Editor
10    
11    # Schedule revocation via scheduled task
12    $TaskAction = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument "-Command Remove-MailboxFolderPermission -Identity '$Owner:\Calendar' -User '$Delegate' -Confirm:$false"
13    $TaskTrigger = New-ScheduledTaskTrigger -Once -At $ExpirationDate
14    
15    Register-ScheduledTask -TaskName "RevokeDelegation_$($Owner)_$($Delegate)" -Action $TaskAction -Trigger $TaskTrigger
16}

Automatic hierarchical delegation

⚡PowerShell

1# Assignment based on Active Directory organization chart
2$Manager = Get-AzureADUser -ObjectId "director@contoso.com"
3$DirectReports = Get-AzureADUserDirectReport -ObjectId $Manager.ObjectId
4 
5foreach ($Report in $DirectReports) {
6    Add-MailboxFolderPermission `
7        -Identity "$($Manager.UserPrincipalName):\Calendar" `
8        -User $Report.UserPrincipalName `
9        -AccessRights Reviewer
10}

Technical glossary

ACL (Access Control List) : List of permissions defining access to resources
Delegate : Specialized role allowing invitation management and sending on behalf of
SendOnBehalfOf : Permission to send messages on behalf of another user
SharingPermissionFlags : Metadata defining the sharing type (Delegate, Calendar, Contact)
UserPrincipalName (UPN) : Unique identifier in user@domain.com format
ExchangeOnlineManagement : Official PowerShell module for Exchange Online administration

Automate Exchange Online Calendar Permissions with PowerShell

PowerShell module installation

Connection with modern authentication

Verify connectivity

Centralized logging

Prior validation

Error handling

Houssem MAKHLOUF

Related articles

New Microsoft 365 Security Adoption Model

Agents: Transforming Work with AI in Microsoft 365

Audit and Manage AI Applications with PowerShell

Automate Exchange Online Calendar Permissions with PowerShell

PowerShell module installation

Connection with modern authentication

Verify connectivity

Centralized logging

Prior validation

Error handling

Houssem MAKHLOUF

Related articles

New Microsoft 365 Security Adoption Model

Agents: Transforming Work with AI in Microsoft 365

Audit and Manage AI Applications with PowerShell