Alternative ways to retrieve shared mailbox users and permissions programmatically

aryane sadh 20 Reputation points
2026-10-15T10:46:38.2366667+00:00

I am trying to build a backend tool that can display the users who have access to a shared mailbox, along with their respective permissions (e.g., Full Access, Send As, and Send on Behalf).

I understand that Exchange Online PowerShell provides cmdlets such as Get-MailboxPermission and Get-RecipientPermission to retrieve these details. However, I would like to explore alternatives to running PowerShell commands from my backend.

Are there any other approaches available to achieve this requirement, such as using an SDK, Python libraries, Exchange APIs, or other programmatic methods?

I am open to exploring any suitable solution, including Microsoft-supported APIs or third-party libraries. Ideally, the approach should allow me to retrieve mailbox access permissions reliably and integrate them into a backend application without depending on PowerShell cmdlets.

Has anyone implemented something similar or found a practical alternative? Any suggestions or recommendations would be appreciated.

Exchange Online
Exchange Online

A cloud-based service included in Microsoft 365, delivering scalable messaging and collaboration features with simplified management and automatic updates.

0 comments
Answer accepted by question author
Kristen Tran 2,445 Reputation points Independent Advisor
2026-10-15T11:37:09.7933333+00:00

Hi Aryane,

After reviewing the available options, it appears that there is currently no generally available API in Microsoft Graph that can retrieve all shared mailbox delegation permissions (Full Access, Send As, and Send on Behalf) in the same way as the corresponding Exchange Online PowerShell cmdlets. Graph does not currently provide a method to query which mailboxes a user has been granted access to.

For a complete and reliable inventory of shared mailbox permissions, the Microsoft-supported approach remains:

  • Get-MailboxPermission for Full Access
  • Get-RecipientPermission for Send As
  • Mailbox delegation properties (such as GrantSendOnBehalfTo) for Send on Behalf

For your reference: Manage permissions for recipients in Exchange Online

If your goal is to avoid executing PowerShell directly from your application, one practical approach would be to create a background service or scheduled process that authenticates to Exchange Online, collects the required permission data, stores it in a database, and then exposes the results through your application's own API. This keeps PowerShell isolated from your frontend or request-processing layer while still using the supported Exchange management interface.

Microsoft has also introduced the Exchange Online Admin API, a REST-based administrative API that supports selected mailbox delegation and permission-related scenarios. However, this API is currently in Preview, is not available in all organizations, and does not provide the full Exchange administration surface available through Exchange Online PowerShell.

For more ìnormation: Authentication and authorization

Therefore, if your requirement is to reliably retrieve and report all three permission types for shared mailboxes, Exchange Online PowerShell remains the most complete and supported solution at this time. You may use Microsoft Graph to enrich the results with user or directory information, but not as the primary source for mailbox delegation permissions.

I hope this helps clarify the available options. If you have any further questions or need additional clarification, please feel free to let me know. I’ll be happy to help.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.