PowerApps/Automate get (shared) mailbox permissions

[WesleyE]

Hi all,

I was wondering if it is possible to use PowerApp/PowerAutomate to pull the mailbox permission (FULL/SEND AS) of a shared mailbox?

I am using PowerAutomate to pull the members of a group. I can do so using the Azure AD connector, but how do I pull the permissions of a shared mailbox? What connector do I need? Should I use MS Graph? Should I use PowerAutomate to kick off a custom made PowerShell script?

I don't find much on the internet on what I am trying to do so I hope someone on this forum has experience in this.

I'd like to give our end users (the shared mailbox owner) the ability to export the mailbox permissions of the shared mailbox they own.

What I'd like to achieve is an "export" button in the PowerApp next to the shared mailbox's name. That export button will then pull the FULL/SEND AS Permissions of that shared mailbox and send them an email with all the names of the people that do have access to this shared mailbox.

I am currently doing the same for Distribution Lists. The end user clicks the "export" button and they will receive an email with all the members of that Distribution List.

Now I want to do the same for shared mailbox permissions, so pulling all people that do have FULL mailbox access on a shared mailbox and send that by email to the shared mailbox owner.

[narayan225]

Are you using the permission to send an email?

Or are you using the permission for something else?

If you can clarify what you are trying to achieve, it will be easier to help you out.

[WesleyE]

Apologize my first message wasn't clear enough, I'll modify that message.

I'd like to give our end users (the shared mailbox owner) the ability to export the mailbox permissions of the shared mailbox they own.

What I'd like to achieve is an "export" button in the PowerApp next to the shared mailbox's name. That export button will then pull the FULL/SEND AS Permissions of that shared mailbox and send them an email with all the names of the people that do have access to this shared mailbox.

I am currently doing the same for Distribution Lists. The end user clicks the "export" button and they will receive an email with all the members of that Distribution List.

Now I want to do the same for shared mailbox permissions, so pulling all people that do have FULL mailbox access on a shared mailbox and send that by email to the shared mailbox owner.

[narayan225 · Accepted solution]

This feature is not there at the moment in Power Automate Connectors.

You can leverage Azure Functions and Powershell to get this done.

Poweshell Mailbox Permissions:

https://learn.microsoft.com/en-us/powershell/module/exchange/get-mailboxpermission?view=exchange-ps

Run PowerShell via Azure Function App:

http://johnliu.net/blog/2018/4/run-any-pnp-powershell-in-one-azurefunction-from-microsoft-flow

You can also use Power Automate destop to run the script and get the data, however you will need a premium license and a dedicated host for this.

Cheers!

[WesleyE]

Thanks for sharing that info! I will take a look and see if I can get this to work! 🙂

[CarterBurbage]

WesleyE, I stumbled upon this, and I initially had this same idea before I knew there were still limitations on Graph and getting Mailbox Delegates. In our environment, I have multiple PowerShell scripts that run throughout the day. One of them goes out and grabs mailbox delegates. Due to the number of mailboxes, we have, I break them into multiple background jobs at around 20k chunks. It's usually pretty reliable except for the Rest API issues this Week. I have data flows that pulls this data into Dataverse Tables, and then it can be manipulated this way. 

As someone also mentioned having the Desktop Flows etc., I have tried this as well, but it could take 30-60 seconds until you get a response. Generally, when someone was requesting this information, they didn't want to be put on hold. 

[WesleyE]

Thanks for the information!

I've played with Desktop Flows as well, but that requires a premium license, which means it'll make the whole PowerApp premium, which means everyone using the app (thousands of people) do require a premium license. That's not something our company offers.

What I've done now, is list all Shared Mailboxes in a PowerApp and I added a "Export" button for each Shared Mailbox. If they click the button, it'll patch that shared mailbox record to a SharePoint List with some information.

Then we have OnPrem scripts running that are reading the information from the SharePoint List, pulling the mailbox permissions and sending that by email to the person who clicked the export button. It will then mark this record as "complete" in the SharePoint list so the next time the script runs, it'll skip this record.

Unfortunately it might take some time before the user will get what they need. We have the script scheduled to run every 15 minutes, which means you'd have to wait up to 15 minutes before you're getting the information you need.

The above solution works for us, is a bit more complicated and time consuming, but it is free and everyone can use it without the need of premium licenses.