Table of Contents
Delegate Access to Calendars is Popular Exchange Feature
Delegate access to a mailbox is a popular feature supported by Outlook desktop, OWA, and Outlook Mobile. In some cases, you only want to allow access to a specific folder rather than the complete mailbox. Calendar access is often granted to delegates to allow other people to deal with someone’s schedule. It’s easy for users to assign delegate access to their calendar. For instance, in OWA, go to the calendar, click the […] beside the calendar you want to share, select Sharing and permissions, and then add the new delegate. In Figure 1, we’ve elected to give the delegate the ability to view private calendar events too.
Once applied, the delegate will be able to open the delegator’s calendar and Exchange will send calendar invitations and responses to the delegate for their attention.
Behind the Scenes
Delegate access usually works without a hitch, but when things go wrong administrators will probably need to resort to PowerShell to understand what’s happening. The first thing is to establish what kind of access someone has to a problematic calendar. The Get-MailboxFolderPermission cmdlet shows the permissions set on a folder. In this case, we pass the user principal name of the account we want to check and “:\Calendar” to indicate the folder name.
Get-MailboxFolderPermission -Identity Jane.Sixsmith@office365itpros.com:\Calendar
FolderName User AccessRights SharingPermissionFlags
------------- ---- ------------ ----------------------
Calendar Default {AvailabilityOnly}
Calendar Anonymous {None}
Calendar Ken Bowers {Editor} Delegate, CanViewPrivateItems
Common Delegate Access Issue
According to Microsoft, the most common error met with delegate access happens when a user cannot add a new delegate or remove an existing delegate from their mailbox. The root cause is usually a corrupted hidden item in the mailbox which stores the delegate information. Microsoft publishes a comprehensive support article outlining the steps to take to recreate the hidden item. The steps work, but assume that:
- You have a working knowledge of the MFCMAPI utility or the Exchange Web Services editor. I prefer using MFCMAPI and consider it an extremely useful program for any administrator, but I acknowledge that the interface is “interesting” and non-intuitive. In other words, it’s easy to make mistakes.
- You can run these utilities on a Windows workstation to access the problem mailbox.
Because of the multi-step recipe to fix the problem and the need to use an unfamiliar program, some people never manage to get to the end and resolve the issue. This is a classic example of where software can help.
Automating the Rebuild with a New Cmdlet Parameter
Microsoft has released a new switch parameter for the Remove-MailboxFolderPermission cmdlet called ResetDelegateUserCollection. When you run the cmdlet with the parameter, Exchange Online essentially does all the work outlined in the support article to replace the potentially corrupted mailbox items. For example:
Remove-MailboxFolderPermission -Identity Jane.Sixsmith@office365itpros.com:\Calendar -ResetDelegateUserCollection Confirm Are you sure you want to perform this action? Using ResetDelegateUserCollection changes existing calendar Delegate permissions. You will need to re-assign the Delegate flag to these recipients using Set-MailboxFolderPermission -SharingPermissionFlags Delegate. It is suggested that this ResetDelegateUserCollection option is only used when you believe there is corruption that is preventing managing calendar permissions. [Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): Y WARNING: Resetting DelegateUserCollection... WARNING: DelegateUserCollection is reset.
Note the warning. If we run Get-MailboxFolderPermission again, we’ll see that the sharing permission flags which make someone into a delegate are gone.
Get-MailboxFolderPermission -Identity Jane.Sixsmith@office365itpros.com:\Calendar
FolderName User AccessRights SharingPermissionFlags
---------- ---- ------------ ----------------------
Calendar Default {AvailabilityOnly}
Calendar Anonymous {None}
Calendar Ken Bowers {Editor}
To complete the fix, we need to add delegate permissions again. You could ask the user to do this by updating the permissions assigned to their calendar, but it’s easier and more polite for the administrator who’s just reset the delegate information to do the job for the user by running the Set-MailboxFolderPermission cmdlet. If you don’t do reset permissions, delegates will have editor permission for the calendar folder, but they won’t be able to process calendar invitations on behalf of the mailbox owner. Here’s how to reset the permissions for Ken Bowers:
Set-MailboxFolderPermission -Identity Jane.Sixsmith@office365itpros.com:\Calendar -User Ken.Bowers@office365itpros.com -SharingPermissionFlags Delegate, CanViewPrivateItems -AccessRights Editor
After the cmdlet completes, you can run Get-MailboxFolderPermission again to verify that the delegate sharing permission flag is present once again (and optionally the flag allowing the delegate to view private items too).
Of course, it’s fine if you’d prefer to follow the MFCMAPI recipe to fix the delegate issue, but it’s a lot easier and faster to run a couple of lines of PowerShell!
Cmdlet Availability
The upgraded version of Remove-MailboxFolderPermission is rolling out now. If your RBAC configuration is higher than 15.20.3722, the cmdlet should be available in your tenant. To check, run the Get-OrganizationConfig cmdlet to check the value of RBACConfigurationVersion:
Get-OrganizationConfig | Select RBACConfigurationVersion RBACConfigurationVersion ------------------------ 0.1 (15.20.3763.11)
This is just the kind of detailed how-to information we love reading about. It might only end up as a line or two in the Office 365 for IT Pros eBook, but that’s no reason not to share the knowledge with you.
One Reply to “How to Rebuild Delegate Access for a Calendar with PowerShell”