Free tool · Read-only

Shared Mailbox Permission Audit Generator

Enter one shared mailbox address. Get a read-only PowerShell script that lists its current Full Access, Send As and Send on Behalf delegates, and flags any trustee that no longer resolves to an Exchange recipient. One mailbox per script, on purpose.

Everything below runs in your browser. The mailbox address you type is never sent to Tenvero or logged anywhere — it's only used to build the text of the script.

Shared mailbox address

PowerShell — audits only

What this script checks

Full Access — direct, non-inherited grants, excluding NT AUTHORITY\SELF and the S-1-5-10 self SID.
Send As — direct, non-inherited recipient permission grants.
Send on Behalf — the mailbox's GrantSendOnBehalfTo list.
Unresolved trustees — any delegate that no longer resolves via Get-EXORecipient, flagged as a possible orphaned or stale entry.

It is read-only: no Add-*, Remove-* or Set-* cmdlets. It requires theExchangeOnlineManagement module and Exchange Online read access (View-Only Recipients or higher), and it only ever targets the one mailbox you entered above.

Doing this across dozens or hundreds of shared mailboxes?

Tenvero turns this audit into an ongoing managed process — every mapped mailbox, on a schedule, with reconciliation against the AD group that's supposed to own the access.

Start 30-day trial See the Delegation Audit