Managing calendar permissions through the Microsoft 365 admin centre works fine for one-off changes, but the moment you need to audit permissions across a whole department, fix permissions for a leaver, or bulk-update access for a new team structure, the UI becomes painfully slow. PowerShell lets you handle all of this in seconds.
This post covers every calendar permission operation, get, add, remove, change, and bulk lookup, using the Exchange Online MailboxFolderPermission cmdlets.
Prerequisites
All commands below require the Exchange Online PowerShell module and a connection to your tenant. If you haven't set this up yet:
# Install the Exchange Online module (run once)
Install-Module -Name ExchangeOnlineManagement -Force
# Connect to Exchange Online, sign in with your Global Admin account
Connect-ExchangeOnline -UserPrincipalName "admin@yourdomain.com"Quick Reference
Get Calendar Permissions
🔍 GetLists every user who has been granted access to the specified calendar and their current permission level.
# View all permissions on a user's calendar
# Replace the email with the mailbox owner's address
Get-MailboxFolderPermission -Identity "example@example.co.uk:\calendar"
The output shows each User who has access and their AccessRights level. The Default and Anonymous entries are always present, Default covers internal users who haven't been explicitly granted access, Anonymous covers external unauthenticated users.
Add Calendar Permissions
➕ AddGrants a user access to another user's calendar. The -Identity is the calendar owner, -User is the person being granted access.
# Grant a user access to a calendar
# -Identity = the calendar owner
# -User = the person receiving access
# -AccessRights = the permission level to grant (see reference table below)
Add-MailboxFolderPermission `
-Identity "test@jackdjd.co.uk:\calendar" `
-User "user@jackdjd.co.uk" `
-AccessRights Editor
# Verify the permission was added
Get-MailboxFolderPermission -Identity "test@jackdjd.co.uk:\calendar"
This grants user@jackdjd.co.uk Editor access to test@jackdjd.co.uk's calendar, they can read, create, edit and delete items.
Remove Calendar Permissions
➖ RemoveCompletely revokes a user's access to a calendar. This removes their entry entirely, they'll fall back to whatever the Default permission allows.
# Remove a user's access to a calendar
Remove-MailboxFolderPermission `
-Identity "test@jackdjd.co.uk:\calendar" `
-User "user@jackdjd.co.uk"
# Verify the permission was removed
Get-MailboxFolderPermission -Identity "test@jackdjd.co.uk:\calendar"
Change Calendar Permissions
✏️ ChangeUpdates an existing permission entry to a new access level. Use this when a user already has access and you need to increase or reduce it.
# Change an existing calendar permission to a new access level
Set-MailboxFolderPermission `
-Identity "test@jackdjd.co.uk:\calendar" `
-User "user@jackdjd.co.uk" `
-AccessRights Reviewer
# Verify the change
Get-MailboxFolderPermission -Identity "test@jackdjd.co.uk:\calendar"
See All Calendars a User Has Access To
🔎 Bulk LookupUseful for audits, offboarding, or troubleshooting. This script iterates every mailbox in the tenant and returns any calendar where the specified user has been explicitly granted access.
# Find every calendar that a specific user has access to
# Replace the email with the user you're auditing
Get-Mailbox | % {
Get-MailboxFolderPermission `
(($_.PrimarySmtpAddress.ToString()) + ":\Calendar") `
-User "test@jackdjd.co.uk" `
-ErrorAction SilentlyContinue
} | Select-Object Identity, User, AccessRights
# Example output:
# Identity User AccessRights
# -------- ---- ------------
# user@jackdjd.co.uk:\Calendar test@jackdjd.co.uk {Editor}
# manager@jackdjd.co.uk:\Calendar test@jackdjd.co.uk {Reviewer}
The -ErrorAction SilentlyContinue flag suppresses errors for mailboxes where the user has no explicit permission entry, without it you'd get an error for every mailbox that doesn't have a match, drowning out the useful results.
... | Select Identity, User, AccessRights | Export-Csv -Path "C:\CalendarAudit.csv" -NoTypeInformation
Calendar Access Rights Reference
📋 ReferenceWhen using Add-MailboxFolderPermission or Set-MailboxFolderPermission, the -AccessRights parameter accepts one of the following values:
| Access Right | What the user can do |
|---|---|
| Owner FULL | Read, create, modify and delete all items and folders. Can also manage item permissions, effectively full control. |
| PublishingEditor HIGH | Read, create, modify and delete all items and subfolders. Same as Editor but can also create subfolders. |
| Editor HIGH | Read, create, modify and delete all items. Cannot manage permissions or create subfolders. |
| PublishingAuthor MID | Read all items and create subfolders. Can only modify and delete items they created themselves. |
| Author MID | Read all items and create new items. Can edit and delete their own items only. |
| NonEditingAuthor MID | Read all items and create new items. Can delete their own items but cannot edit anything. |
| Reviewer LOW | Read-only access. Can view all calendar items but cannot create, edit or delete anything. |
| Contributor LOW | Can create items and subfolders but cannot read any existing items |