Mailbox delegations: Full Access, Send As and Send on Behalf

#Requires -Modules ExchangeOnlineManagement
# Full Access, Send As and Send on Behalf delegates on every mailbox. Read-only.

Connect-ExchangeOnline -ShowBanner:$false

$mailboxes = Get-EXOMailbox -ResultSize Unlimited -Properties GrantSendOnBehalfTo

$rows = @(foreach ($mailbox in $mailboxes) {
    Get-EXOMailboxPermission -Identity $mailbox.UserPrincipalName |
        Where-Object { -not $_.IsInherited -and -not $_.Deny -and $_.User -ne 'NT AUTHORITY\SELF' } |
        ForEach-Object {
            [pscustomobject]@{
                Mailbox    = $mailbox.UserPrincipalName
                Delegate   = "$($_.User)"
                Permission = $_.AccessRights -join ', '
            }
        }
    foreach ($delegate in $mailbox.GrantSendOnBehalfTo) {
        [pscustomobject]@{
            Mailbox    = $mailbox.UserPrincipalName
            Delegate   = "$delegate"
            Permission = 'SendOnBehalf'
        }
    }
})

$rows += @(Get-EXORecipientPermission -ResultSize Unlimited -AccessRights SendAs |
    Where-Object { $_.Trustee -ne 'NT AUTHORITY\SELF' } |
    ForEach-Object {
        [pscustomobject]@{
            Mailbox    = "$($_.Identity)"
            Delegate   = "$($_.Trustee)"
            Permission = 'SendAs'
        }
    })

$rows | Sort-Object Mailbox, Permission, Delegate

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

• Full Access rows are permissions assigned directly to the mailbox (IsInherited False) and not denied. NT AUTHORITY\SELF, the owner's own entry, is left out, as are the inherited defaults Microsoft lists on the Get-EXOMailboxPermission page.
• Send As comes from Get-EXORecipientPermission, which covers every recipient, so groups with Send As delegates appear too. Send on Behalf comes from each mailbox's GrantSendOnBehalfTo.
• Makes one permissions request per mailbox, so it takes a while in large organisations.
• ExchangeOnlineManagement 3.10.0 and later require PowerShell 7.6 when run in PowerShell 7 (Windows PowerShell 5.1 is unaffected), per the module release notes.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.