Exchange Calendar Permissions & Delegate Access

6 min readArticle

Permission Levels

Exchange calendar permissions use a role-based model. Each role is a named set of capabilities:

Role	Create	Read	Edit Own	Edit All	Delete Own	Delete All	Create Subfolders	Manage Perms
Owner	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
PublishingEditor	Yes	Yes	Yes	Yes	Yes	Yes	Yes	No
Editor	Yes	Yes	Yes	Yes	Yes	Yes	No	No
PublishingAuthor	Yes	Yes	Yes	No	Yes	No	Yes	No
Author	Yes	Yes	Yes	No	Yes	No	No	No
NonEditingAuthor	Yes	Yes	No	No	Yes	No	No	No
Reviewer	No	Yes	No	No	No	No	No	No
Contributor	Yes	No	No	No	No	No	No	No
AvailabilityOnly	No	Free/Busy only	No	No	No	No	No	No
LimitedDetails	No	Subject + Location	No	No	No	No	No	No
None	No	No	No	No	No	No	No	No

Most common in practice: Editor (full access, typical for EA/delegate), Reviewer (read-only), LimitedDetails (org-wide free/busy default), AvailabilityOnly (minimal visibility).

Delegate Access vs. Direct Permissions

These are two distinct mechanisms that are often confused:

Delegate Access (via Outlook):

Configured through: File > Account Settings > Delegate Access
Delegates receive a copy of meeting requests, responses, and cancellations sent to the mailbox owner
Delegates can act on behalf of the user (visible in From field: "Jane Smith on behalf of John Brown")
Can be scoped to Calendar, Tasks, Inbox, Contacts, Notes individually
Delegates can be granted "Send on Behalf" permission for email as well
Best for: Executive Assistant managing a manager's full schedule

Direct Calendar Permissions (folder-level):

Configured via PowerShell Add-MailboxFolderPermission or right-click > Share in Outlook
No meeting request forwarding — user just has access to view/edit the calendar folder
Acts as themselves, not on behalf of
Best for: giving a team member read access to a colleague's calendar without full delegation

Both can coexist. A user can be both a delegate AND have direct folder permissions set.

PowerShell Cmdlets

Connect to Exchange (On-Premises)

powershell

$Session = New-PSSession -ConfigurationName Microsoft.Exchange `
  -ConnectionUri http://exchange.corp.local/PowerShell/ `
  -Authentication Kerberos
Import-PSSession $Session -DisableNameChecking

Connect to Exchange Online

powershell

Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline -UserPrincipalName [email protected]

View Permissions

powershell

# View all permissions on a user's calendar
Get-MailboxFolderPermission -Identity [email protected]:\Calendar

# Export to CSV for auditing
Get-MailboxFolderPermission -Identity [email protected]:\Calendar | Export-CSV C:\calendar-perms.csv -NoTypeInformation

# Check a specific user's access
Get-MailboxFolderPermission -Identity [email protected]:\Calendar | Where-Object { $_.User -like "*delegate*" }

Add Permissions (use when user has NO existing permissions)

powershell

Add-MailboxFolderPermission -Identity [email protected]:\Calendar `
  -User [email protected] -AccessRights Editor

# Read-only access
Add-MailboxFolderPermission -Identity [email protected]:\Calendar `
  -User [email protected] -AccessRights Reviewer

# Free/busy with subject and location
Add-MailboxFolderPermission -Identity [email protected]:\Calendar `
  -User [email protected] -AccessRights LimitedDetails

Modify Permissions (use when user ALREADY HAS permissions — Add will fail)

powershell

Set-MailboxFolderPermission -Identity [email protected]:\Calendar `
  -User [email protected] -AccessRights Editor

# Downgrade existing access
Set-MailboxFolderPermission -Identity [email protected]:\Calendar `
  -User [email protected] -AccessRights Reviewer

Remove Permissions

powershell

Remove-MailboxFolderPermission -Identity [email protected]:\Calendar `
  -User [email protected] -Confirm:$false

Default and Anonymous Permissions

Every calendar has two special permission entries that control org-wide visibility:

Default — Applies to all authenticated users in the organization who are not explicitly listed.
Anonymous — Applies to unauthenticated users (external sharing, if enabled).

powershell

# Show free/busy time with subject and location to all org users (recommended baseline)
Set-MailboxFolderPermission -Identity [email protected]:\Calendar `
  -User Default -AccessRights LimitedDetails

# Show only free/busy time (more restrictive)
Set-MailboxFolderPermission -Identity [email protected]:\Calendar `
  -User Default -AccessRights AvailabilityOnly

# Block all visibility (privacy mode)
Set-MailboxFolderPermission -Identity [email protected]:\Calendar `
  -User Default -AccessRights None

Bulk Set Calendar Permissions

Apply a standard Default permission to all user calendars in the org:

powershell

# Set LimitedDetails for all user mailboxes (excludes resource/room mailboxes)
Get-Mailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited | ForEach-Object {
    $calendar = "$($_.SamAccountName):\Calendar"
    try {
        Set-MailboxFolderPermission -Identity $calendar -User Default -AccessRights LimitedDetails -ErrorAction Stop
        Write-Host "Set: $($_.SamAccountName)" -ForegroundColor Green
    } catch {
        # May need Add instead of Set if Default doesn't exist yet
        Add-MailboxFolderPermission -Identity $calendar -User Default -AccessRights LimitedDetails -ErrorAction SilentlyContinue
        Write-Host "Added: $($_.SamAccountName)" -ForegroundColor Yellow
    }
}

Free/Busy Sharing

Within the same organization: Automatic via the Exchange Availability Service. No configuration needed — free/busy is available based on the Default calendar permission level set.

Cross-organization (federation): Requires configuring an organization relationship:

powershell

# View existing federation trust
Get-FederationTrust

# View organization relationships
Get-OrganizationRelationship

# Create new org relationship for cross-org free/busy
New-OrganizationRelationship -Name "Contoso" -DomainNames contoso.com `
  -FreeBusyAccessEnabled $true -FreeBusyAccessLevel LimitedDetails

# Sharing policies for external users without federation
Get-SharingPolicy
New-SharingPolicy -Name "External Sharing" -Domains "contoso.com:CalendarSharingFreeBusyDetail" -Enabled $true

# Apply sharing policy to a mailbox
Set-Mailbox [email protected] -SharingPolicy "External Sharing"

# Test the org relationship
Test-OrganizationRelationship -Identity "Contoso" -UserIdentity [email protected]

Room and Resource Calendar Management

powershell

# View room mailboxes
Get-Mailbox -RecipientTypeDetails RoomMailbox | Select Name, PrimarySmtpAddress

# Auto-accept all meeting requests for a room
Set-CalendarProcessing -Identity "[email protected]" `
  -AutomateProcessing AutoAccept `
  -AllowConflicts $false `
  -BookingWindowInDays 180 `
  -MaximumDurationInMinutes 480

# Allow/deny specific users from booking
Set-CalendarProcessing -Identity "[email protected]" `
  -BookInPolicy @("[email protected]") `
  -AllBookInPolicy $false

# Add a delegate to manage room bookings
Set-CalendarProcessing -Identity "[email protected]" `
  -ResourceDelegates "[email protected]" `
  -AutomateProcessing AutoUpdate  # Delegates manually approve/decline

# View current calendar processing settings
Get-CalendarProcessing -Identity "[email protected]" | Format-List

Troubleshooting

User can't see calendar details despite having Editor access:

Verify with Get-MailboxFolderPermission — confirm the entry exists and has the expected role.
Check the Default permission — if set to None and the user isn't explicitly listed, they get nothing.
Confirm the user is looking at the correct calendar folder (not a sub-calendar).

"The specified object was not found in the store" error when adding permissions:

The calendar folder path may differ for non-English mailboxes. Find it with:

powershell

Get-MailboxFolderStatistics [email protected] | Where-Object { $_.FolderType -eq "Calendar" } | Select FolderPath

Use the exact localized folder name in the identity string.

Availability Service not returning free/busy for cross-org:

powershell

Test-OrganizationRelationship -Identity "PartnerOrg" -UserIdentity [email protected] -Verbose

Delegate not receiving meeting requests:

Verify delegate configuration in Outlook: File > Account Settings > Delegate Access.
The delegate setting in Outlook writes to the publicDelegates AD attribute — confirm it's populated.

techzonesite.comUnlock Your IT Potential