Inventory delegated From addresses for outbound spam policies

Outbound spam policy limits depend on the address in the From field (also known as the 5322.From address or P2 sender) of each message, not just the authenticated sender. For details, see How outbound spam policy limits apply to Send As and Send on behalf permissions.

An inventory of delegated sending permissions helps you:

• Identify who can send email from mailboxes and group addresses.
• Investigate unexpected outbound sending restrictions.
• Verify that delegated From addresses are covered by appropriate outbound spam policies.

Include the following delegated permissions in the inventory:

• Send As permissions assigned on mailboxes and groups.
• Send on behalf permissions assigned on mailboxes, distribution groups, dynamic distribution groups, mail-enabled security groups, and Microsoft 365 Groups.

Keep the following points in mind:

• Full Access permissions are excluded, because they don't grant the ability to send email from the mailbox.
• If a delegate has both Send As and Send on behalf permissions for the same target, Send As takes precedence.

Before you begin

• Connect to Exchange Online PowerShell. For instructions, see Connect to Exchange Online PowerShell.
• You need to be assigned permissions before you can run the commands in this article. You have the following options:

  • Exchange Online permissions: Membership in a role group that has the View-Only Recipients role assigned. By default, that role is assigned to the Organization Management, View-Only Organization Management, Compliance Management, Hygiene Management, and Help Desk role groups.

  • Microsoft Entra permissions: Membership in the Global Administrator^*, Exchange Administrator, Exchange Recipient Administrator, or Global Reader roles gives users read access to recipients and permissions for other features in Microsoft 365.

    Important

    ^* Microsoft strongly advocates for the principle of least privilege. Assigning accounts only the minimum permissions necessary to perform their tasks helps reduce security risks and strengthens your organization's overall protection. Global Administrator is a highly privileged role that you should limit to emergency scenarios or when you can't use a different role.

Inventory Send As permissions

Send As assignments are stored as recipient permissions, so you can inventory them for the whole organization. The following Exchange Online PowerShell command returns Send As assignments, excludes the built-in NT AUTHORITY\SELF and NT AUTHORITY\SYSTEM trustees, and sorts the results:

Get-EXORecipientPermission -AccessRights SendAs -ResultSize Unlimited | Where-Object { $_.Trustee -ne "NT AUTHORITY\SELF" -and $_.Trustee -ne "NT AUTHORITY\SYSTEM" } | Select-Object Identity, Trustee, AccessRights | Sort-Object Identity, Trustee

The output includes the following fields:

• Identity is the mailbox or group address that can be used as the delegated From address.
• Trustee is the user or mail-enabled security group granted Send As permission.

To export the results to a CSV file, replace <PathAndFilename> with the desired name and location of the CSV file, and then add | Export-Csv -Path "<PathAndFilename>.csv" -NoTypeInformation to the end of the command.

For more information, see Get-EXORecipientPermission.

Inventory Send on behalf permissions

Send on behalf assignments are stored in the GrantSendOnBehalfTo property of recipient objects. Because the script that collects these assignments is long, save it as a script file and then run it in Exchange Online PowerShell:

1. Copy the code from the following code block into a plain-text editor like Notepad.

2. Save the file with a .ps1 extension (for example, GetSendOnBehalf.ps1) in a location that's easy to find (for example, C:\Data\).

3. In Exchange Online PowerShell, run the following command:

   & "C:\Data\GetSendOnBehalf.ps1"
   

The script collects assignments from mailboxes, distribution groups, dynamic distribution groups, and Microsoft 365 Groups, and returns one row for each delegation.

$sendOnBehalfPermissions = @()

# Mailboxes
Get-EXOMailbox -ResultSize Unlimited -Properties GrantSendOnBehalfTo |
    Where-Object { $_.GrantSendOnBehalfTo.Count -gt 0 } |
    ForEach-Object {
        $target = $_
        foreach ($delegate in $target.GrantSendOnBehalfTo) {
            $sendOnBehalfPermissions += [PSCustomObject]@{
                Permission        = "Send on behalf"
                FromAddress       = $target.PrimarySmtpAddress
                FromDisplayName   = $target.DisplayName
                FromRecipientType = $target.RecipientTypeDetails
                Delegate          = $delegate
            }
        }
    }

# Distribution groups
Get-DistributionGroup -ResultSize Unlimited |
    Where-Object { $_.GrantSendOnBehalfTo.Count -gt 0 } |
    ForEach-Object {
        $target = $_
        foreach ($delegate in $target.GrantSendOnBehalfTo) {
            $sendOnBehalfPermissions += [PSCustomObject]@{
                Permission        = "Send on behalf"
                FromAddress       = $target.PrimarySmtpAddress
                FromDisplayName   = $target.DisplayName
                FromRecipientType = $target.RecipientTypeDetails
                Delegate          = $delegate
            }
        }
    }

# Dynamic distribution groups
Get-DynamicDistributionGroup -ResultSize Unlimited |
    Where-Object { $_.GrantSendOnBehalfTo.Count -gt 0 } |
    ForEach-Object {
        $target = $_
        foreach ($delegate in $target.GrantSendOnBehalfTo) {
            $sendOnBehalfPermissions += [PSCustomObject]@{
                Permission        = "Send on behalf"
                FromAddress       = $target.PrimarySmtpAddress
                FromDisplayName   = $target.DisplayName
                FromRecipientType = $target.RecipientTypeDetails
                Delegate          = $delegate
            }
        }
    }

# Microsoft 365 Groups
Get-UnifiedGroup -ResultSize Unlimited |
    Where-Object { $_.GrantSendOnBehalfTo.Count -gt 0 } |
    ForEach-Object {
        $target = $_
        foreach ($delegate in $target.GrantSendOnBehalfTo) {
            $sendOnBehalfPermissions += [PSCustomObject]@{
                Permission        = "Send on behalf"
                FromAddress       = $target.PrimarySmtpAddress
                FromDisplayName   = $target.DisplayName
                FromRecipientType = "Microsoft 365 Group"
                Delegate          = $delegate
            }
        }
    }

$sendOnBehalfPermissions |
    Sort-Object FromAddress, Delegate |
    Format-Table -AutoSize

To export the results to a CSV file, replace the final Format-Table -AutoSize command with Export-Csv -Path "<PathAndFilename>.csv" -NoTypeInformation, where <PathAndFilename> is the desired name and location of the CSV file.

Review permissions assigned through groups

The inventory reports only the trustee that received the permission directly. Because a trustee can be a group, users can inherit delegated sending rights through membership even when their names don't appear in the results.

For each group trustee:

• Determine whether the group-based permission assignment is still needed.
• Review the current membership of the group. The command in this section expands nested groups automatically, so members of nested groups are included in the results.
• Document the effective users that can send email from the delegated address.

To list all members of a group, including members of any nested groups, replace <GroupName> with the name, alias, or email address of the group, and then run the following command:

function Get-AllGroupMembers ($GroupIdentity) {$members = Get-DistributionGroupMember -Identity $GroupIdentity -ResultSize Unlimited; foreach ($member in $members) {if ($member.RecipientType -like "*Group*") { Get-AllGroupMembers $member.PrimarySmtpAddress} else {$member}}}; Get-AllGroupMembers "<GroupName>" | Select-Object DisplayName, PrimarySmtpAddress, RecipientType -Unique

Map delegated permissions to outbound spam policies

Use the inventory results to build a mapping between the effective delegate, the delegated From address, the delegated permission type, and the outbound spam policy that applies to that From address. For example:

For each user, compare:

• The user's own From address.
• Every delegated From address the user routinely uses.
• Delegated permissions obtained through group membership.
• Delegated permissions obtained through nested groups.

If different policies have different limits or restriction actions, users can encounter unexpected restrictions when they send email from delegated addresses. To adjust policy coverage, see Configure outbound spam policies.

Related content

• How outbound spam policy limits apply to Send As and Send on behalf permissions
• Configure outbound spam policies
• Troubleshoot outbound sending limits in Exchange Online
• Manage permissions for recipients in Exchange Online