Exchange.ManageAsApp (+ View-Only Recipients)
User.Read.All (holder account state)
— application permissions, granted to the app registration with admin consent.
Licence: None.
Endpoints:
Get-EXOMailbox -RecipientTypeDetails SharedMailbox · Get-EXOMailboxPermission (Full Access) · Get-EXORecipientPermission (Send As) · Get-EXOMailboxFolderStatistics -FolderScope Inbox (newest item) · Get-EXOMailboxStatistics
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Shared Mailboxes Nobody Can Access
A shared mailbox that nobody can open still receives mail - customer enquiries, invoices, password resets - and nobody reads it. This scan lists shared mailboxes with no Full Access or Send As holder, or only disabled holders, and those that received nothing for 180 days (clean-up and retention candidates). LeaverCleanup covers leavers' own mailboxes.
Press Run scan to check every shared mailbox (several minutes on large tenants).