Mailbox Folder Permissions (non-calendar)
The question it answers: Which mailbox folders other than calendars are shared with other users, everyone (Default) or anonymous?
Users can share their Inbox with a colleague - or with Default, which means everyone in the company. Attackers who compromise one account use such grants to read other mailboxes without any admin role. CalendarPermissions covers calendars; this scan covers the mailbox root and the Inbox, Sent Items, Deleted Items and Contacts folders. Sub-folders are not scanned.
At a glance
Section titled “At a glance”| Where in the app | Exchange Online › Mail Security & Hygiene › Mailbox Folder Permissions |
| Workload | Exchange Online |
| Kind | Findings list · dashboard tile |
| Data | A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report. |
| Licence | No extra licence needed. |
| Report id (API and MCP) | exchange.hygiene.mailbox-folder-permissions |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Mailbox type | Category | Text |
| Mailbox | Subject | Link |
| Check | Setting | Text |
| Folder | Value | Text |
| Finding | Finding | Text |
| Who has access | Detail | Text |
| Date | When | Date |
| Grants | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: No extra licence needed.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Exchange.ManageAsApp | Office 365 Exchange Online | Manage Exchange As Application | + View-Only Recipients |
Data sources it reads
Get-EXOMailbox -RecipientTypeDetails UserMailbox, SharedMailboxGet-MailboxFolderStatistics (folder paths by type, any mailbox language)Get-EXOMailboxFolderPermission (root, Inbox, Sent Items, Deleted Items, Contacts)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/exchange.hygiene.mailbox-folder-permissions?size=100POST /ir-api/v1/reports/exchange.hygiene.mailbox-folder-permissions/scanAn AI assistant reads it with the MCP tool get_report and the id exchange.hygiene.mailbox-folder-permissions. The client needs the Run scan grant for Exchange Online. See Using the API.