{"id":76,"date":"2025-04-16T14:45:05","date_gmt":"2025-04-16T14:45:05","guid":{"rendered":"https:\/\/burlage.it\/?p=76"},"modified":"2025-04-17T15:00:09","modified_gmt":"2025-04-17T15:00:09","slug":"convert-remote-enabled-shared-mailbox-to-cloud-only-shared-mailbox","status":"publish","type":"post","link":"https:\/\/burlage.it\/index.php\/2025\/04\/16\/convert-remote-enabled-shared-mailbox-to-cloud-only-shared-mailbox\/","title":{"rendered":"Convert remote-enabled shared mailbox to cloud-only shared mailbox"},"content":{"rendered":"\n

This guide will not include:
– AD permission
– Exchange permissions
– Entra Connect permissions
– Entra Permissions

This code must be executed in Visual Studio Code<\/a>

Make sure you first have set up Visual Studio Code and all PowerShell modules.

There are no speed-checks in here (at least for now) so, first check per block if everything is working.

Operationally you would only need to change one variable: $sharedMailbox

Initially you have to fill in one time these variables:
– $notSyncedOU
– $ad_domain
– $entraConnect
and it will prompt you to enter the UPN of your admin account and it’s password
(still need to figure out some other authentication methods, connecting to exchange-online and mggraph still requires some input from the administrator)

Good luck – no garantees.
Roger<\/p>\n\n\n\n

<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
# Enter - Primairy emailaddress of shared mailbox<\/span><\/span>\n$sharedMailbox<\/span> = <\/span>'primairyemailaddress@domain.com'<\/span><\/span>\n$notSyncedOU<\/span> = <\/span>'OU=NotSyncedToEntraOU,DC=domain,DC=com'<\/span> <\/span><\/span>\n<\/span>\n# PowerShell - Store domain credentials if not present in a secure text file<\/span><\/span>\nif<\/span> ( (<\/span>Test-Path<\/span> <\/span>'C:\\Temp\\usera.txt'<\/span>) -eq <\/span>$false<\/span> ) {<\/span>Read-Host<\/span> -Prompt <\/span>"Enter your adminaccount for DOMAIN (e.g. admin-john.doe@domain.com)"<\/span> | <\/span>Out-File<\/span> -FilePath <\/span>'C:\\Temp\\usera.txt'<\/span>}<\/span><\/span>\nif<\/span> ( (<\/span>Test-Path<\/span> <\/span>'C:\\Temp\\creda.txt'<\/span>) -eq <\/span>$false<\/span> ) {<\/span>Read-Host<\/span> -Prompt <\/span>"Enter password for your adminaccount for DOMAIN"<\/span> -AsSecureString | <\/span>ConvertFrom-SecureString<\/span> | <\/span>Out-File<\/span> -FilePath <\/span>'C:\\Temp\\creda.txt'<\/span>}<\/span><\/span>\n$password_domain<\/span> = <\/span>Get-Content<\/span> -Path <\/span>'C:\\Temp\\creda.txt'<\/span> | <\/span>ConvertTo-SecureString<\/span><\/span>\n$user_domain<\/span> = <\/span>Get-Content<\/span> -Path <\/span>'C:\\Temp\\usera.txt'<\/span><\/span>\n$cred_domain<\/span> = <\/span>New-Object<\/span> -TypeName System.Management.Automation.PSCredential -ArgumentList <\/span>$user_domain<\/span>, <\/span>$password_domain<\/span><\/span>\n<\/span>\n# AD - Import Active Directory PS-session<\/span><\/span>\n$ad_domain<\/span> = <\/span>'domaincontroller.domain.com'<\/span><\/span>\n$session_domain<\/span> = <\/span>New-PSSession<\/span> -ComputerName <\/span>$ad_domain<\/span> -Credential <\/span>$cred_domain<\/span><\/span>\nInvoke-Command<\/span> -Session <\/span>$session_domain<\/span> -ScriptBlock {<\/span>Import-Module<\/span> ActiveDirectory} <\/span><\/span>\nImport-PSSession<\/span> -Session <\/span>$session_domain<\/span> -DisableNameChecking -AllowClobber -Module ActiveDirectory | <\/span>Out-Null<\/span><\/span>\n<\/span>\n# Exchange - Connect to Exchange Online<\/span><\/span>\nConnect-ExchangeOnline<\/span> -UserPrincipalName <\/span>$user_domain<\/span><\/span>\n<\/span>\n# Exchange - Collect permissions on shared mailbox<\/span><\/span>\n$fullpermissions<\/span> = (<\/span>Get-MailboxPermission<\/span> <\/span>$sharedmailbox<\/span> | <\/span>Where-Object<\/span> {<\/span>$_<\/span>.AccessRights<\/span> -like <\/span>'Full*'<\/span> -and <\/span>$_<\/span>.User<\/span> -notlike <\/span>'*SELF'<\/span>}).User<\/span><\/span>\n$sendaspermissions<\/span> = (<\/span>Get-RecipientPermission<\/span> -Identity <\/span>$sharedmailbox<\/span> | <\/span>Where-Object<\/span> {<\/span>$_<\/span>.AccessRights<\/span> -like <\/span>'SendAs'<\/span> -and <\/span>$_<\/span>.Trustee<\/span> -notlike <\/span>'*SELF'<\/span>}).Trustee<\/span><\/span>\n<\/span>\n# AD - Collect varialbles from shared mailbox ad-account<\/span><\/span>\n$samAccountName<\/span> = (<\/span>Get-ADUser<\/span> -Filter * -Properties mail | <\/span>Where-Object<\/span> {<\/span>$_<\/span>.mail<\/span> -eq <\/span>$sharedMailbox<\/span>}).SamAccountName<\/span><\/span>\n$distinguishedName<\/span> = (<\/span>Get-ADUser<\/span> -Identity <\/span>$samAccountName<\/span>).DistinguishedName<\/span><\/span>\n$emailAlias<\/span> = (<\/span>Get-ADUser<\/span> -Identity <\/span>$samAccountName<\/span> -Properties mailNickname).mailNickname<\/span><\/span>\n$displayName<\/span> = (<\/span>Get-ADUser<\/span> -Identity <\/span>$samAccountName<\/span> -Properties displayName).displayName<\/span><\/span>\n<\/span>\n# AD - Move the shared mailbox account to a non-synced OU<\/span><\/span>\nMove-ADObject<\/span> -Identity <\/span>$distinguishedName<\/span> -TargetPath <\/span>$notSyncedOU<\/span><\/span>\n<\/span>\n# Entra Connect - Import Entra Connect server PS-session <\/span><\/span>\n$entraConnect<\/span> = <\/span>'entraconnectserver.domain.com'<\/span><\/span>\n$session_domain<\/span> = <\/span>New-PSSession<\/span> -ComputerName <\/span>$entraConnect<\/span> -Credential <\/span>$cred_domain<\/span><\/span>\nInvoke-Command<\/span> -Session <\/span>$session_domain<\/span> -ScriptBlock {<\/span>Import-Module<\/span> ADSync} <\/span><\/span>\nImport-PSSession<\/span> -Session <\/span>$session_domain<\/span> -DisableNameChecking -AllowClobber -Module ADSync | <\/span>Out-Null<\/span><\/span>\n<\/span>\n# Entra Connect - Start Entra Connect delta sync to synchronize AD with Entra<\/span><\/span>\nStart-ADSyncSyncCycle<\/span> -PolicyType Delta <\/span><\/span>\n<\/span>\n# Exchange - Retrieve the GUID of the deleted shared mailbox<\/span><\/span>\n$sharedmailboxGuid<\/span> = (<\/span>Get-Mailbox<\/span> -SoftDeletedMailbox <\/span>$sharedMailbox<\/span>).Guid<\/span><\/span>\n<\/span>\n# MgGraph - Permanently delete the soft-deleted Entra account of the shared mailbox<\/span><\/span>\n$directoryObjectId<\/span> = (<\/span>Get-MgDirectoryDeletedItemAsUser<\/span> -Filter <\/span>"Mail eq '<\/span>$sharedMailbox<\/span>'"<\/span>).Id<\/span><\/span>\nRemove-MgDirectoryDeletedItem<\/span> -DirectoryObjectId <\/span>$directoryObjectId<\/span><\/span>\n<\/span>\n# Exchange - Restore the deleted shared mailbox to a new Entra account<\/span><\/span>\nNew-Mailbox<\/span> -InactiveMailbox <\/span>$sharedmailboxGuid<\/span> -Alias <\/span>$emailAlias<\/span> -MicrosoftOnlineServicesID <\/span>$sharedMailbox<\/span> -Name <\/span>$samAccountName<\/span> -DisplayName <\/span>$displayName<\/span><\/span>\n<\/span>\n# Exchange - Convert restored mailbox to shared mailbox<\/span><\/span>\nSet-Mailbox<\/span> <\/span>$sharedMailbox<\/span> -Type Shared<\/span><\/span>\n<\/span>\n# Exchange - Set the shared mailbox to leave a copy in the sent items folder of the shared mailbox<\/span><\/span>\nSet-Mailbox<\/span> -Identity <\/span>$emailAddress<\/span> -MessageCopyForSentAsEnabled <\/span>$true<\/span> -MessageCopyForSendOnBehalfEnabled <\/span>$true<\/span><\/span>\n<\/span>\n# Exchange - Re-add full permissions for a user to a shared mailbox<\/span><\/span>\nforeach<\/span> (<\/span>$user<\/span> <\/span>in<\/span> <\/span>$fullpermissions<\/span>) {<\/span>Add-MailboxPermission<\/span> -Identity <\/span>$sharedmailbox<\/span> -User <\/span>$user<\/span> -AccessRights <\/span>'FullAccess'<\/span> -InheritanceType <\/span>'All'<\/span> -AutoMapping <\/span>$false<\/span> -Confirm:<\/span>$false<\/span>}<\/span><\/span>\n<\/span>\n# Exchange - Re-add SendAs permissions for a user on a shared mailbox<\/span><\/span>\nforeach<\/span> (<\/span>$user<\/span> <\/span>in<\/span> <\/span>$sendaspermissions<\/span>) {<\/span>Add-RecipientPermission<\/span> -Identity <\/span>$sharedmailbox<\/span> -Trustee <\/span>$user<\/span> -AccessRights <\/span>'SendAs'<\/span> -Confirm:<\/span>$false<\/span>}<\/span><\/span>\n<\/span>\n# AD - remove ad-account<\/span><\/span>\nRemove-ADUser<\/span> -Identity <\/span>$samAccountName<\/span> -Confirm:<\/span>$false<\/span><\/span><\/code><\/pre><\/div>\n","protected":false},"excerpt":{"rendered":"
This guide will not include:– AD permission– Exchange permissions– Entra Connect permissions– Entra Permissions This code must be executed in Visual Studio Code Make sure you first have set up Visual Studio Code and all PowerShell modules. There are no speed-checks in here (at least for now) so, first check per block if everything is […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-76","post","type-post","status-publish","format-standard","hentry","category-powershell"],"_links":{"self":[{"href":"https:\/\/burlage.it\/index.php\/wp-json\/wp\/v2\/posts\/76","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/burlage.it\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/burlage.it\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/burlage.it\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/burlage.it\/index.php\/wp-json\/wp\/v2\/comments?post=76"}],"version-history":[{"count":4,"href":"https:\/\/burlage.it\/index.php\/wp-json\/wp\/v2\/posts\/76\/revisions"}],"predecessor-version":[{"id":83,"href":"https:\/\/burlage.it\/index.php\/wp-json\/wp\/v2\/posts\/76\/revisions\/83"}],"wp:attachment":[{"href":"https:\/\/burlage.it\/index.php\/wp-json\/wp\/v2\/media?parent=76"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/burlage.it\/index.php\/wp-json\/wp\/v2\/categories?post=76"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/burlage.it\/index.php\/wp-json\/wp\/v2\/tags?post=76"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}