Get-MailboxDelegateAccessReport

<#
.SYNOPSIS
    Reports Full Access and Send As delegate permissions across all mailboxes.

.DESCRIPTION
    Scans every mailbox for Full Access and Send As permissions granted to
    another user, skipping the default self and SELF/NT AUTHORITY entries,
    so the actual delegate relationships are easy to review.

.EXAMPLE
    .\Get-MailboxDelegateAccessReport.ps1

.NOTES
    Requires ExchangeOnlineManagement and an active Connect-ExchangeOnline session.

.AUTHOR
    Shehryar Hassan
#>

$mailboxes = Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox,SharedMailbox
$report = foreach ($mbx in $mailboxes) {
    $fullAccess = Get-MailboxPermission -Identity $mbx.Identity |
        Where-Object { $_.User -notlike "NT AUTHORITY\*" -and $_.User -ne $mbx.UserPrincipalName -and $_.IsInherited -eq $false }
    $sendAs = Get-RecipientPermission -Identity $mbx.Identity |
        Where-Object { $_.Trustee -notlike "NT AUTHORITY\*" -and $_.Trustee -ne $mbx.UserPrincipalName }

    foreach ($perm in $fullAccess) {
        [pscustomobject]@{ Mailbox = $mbx.DisplayName; Delegate = $perm.User; Right = "Full Access" }
    }
    foreach ($perm in $sendAs) {
        [pscustomobject]@{ Mailbox = $mbx.DisplayName; Delegate = $perm.Trustee; Right = "Send As" }
    }
}

$report | Sort-Object Mailbox | Format-Table -AutoSize
Write-Host "$($report.Count) delegate permission(s) found across $($mailboxes.Count) mailboxes" -ForegroundColor Cyan