ErrorAccessDenied
Exchange denied access to the requested mailbox operation
Answer: The identity lacks an effective Exchange permission, application access assignment, or supported authorization context for the operation.
Resolution playbook
Fix it, then prove it
Use the error record as the starting point; use tenant evidence to confirm the actual cause.
Likely causes
- Graph API consent and Exchange workload authorization can both affect mailbox access.
- The connected identity lacks the Exchange role, scope, or ownership required by the cmdlet.
- The session is stale, connected to the wrong tenant, or blocked by service health or workload policy.
Recommended fix
- Confirm whether the operation uses delegated, app-only, EWS, or Graph access.
- Review mailbox permissions, RBAC, and application access controls.
- Test the exact target mailbox and retain correlation information.
Verify
- Repeat the smallest operation that produced the failure.
- Confirm a fresh success in the authoritative service log or admin center, not only in the client UI.
- Record the new UTC timestamp and correlation/request ID so the retry can be distinguished from cached or older failures.
Escalate when
- The failure persists after the documented prerequisites and a new authentication/session attempt.
- Multiple users, apps, devices, or networks show the same error, suggesting tenant policy or service scope.
- You can provide the exact UTC time, tenant, application/resource, correlation or request ID, and sanitized logs.
Inspect the Exchange Online session
Get-ConnectionInformation | Format-List UserPrincipalName,TenantID,ConnectionId,State,TokenStatusRead-only. Run after Connect-ExchangeOnline and redact identifiers before sharing.
Admin context
Graph API consent and Exchange workload authorization can both affect mailbox access.
Evidence to preserve
- UTC timestamp and correlation/request ID
- Tenant, application, resource, and authentication flow
- Sanitized service log details and exact operation
Advertisement