Export Shared Mailbox Delegates from Exchange Online (and Why PowerShell ISE Breaks It)

<#
Shared mailbox delegate export (WinPS 5.1)

- NO [CmdletBinding()] and NO param() block
- Exports ONLY:
    C:\temp\SharedMailboxes.csv
- Captures:
    * Full Access
    * Send As
    * Send on Behalf
- Auto re-launches out of PowerShell ISE into console and keeps it open
#>

# ===================== SETTINGS =====================
$AdminUPN                = $null
$OutputPath              = "C:\temp"
$IncludeInherited        = $false
$IncludeSystemPrincipals = $false
# ====================================================

Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

function Ensure-Tls12 {
    try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}
}

function Ensure-ExchangeOnlineModule {
    if (-not (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
        throw "ExchangeOnlineManagement module not found."
    }
    Import-Module ExchangeOnlineManagement -ErrorAction Stop | Out-Null
}

function Connect-EXO {
    param([string]$AdminUPN)

    $cmd = Get-Command Connect-ExchangeOnline -ErrorAction Stop
    $params = @{ ShowBanner = $false }

    if ($AdminUPN -and $cmd.Parameters.ContainsKey('UserPrincipalName')) {
        $params['UserPrincipalName'] = $AdminUPN
    }

    Connect-ExchangeOnline @params
}

function Should-IncludePrincipal {
    param([string]$Principal)

    if ($IncludeSystemPrincipals) { return $true }
    if ($Principal -match '^NT AUTHORITY\\SELF$') { return $false }
    if ($Principal -match '^NT AUTHORITY\\SYSTEM$') { return $false }
    if ($Principal -match '^S-1-5-') { return $false }
    if ($Principal -match '^Microsoft Exchange$') { return $false }
    if ($Principal -match '^ExchangeOnlineProtection\\') { return $false }
    return $true
}

$script:RecipientCache = @{}
function Resolve-RecipientCached {
    param([string]$Identity)

    if ($script:RecipientCache.ContainsKey($Identity)) {
        return $script:RecipientCache[$Identity]
    }

    try {
        $r = Get-Recipient -Identity $Identity -ErrorAction Stop
        $obj = [pscustomobject]@{
            DisplayName          = $r.DisplayName
            PrimarySmtpAddress   = $r.PrimarySmtpAddress.ToString()
            RecipientTypeDetails = $r.RecipientTypeDetails
        }
    } catch {
        $obj = [pscustomobject]@{
            DisplayName          = $Identity
            PrimarySmtpAddress   = ""
            RecipientTypeDetails = ""
        }
    }

    $script:RecipientCache[$Identity] = $obj
    return $obj
}

# -------------------- ISE auto re-launch --------------------
if ($Host.Name -like "*ISE*") {
    $escaped = $PSCommandPath.Replace("'", "''")
    Start-Process powershell.exe -ArgumentList @(
        '-NoExit','-ExecutionPolicy','Bypass','-NoProfile',
        '-Command', "& '$escaped'; Write-Host 'Press Enter to close'; Read-Host"
    )
    return
}

# -------------------- main --------------------
Ensure-Tls12
Ensure-ExchangeOnlineModule

if (-not (Test-Path $OutputPath)) {
    New-Item -ItemType Directory -Path $OutputPath | Out-Null
}

Write-Host "Connecting to Exchange Online..." -ForegroundColor Cyan
Connect-EXO -AdminUPN $AdminUPN

$detail = New-Object System.Collections.Generic.List[object]

$sharedMbx = Get-Mailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited

foreach ($mbx in $sharedMbx) {
    $id = $mbx.Identity
    $primary = $mbx.PrimarySmtpAddress.ToString()

    Get-MailboxPermission $id | Where-Object {
        $_.AccessRights -contains "FullAccess" -and -not $_.IsInherited -and -not $_.Deny
    } | ForEach-Object {
        if (Should-IncludePrincipal $_.User) {
            $r = Resolve-RecipientCached $_.User
            $detail.Add([pscustomobject]@{
                Mailbox        = $primary
                PermissionType = "FullAccess"
                DelegateName   = $r.DisplayName
                DelegateSMTP   = $r.PrimarySmtpAddress
                DelegateType   = $r.RecipientTypeDetails
            })
        }
    }

    Get-RecipientPermission $id | Where-Object {
        $_.AccessRights -contains "SendAs"
    } | ForEach-Object {
        if (Should-IncludePrincipal $_.Trustee) {
            $r = Resolve-RecipientCached $_.Trustee
            $detail.Add([pscustomobject]@{
                Mailbox        = $primary
                PermissionType = "SendAs"
                DelegateName   = $r.DisplayName
                DelegateSMTP   = $r.PrimarySmtpAddress
                DelegateType   = $r.RecipientTypeDetails
            })
        }
    }

    foreach ($sob in $mbx.GrantSendOnBehalfTo) {
        if (Should-IncludePrincipal $sob) {
            $r = Resolve-RecipientCached $sob
            $detail.Add([pscustomobject]@{
                Mailbox        = $primary
                PermissionType = "SendOnBehalf"
                DelegateName   = $r.DisplayName
                DelegateSMTP   = $r.PrimarySmtpAddress
                DelegateType   = $r.RecipientTypeDetails
            })
        }
    }
}

$detail | Export-Csv -NoTypeInformation -Encoding UTF8 -Path "$OutputPath\SharedMailboxes.csv"

Write-Host "Export complete: $OutputPath\SharedMailboxes.csv" -ForegroundColor Green