Managing calendar permissions with PowerShell on Microsoft 365 / Exchange Online will often require you to use PowerShell a bit. I can explain how to perform typical day-to-day admin tasks involving calendar permissions, using PowerShell.

Before managing permissions, you need to connect to Exchange Online through PowerShell. Once connected, you can view existing calendar permissions, add new permissions, edit existing calendar permissions, and remove calendar permissions.

Connect to Exchange Online via PowerShell

Connecting to Exchange Online via PowerShell requires just a few commands. Follow the instructions below to connect to Exchange Online from your PowerShell prompt.

• Launch PowerShell from Workstation
• Run the Following Four Commands in Order:

Set-ExecutionPolicy RemoteSigned -Force
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session

The above script will prompt you for O365 credentials. When prompted, supply your credentials for the O365 tenant you are trying to manage.

If you know how to use PowerShell, you can easily write a script to automate this.

Viewing Calendar Permissions with PowerShell

Before setting / updating / removing permissions from an O365 calendar, it is a good idea to see what permissions currently exist on it so they can be set back to their original permissions if you make a mistake. To list the permissions on a calendar using PowerShell, run the Get-MailboxFolderPermission command in PowerShell after you have connected to Exchange Online.

Get-MailboxFolderPermission -Identity <user@company.com>:\Calendar

You would obviously replace john@contoso.com with the user whose calendar permissions you want to view. If you prefer, you can pipe the output to a CSV file as well by appending | Export-CSV c:\filepath\filename.csv to the command:

Get-MailboxFolderPermission -Identity <user@company.com>:\Calendar | Export-CSV c:\filepath\filename.csv

Replace filepath with the path to the file you are creating and filename with the name you want to give the CSV file.

Removing Calendar Permissions with PowerShell

Removing existing permissions from a calendar in O365 with PowerShell requires just a single command (Remove-MailboxFolderPermission). To run it, make sure you have connected to Exchange Online via PowerShell and then run the command below. In the example below, we are removing John’s access from Jen’s calendar:

Remove-MailboxFolderPermission -Identity <user@company.com>:\Calendar -User john@contoso.com

Adding Permissions to a Calendar with PowerShell

The Add-MailboxFolderpermission PowerShell command is used to add permissions to a calendar. You can only ADD permissions to a calendar for a user if there are not already permissions configured. If you need to UPDATE permissions that already exist, you would use the Set-MailboxFolderPermission command.

To clarify, let’s use the following example:

Jimmy is a new hire at Contoso. He has not yet been given any permissions to User’s calendar and now needs “Reviewer” access. Since he currently has no permissions to Jen’s calendar, you would use the command below to add his permissions to Jen’s calendar:

Add-MailboxFolderPermission -Identity <user@company.com>:\calendar -user <jimmy@company.com> -AccessRights Reviewer

If Jimmy already had permissions (i.e. Editor, Author, etc) to User’s calendar, running the Add-MailboxFolderPermission command would have generated an error indicating permissions already exist. In that case, you would use the Set-MailboxFolderPermission command instead (see below).

Changing Permissions on a Calendar in O365 with PowerShell

Changing permissions that already exist on the calendar in O365 requires a different command. Instead of running the Add-MailboxFolderPermission PowerShell command, you should run the Set-MailboxFolderPermission command when you need to update pre-existing permissions.

For example, if John already has Reviewer access to Jen’s calendar, you will use the command below to change the permissions to Editor:

Set-MailboxFolderPermission -Identity user@company.com:\Calendar -User jimmy@ company.com -AccessRights Editor

If you try to run the command above, it will fail if existing permissions are not already in place.

Available Calendar Permissions with PowerShell

There are 10 available roles that you can set on calendars. They are:

• Owner.  Allows read, create, modify and delete all items and folders. Also allows managing items permissions
• PublishingEditor.  Allows read, create, modify and delete items/subfolders.
• Editor.  Allows read, create, modify and delete items.
• PublishingAuthor.  Allows read, create all items/subfolders. You can modify and delete only items you create.
• Author.  Allows create and read items; edit and delete own items.
• NonEditingAuthor.  Allows full read access and create items. You can delete only your own items.
• Reviewer.  Read only.
• Contributor.  Allows create items and folders.
• AvailabilityOnly.  Allows read free/busy information from calendar
• LimitedDetails.  Allows view of the subject and location.
• None.  No permission to access folder and files.

You may use any of the above roles when setting permissions on calendars in O365 with PowerShell.

Summary or Calendar Permissions with PowerShell

Managing calendars in M365 with PowerShell requires familiarity with four commands:

The Get-MailboxFolderPermission command is used to view existing permissions.

The Remove-MailboxFolderPermission is used to remove existing permissions. 

Add-MailboxFolderPermission is used to add NEW permissions to a calendar and

Set-MailboxFolderPermission is used to modify EXISTING permissions on the calendar.

If you are a larger organization, you are probably still running Classic Outlook or just Outlook as we like to call it. Now you need to evaluate New Outlook vs Classic Outlook because Microsoft is mandating that you do….

It is better to go eyes wide open into this. Changing the toggle to evaluate New Outlook is one thing but if you don’t know the changes (translation: features they have changed or taken away) you are in for a big surprise. When it comes default on all M365 installations. At least they left the toggle visible and business customers have support until 2029.

I have compared both versions and here are 4 features I have found that might leave you scrambling after the switch if you are not careful….

New Outlook vs Classic Outlook – Public Folders

I will start with what night be the most detrimental change for some organizations. No, public folders are not dead but they are on life support. In true Microsoft fashion, instead of just saying “This feature will be retired by X Date” they transition functionality from Good to Bad to Worse to Non-existent and that’s precisely what they are doing now.

I would say it is the worse stage now. The only way I could get access to Public folders in New Outlook was to not use it. I had to go to Outlook on the web and then jump through hurdles to configure viewing it. Try getting a normal user to do this. They will tell you to “go pound salt”.

Signatures

I have already posted about this one. This change is also using Microsoft’s “slight of hand”. To get users to transition in newer versions of Classic outlook, they added a dropdown box allowing you to still store signatures locally in the app but also choose to put a signature in the cloud (available to all devices that login to Outlook). I suggested manually copying and pasting you signature from local to cloud. Once you switch to New Outlook the ability to do this will be gone.

PST Files

To discourage users from continuing to use PST files they make it difficult to mount them. What happens is after the switch your PST file get disconnected and you will have to re-mount them. Maybe Microsoft was hoping you would forget about them LOL. You will have to jump through some hoops to get them mounted after you switch.

Shared Tasks

It can be done but is now done through “To-Do”. The behavior is different than the old, shared tasks. I am not sure if old shared tasks are transferred without issue during the switch. My testing so far shows that shared tasks will need to be recreated. This will be a problem for uses who live and die with this feature.

Verdict of New Outlook vs Classic Outlook

It will be like any switch to any newer version of software when comparing New Outlook vs Classic Outlook. There will be a core group of users who will bemoan the change. To them, it is a major disruption of their work flow. But to most it will primarily go unnoticed. They will just notice the shiny new look of the screens and buttons. Ignorance might be bliss for most users but not for IT support!

You have used this command many times before but Set-MgUserLicense Not Working? Why? There could be many reasons why but I am here to tell you of one particular reason in my travels with PowerShell.

Why Use Set-MgUserLicense Not Working

Set-MgUserLicense is very helpful when assigning or un-assigning licenses to several users. The portal does not make it very easy to do this. Sure, if you have a handful of licenses to deal with it is not a problem. But what if you have to work with hundreds or thousands of users at once? PowerShell is the way to go but what if it is not working?

Don’t Use Connect-MsolService to do this

It is now depreciated and you will either get an error message saying so or even worse, it will look like it ran but nothing has happened. If you are trying to re-assign a bunch of licenses from a new provider and you thought it worked but then on Monday your helpdesk lights up like a Christmas Tree, you know it didn’t work and you have a huge problem on your hands.

One big Tip to Prevent Set-MgUserLicense Not Working

Check the version of the Microsoft.Graph Module you are running:

Get-InstalledModule

Version              Name                                Repository           Description                                                                                                                                                                        
-------              ----                                ----------           -----------                                                                                                                                                                              
 Authentication Module.                                                                                                                                  
2.24.0               Microsoft.Graph.BackupRestore       PSGallery            Microsoft Graph PowerShell Cmdlets                                                                                                                                                 
2.24.0               Microsoft.Graph.Bookings            PSGallery            Microsoft Graph PowerShell Cmdlets                                                                                                                                                 
2.24.0               Microsoft.Graph.Calendar            PSGallery            Microsoft Graph PowerShell Cmdlets                                                                                                                                                 
2.24.0               Microsoft.Graph.ChangeNotifications PSGallery            Microsoft Graph PowerShell Cmdlets                                                                                                                                                 
2.24.0               Microsoft.Graph.CloudCommunications PSGallery            Microsoft Graph PowerShell Cmdlets                                                                                                                                                 
2.24.0               Microsoft.Graph.Compliance          PSGallery            Microsoft Graph PowerShell Cmdlets                                                                                                                                                 
2.24.0               Microsoft.Graph.CrossDeviceExper... PSGallery            Microsoft Graph PowerShell Cmdlets                                                                                                                                                 
2.24.0               Microsoft.Graph.DeviceManagement    PSGallery            Microsoft Graph PowerShell 

This is just a snapshot of the many Graph modules but as you can see here, I have version 2.24.0 of the Microsoft.Graph Module installed. The problem occurred when I was at a higher version (name 2.26.0). Downgrading did the trick.

Uninstall-Module -Name Microsoft.Graph -AllVersions

Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery -Force -RequiredVersion 2.24.0

Do this and you will solve Set-MgUserLicense Not Working

Teams Meeting Make Sure You’re Signed in (two ways to Fix) 

You see the dreaded “To schedule a Teams meeting, make sure you’re signed in to Teams”, But you are you say!! If you are still using classic teams this is an issue. It shouldn’t be after July 2025 so you better upgrade. 

There are a myriad of ways to fix it but ultimately it is an issue with the add-in needing to be re-loaded. If you must resort to the link above, there is a lot more going on with not just Teams but Outlook too. 

The Good news is the new Outlook does not need the Teams Add-in so eventually it won’t be problem. There are two ways we can tackle this. One if you are a regular user or an admin with only a few users or two or an admin who has a lot of users! 

Fix Teams Meeting Make Sure You’re Signed in for Only a Few Users 

It is very simple, you need to: 

1. Close Outlook. 

2. Sign out of Teams 

3. Sign back into Teams. 

4. Open Outlook 

If that doesn’t work, then: 

1. Close Outlook 

2. To resolve the add-in issue, you can uninstall the Teams add-in completely. Then reinstall it. Go to Add or remove programs in System settings. 

3. Uninstall Microsoft Teams Add-in for Outlook.  

4. When you start Outlook, it will reinstall the Add-in 

Admin Fix Teams Meeting Make Sure You’re Signed in for A lot of Users 

I hope you like batch files! If you have never used them before, here is a good tutorial. They are good for a lot of things, even Teams. You can create a batch file that performs the first sub step above and you can put it somewhere on your on-prem file server and get them to run it when they get the error message. 

First create a folder to hold the batch files. Name it something like “ReinstallTeamsAddin” or something. The folder will hold three files. A main file that runs the commands necessary to execute the batch and two sub batch files that are called from the main batch file. 

Main Batch File 

REM ***BATCH FILE BEGINS...*** 

taskkill /im OUTLOOK.exe 

start /min CallTeams.bat 

timeout /t 35 /nobreak 

taskkill /im TEAMS.exe 

start /min CallOutlook.bat 

Exit 

Call Teams Batch File 

cd "C:\Program Files (x86)\Microsoft\Teams\current\" – You need to make sure this is the right path 

teams.exe 

Exit 

Call Outlook File 

cd "C:\Program Files (x86)\Microsoft Office\root\Office16" – You need to make sure this is the right path 

start OUTLOOK.EXE 

Exit 

What Teams Meeting Make Sure You’re Signed in Batch Does 

If Outlook is Open, it closes it (since it needs to be closed to reload the add-in). Teams will open. One of three things will happen (one, it will load the main window, two, it will ask you to log in or three, it will tell you there was an error. Click “sign out and sign back in. Do not restart Teams, it does work). 

The batch file gives you 35 seconds to do this. You can set whatever time you want but it must be enough for the user to reload teams. 

Teams will close after the time expires and Outlook will reopen allowing the add-in to reload. 

Easy Peasy…. 

Have you just tried to do this? Samsung S25 and Intune Enrollment Fails. It fails and for the stupidest reason. Read Below.

What is Supposed to Happen 

With Intune enrollment, once you have created an enrollment profile all you need to do is take an Android phone, tap the screen five time and then scan the QR code to begin the process. Easy, right? 

Why Samsung S25 and Intune Enrollment Fails 

Well, all is fine and dandy in the process until you get to the screen where you must pick a Category for your devices. This is something you have set up beforehand to separate your devices (i.e. Office Mobiles, Office Computers, etc.…). 

Samsung has done something with their UI where you can’t tap OK to get to the next screen. There is a grey bar or something that covers the OK button preventing you from tapping it. 

How To Fix Samsung S25 and Intune Enrollment Fails 

It is not a fix but a workaround. This is something Samsung needs to fix quickly. There is going to be a lot of fuss over this. In the meantime, you can work around it by doing the following. 

Once you get to the screen above, you can go no further, Shut the phone off. It is already registered in Intune. You can finish the set up there. 

Go to https://intune.microsoft.com/?ref=AdminCenter#view/Microsoft_Intune_DeviceSettings/DevicesAndroidMenu/~/androidDevices 

And search for the device you were settings up. It starts with the username of whom your were enrolling in Intune. 

Then click on the device, which brings it to its screen. Click Properties and give it a device category: 

Save the entry and restart the Android Phone. You will then continue with the enrollment process as if nothing was wrong (But there was a lot wrong LOL). 

Hopefully you haven’t got a huge batch of S25’s to enroll in your organization. Until Samsung fixes this (or Microsoft), it’s gonna be a long night! 

You may not know this, but if you don’t Disable Per User MFA for your users before you start enforcing it with Conditional Access, it wreaks havoc with your policies. I found this out the hard way. I had to disable MFA for a group of users who were in a session that would make using MFA rather cumbersome. 

What Happens when you have both Per User MFA and Conditional Access for MFA  

Microsoft recommends that you completely disable Per User MFA. If you don’t use Per User MFA but it still enabled on some accounts, it takes precedence over conditional access. This is why some of your users get exempted from a conditional access policy for MFA and some do not. It makes it difficult to troubleshoot MFA issues. I know! 

Why Disable Per User MFA With MS Graph 

There are a couple of reasons why you would want to do this. One, you have users logging in from a single location that is trusted and secure. There is no need to have them constantly verifying their identity when all they are trying to do is work. Two, you have a temporary need, and it makes sense for your users to not have to use MFA for the work they are doing (i.e. software training). 

I will discuss two ways you can fix this issue.  

Note: the Ways I am about to describe require you to have at least the Authentication Policy Administrator Role to administer MFA Status. 

Disable Per User MFA Through the Portal 

This way is simple. I would use it if you only had a few users to do. Go to the portal and in the Per User MFA section, check the user and then click disable MFA above: 

Disable Per User MFA Using Microsoft Graph 

This is the better way to go to disable per user MFA if you have several users. First you need to export users to a csv using the portal. From that CSV file, you need to take the Object ID column and put it in it’s own CSV with the Column heading ObjectID. Make sure the CSV file is named ObjectID.csv and it resides in the same folder as the script. 

Here is the script: 

# This Requires the PIM of "Authentication Policy Administrator". If you get a 403 error this is why. 

 
Connect-MgGraph -Scopes "User.Read.All", "Policy.ReadWrite.AuthenticationMethod" 



#Path to UPN File # 

 

$CSVPathUPN = ".\ObjectID.csv" 

 

##Run Script## 



##Try import UPN CSV file## 

 
Write-Host Importing CSV 
 

try { 

    $MFAUsers = import-csv $CSVPathUPN -ErrorAction stop 

} 

catch { 

    throw "Error importing CSV: $($_.Exception.Message)" 

    break 

} 

 

foreach ($MFAUser in $MFAUsers) { 

 

# Fill in user ID 

$userid = $MFAUser.ObjectID 

 

# MFA status 

$body = @{"perUserMfaState" = "disabled" } 

 

# Invoke the request to update MFA status 

Invoke-MgGraphRequest -Method PATCH -Uri "/beta/users/$userid/authentication/requirements" -Body $body 


} 
 

Write-Host All Users Per User MFA set to Disabled  

Microsoft is now making it virtually impossible Set Up Windows 11 Without Microsoft Account. It is frustrating to say the least. You know they are only doing it so they can collect even more information about you.

Windows has become more of a marketing machine than an Operating System. I miss the good old days when you could just set up a computer, install software and start working. This can still be done on Windows, but it is getting more difficult, and you need to know a little technical stuff to do it. Fortunately, you are here for a Quick Tip so I will give it to you.

Setting Up Windows 11 Without Microsoft Account

At “Let’s add your Microsoft Account” screen, asking to sign in:

Press Shift F10 (If you’re on a laptop that has Action Keys mode or something similar, you may need to Function Shift F10).

The command prompt appears.

Type into the command line.

ncpa.cpl

The Network connections screen appears.

Right click the Ethernet and or Wi-Fi whichever is connected.

Click Disable.

Close Network Connections.

Type into command line.

oobe\bypassnro

The computer will restart.

At “Let’s connect you to a network”, it should show it is Not connected

Then click I don’t have internet.

Microsoft will protest but check “Continue with limited setup”.

Enter the username you want to create and click next to continue Windows setup normally.

After setup, and you get to the desktop, there will be no internet.

Right click the world icon in bottom right taskbar.

Network and Internet Settings

Advanced Network Settings

Under Network adapters, for any that has a button labeled Enable, click Enable. They should all say Disable (Meaning they are Enabled, and you can Disable it)

Close Network & Internet settings

Proceed with configuration

Here is a great video to walk you through it if you are a more visual learner….

Why Set Up Windows 11 Without Microsoft Account?

This is a great question! As I mentioned before you just want to set up the computer and start working. You have no need to be constantly bombarded with advertisements and news about this and that. I am sure you have enough distractions and the las thing you need is to constantly slag off at work, that’s what solitaire is for! LOL

Or if you want, you could always go and try Linux……

So you are running a version of Outlook that does not store signatures in the cloud. Your company also does not use a cloud signature service like Code Two. You are moving to the New Outlook. How do you get your signature in the New Outlook. There are basically two ways to do this and I will show you both.

What has Microsoft Done?

Microsoft has decided that they want a more uniform experience across devices. So a better way to do this than by storing everything in the cloud (They are not there 100% but I guess they are trying). So, a lot of features that you had stored locally on the machine you were using will now be available to all devices that you have configured. Basically if you AD is Hybrid and you like to pull user info from your Domain controllers and store them locally and automatically, you won’t be able to do this anymore.

You Are Using a Really Old Version of Outlook – Signature in the New Outlook

In this case to get your signature in the New Outlook, when you go to File / Options / Mail / Signature you see only one option for for storing your signature. That is locally. There is no cloud option (You will see later in this article that there is an option where to store your signature). Your signature settings probably look like this:

The pretty signature that you so painfully created is stored here:

C:\Users\<your user name>\AppData\Roaming\Microsoft\Signatures

Simply put, if you Hit Win-R, then in the search box type %AppData%, it will take you to your profile. Navigate to Microsoft\Signatures and you will see your signature as an HTML file. read the following steps to get it into the cloud.

Getting Signature in the New Outlook

Note: You can use these steps on Outlook on the web too.

• Please take the HTML file that has opened in your default browser and select all (Ctrl-A) .
• Then copy it to your clipboard (Ctrl-C). Open Outlook and while in your inbox, go to “View”.

• At the top of the window and select “View Settings”.
• Type “email signature” into the search box you see at the top left and then click “+ New signature”.

• Give the signature a name in the “Email Signature” text box.
• Click in the text box below and press Ctrl-v to paste the signature you copied from step #2

• Click Save and you are all done!

Your Version of Outlook is Newer – Signature in the New Outlook

In this case your version of Outlook is at least 2019. you will see a Signature Settings Windows similar to this:

In this case you have a drop-down box for local and cloud signatures. This is Microsoft’s way to get you to move from local signatures to cloud ones. It is a hybrid way of storing signatures. But the new Outlook closes this loop hole and there is no option to do this. But I digress…..

In this case you take the content from “Signatures on this device” and copy it to the cloud signature (as noted by your Microsoft account in the drop down box). Paste it into the content text box and click save.

The New Outlook Way

Unfortunately there is no direct way. If you are lucky enough to be using an older version of Outlook before you switch, you can use one of the two methods above to get you signature into the cloud. If not you have to create it from scratch.