优化Exchange Online共享邮箱权限获取的PowerShell并行处理方案

问题背景 #

需要快速获取指定用户在Exchange Online中拥有“读取和管理”权限的共享邮箱、组邮箱、团队邮箱。现有单线程脚本逐个遍历邮箱调用API，耗时极长；尝试线程作业/并行处理后，虽然输出更快，但整体完成耗时仍久，疑似作业清理阶段阻塞。

最优解决方案：反向查询（推荐） #

不要逐个邮箱检查用户权限，直接查询用户拥有的所有邮箱权限，这是Exchange Online原生支持的高效方式，只需1次API调用即可获取所有数据，性能提升数量级，且支持实时输出。

通用脚本（PowerShell 5.1/7均适用） #

function Show-ReadManageMailboxes {
    param(
        [Parameter(Mandatory=$true)]
        [string]$UserEmail,
        [Parameter(Mandatory=$false)]
        [ValidateSet('SharedMailbox','GroupMailbox','TeamMailbox')]
        [string[]]$RecipientTypes = @('SharedMailbox','GroupMailbox','TeamMailbox')
    )

    Write-Host "获取用户拥有「读取和管理」权限的邮箱，请稍候..." -ForegroundColor DarkCyan

    # 直接查询该用户的所有邮箱权限，过滤目标权限和邮箱类型
    Get-EXOMailboxPermission -User $UserEmail -ResultSize Unlimited |
        Where-Object {
            # 筛选"读取和管理"权限（对应FullAccess权限）
            $_.AccessRights -contains 'FullAccess' -and
            # 排除自身邮箱
            $_.UserPrincipalName -ne $UserEmail -and
            # 筛选目标邮箱类型
            $RecipientTypes -contains $_.RecipientTypeDetails
        } |
        Select-Object @{Name='Display Name'; Expression={$_.DisplayName}},
                      @{Name='UPN'; Expression={$_.UserPrincipalName}},
                      @{Name='Access Rights'; Expression={$_.AccessRights}} |
        Format-Table -AutoSize

    Write-Host "完成！" -ForegroundColor Green
}

# 调用示例
$targetUser = "Example.User@domain.com"
Show-ReadManageMailboxes -UserEmail $targetUser

方案说明 #

• 利用Get-EXOMailboxPermission -User $UserEmail直接获取用户的所有邮箱权限，避免遍历N个邮箱发起N次API请求
• 过滤条件中，FullAccess就是Exchange Online中“读取和管理”权限对应的权限标识
• 自动排除用户自身的邮箱，避免无效结果
• 支持自定义筛选邮箱类型，灵活适配需求

并行方案优化（特殊场景适用） #

如果因业务限制必须采用遍历邮箱+并行查询的方式，需解决API限流和作业阻塞问题：

PowerShell 5.1优化版 #

function Show-ReadManageMailboxes {
    param(
        [Parameter(Mandatory=$true)]
        [array]$MailboxesToSearch,
        [Parameter(Mandatory=$true)]
        [string]$UserEmail,
        [int]$ThrottleLimit = 15 # 控制并发数，避免触发Exchange API限流
    )

    Write-Host "获取用户拥有「读取和管理」权限的邮箱，请稍候..." -ForegroundColor DarkCyan

    $jobs = $MailboxesToSearch | ForEach-Object {
        Start-ThreadJob -ThrottleLimit $ThrottleLimit {
            $mailbox = $using:_
            $permission = Get-EXOMailboxPermission -Identity $mailbox.Identity -User $using:UserEmail -ErrorAction SilentlyContinue
            if ($permission -and $permission.AccessRights -contains 'FullAccess') {
                [PSCustomObject]@{
                    "Display Name"  = $mailbox.DisplayName
                    "UPN"           = $mailbox.UserPrincipalName
                    "Access Rights" = $permission.AccessRights
                }
            }
        }
    }

    # 实时接收作业结果，自动清理完成的作业
    $jobs | Receive-Job -Wait -AutoRemoveJob | Format-Table -AutoSize

    Write-Host "完成！" -ForegroundColor Green
}

# 调用示例
$targetUser = "Example.User@domain.com"
$allMailboxes = Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails SharedMailbox, GroupMailbox, TeamMailbox
Show-ReadManageMailboxes -MailboxesToSearch $allMailboxes -UserEmail $targetUser

PowerShell 7优化版 #

function Show-ReadManageMailboxes {
    param(
        [Parameter(Mandatory=$true)]
        [array]$MailboxesToSearch,
        [Parameter(Mandatory=$true)]
        [string]$UserEmail,
        [int]$ThrottleLimit = 15
    )

    Write-Host "获取用户拥有「读取和管理」权限的邮箱，请稍候..." -ForegroundColor DarkCyan

    $MailboxesToSearch | ForEach-Object -ThrottleLimit $ThrottleLimit -Parallel {
        $mailbox = $_
        $permission = Get-EXOMailboxPermission -Identity $mailbox.Identity -User $using:UserEmail -ErrorAction SilentlyContinue
        if ($permission -and $permission.AccessRights -contains 'FullAccess') {
            [PSCustomObject]@{
                "Display Name"  = $mailbox.DisplayName
                "UPN"           = $mailbox.UserPrincipalName
                "Access Rights" = $permission.AccessRights
            }
        }
    } | Format-Table -AutoSize

    Write-Host "完成！" -ForegroundColor Green
}

# 调用示例
$targetUser = "Example.User@domain.com"
$allMailboxes = Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails SharedMailbox, GroupMailbox, TeamMailbox
Show-ReadManageMailboxes -MailboxesToSearch $allMailboxes -UserEmail $targetUser

并行方案优化点 #

• 设置合理的ThrottleLimit（推荐10-20），避免触发Exchange Online的API调用频率限制
• 在作业内部直接过滤有效权限，减少返回的数据量
• PowerShell 5.1中使用Receive-Job -AutoRemoveJob自动清理完成的作业，避免作业堆积导致的阻塞
• 直接传递邮箱的Identity属性，减少对象序列化开销

内容的提问来源于stack exchange，提问作者Nova