#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : A shared mailbox or delegate access is missing, read-only, or will not send
    Fix   : Grant the right sending permission
    Source: https://jbtecwiz.com/support/win-office-shared-mailbox

    Run as     : Exchange Online PowerShell, as an administrator
    Expect     : 40 minutes
    Risk       : low
    Reversible : yes

    WHEN THIS IS THE RIGHT FIX
    Reading works and sending is refused.

    HOW TO UNDO IT
    Remove-RecipientPermission withdraws Send As; @{Remove='...'} withdraws
    Send on Behalf.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

# - THIS SCRIPT WILL NOT RUN UNTIL YOU EDIT IT -
# The commands below contain values only you can supply. Search the
# script for each one, replace it, then delete this block.
$script:MustEdit = @(
    'example.com'   # a placeholder domain
)
if ($script:MustEdit.Count) {
    Write-Host ""
    Write-Host '  This script needs editing before it can run.' -ForegroundColor Yellow
    Write-Host '  Replace each of these with a real value:' -ForegroundColor Yellow
    $script:MustEdit | ForEach-Object { Write-Host ("    " + $_) -ForegroundColor Yellow }
    Write-Host ""
    Write-Host '  Then delete the $script:MustEdit block near the top.'
    Write-Host ""
    exit 2
}

# This fix is documented as needing an elevated session.
$id = [Security.Principal.WindowsIdentity]::GetCurrent()
if (-not (New-Object Security.Principal.WindowsPrincipal $id).IsInRole(
        [Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host ''
    Write-Host '  This fix needs an elevated PowerShell.' -ForegroundColor Yellow
    Write-Host '  Close this window, right-click PowerShell, Run as administrator,'
    Write-Host '  and run the script again.'
    Write-Host ''
    exit 3
}

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 5"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  A shared mailbox or delegate access is missing, read-only, or will not send' -ForegroundColor White
Write-Host '  Grant the right sending permission' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: low   Reversible   40 minutes'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Decide which of the two is wanted. Send As makes the message appear to come from the shared mailbox alone. Send on Behalf shows "Person on behalf of Shared Mailbox" in the recipient''s client.' -Why 'This is a business decision rather than a technical one, and getting it wrong is visible to every external recipient. Ask before granting.' -Manual

Invoke-Step -Number 2 -Do 'Check what is currently granted. They are stored in two different places, which is why one can be present and the other missing.' -Command {
    Get-RecipientPermission -Identity shared@example.com | Select-Object Trustee, AccessRights
    Get-Mailbox -Identity shared@example.com | Select-Object -ExpandProperty GrantSendOnBehalfTo
}

Invoke-Step -Number 3 -Do 'Grant Send As if that is what is wanted.' -Command {
    Add-RecipientPermission -Identity shared@example.com -Trustee person@example.com -AccessRights SendAs -Confirm:$false
}

Invoke-Step -Number 4 -Do 'Or grant Send on Behalf instead. Note this replaces the whole list rather than adding to it, so include everyone who should have it.' -Why 'Using @{Add=...} rather than a plain assignment is what stops this quietly removing everyone else who already had the right.' -Command {
    Set-Mailbox -Identity shared@example.com -GrantSendOnBehalfTo @{Add='person@example.com'}
}

Invoke-Step -Number 5 -Do 'Allow up to an hour, then have the user restart Outlook and send a test message. They must set the From field to the shared mailbox -- it does not switch on its own.' -Manual

Write-Rule "  Confirm it worked"
Show-Prose 'A test message sends from the shared address and arrives showing the sender you expected.' 'White'

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/win-office-shared-mailbox' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: Remove-RecipientPermission withdraws Send As; @{Remove=''...''} withdraws Send on Behalf.' 'DarkGray'
Write-Rule