Here is what I ended up with:
(assumes input $alias with samaccountname/identity)
Get-MailboxPermission -Identity $alias | ForEach-Object {Remove-MailboxPermission -identity $_.Identity -user $_.User -AccessRights FullAccess -InheritanceType All -confirm: $false}
Get-MailboxPermission -Identity $alias | ForEach-Object {Remove-MailboxPermission -identity $_.Identity -user $_.User -AccessRights ReadPermission -InheritanceType All -confirm: $false}
$Permissions = Get-Mailbox -identity $alias | where {($_.Identity -like "*")} | Get-ADPermission | Where-Object { ($_.ExtendedRights -like "*send-as*") -and $_.User -notlike "*AUTHORITY*" }
if ($Permissions)
{
$Permissions | ForEach-Object{ Remove-ADPermission -identity $_.Identity -user $_.User -ExtendedRights "Send As" -confirm:$false }
}
$mb = Get-mailbox -Identity $alias
$mb.GrantSendOnBehalfTo = "CN=SomeAdminAccount,CN=Users,DC=ourdomain,DC=local"
Set-Mailbox -Identity $alias -GrantSendOnBehalfTo $mb.GrantSendOnBehalfTo
Could be made a bit more elegant, but good gets the job done.
Also works using remote powershell, something that often seems to fail with creative" solutions using piping.