Home · Lessons
Cloud mail
How to give someone access to a shared mailbox in Exchange Online
Most organizations now run their mail in Exchange Online. A new starter needs to read a shared mailbox and reply from it. In Exchange Online those are separate permissions, and mixing them up is the most common mistake.
1. Know the three permissions
- Full Access lets the person open the mailbox and read, move, and delete what is in it. It does not let them send as the mailbox.
- Send As lets them send mail that appears to come from the shared address itself.
- Send on Behalf lets them send mail that shows as sent by them on behalf of the shared mailbox.
Read the request closely. "Read and reply as support@" needs Full Access and Send As together.
2. Connect and pick the right mailbox
Connect to Exchange Online PowerShell, then list the shared mailboxes. Names are often similar, so check the address and ask if the ticket is unclear.
Connect-ExchangeOnline
Get-Mailbox -RecipientTypeDetails SharedMailbox3. Grant Full Access
Add-MailboxPermission -Identity [email protected] -User [email protected] -AccessRights FullAccess -InheritanceType AllBy default the mailbox then opens automatically in the user's Outlook. That is called auto-mapping. To turn it off, add -AutoMapping $false when you grant the permission.
You can't change auto-mapping on an existing grant. Remove the Full Access permission and add it again with the setting you want. Auto-mapping also only works for individual users, not for groups, so a mailbox shared through a group won't open by itself.
4. Grant Send As
Add-RecipientPermission -Identity [email protected] -Trustee [email protected] -AccessRights SendAs5. Grant Send on Behalf, if that is what was asked
Send on Behalf is set on the mailbox itself. Use Add and Remove so you don't overwrite the people who already have it.
Set-Mailbox -Identity [email protected] -GrantSendOnBehalfTo @{Add="[email protected]"}To see who has it, check the mailbox. The permission commands in steps 3 and 4 do not list Send on Behalf.
Get-Mailbox -Identity [email protected] | Format-List GrantSendOnBehalfTo6. Remove access that should end
When someone leaves the team, remove each permission they hold. Check what they have first, because it is usually more than one kind.
Get-MailboxPermission -Identity [email protected]
Get-RecipientPermission -Identity [email protected]
Remove-MailboxPermission -Identity [email protected] -User [email protected] -AccessRights FullAccess
Remove-RecipientPermission -Identity [email protected] -Trustee [email protected] -AccessRights SendAsOnly remove what the request names. The same person may still need another mailbox.
7. Expect a delay, then confirm
Changes can take a while to show up in Outlook, and a restart of Outlook can help. Ask the user to check that they can open the mailbox and send as it, then record who asked, what you granted, and when.
Hybrid environments and roles
If mailboxes are still on-premises, or the organization is hybrid, some permissions are set in both places. Microsoft notes that Send As is not synchronized automatically between on-premises Exchange and Exchange Online. You also need an Exchange admin role that allows managing recipients, so check your role first.
Practice the on-premises version in the lab. Shared Mailbox Access is a free module that controls mailbox access with groups, as many hybrid organizations still do. The Exchange Online module, with these commands, is a paid module that is coming soon.