Home · Lessons

Access requests

How to give someone access to a shared mailbox with AD groups

A shared mailbox is used by a whole team, so who can open it matters. Most requests are simple: add a new colleague. The mistakes happen when the wrong mailbox is chosen or when access that should have ended is left in place. This lesson covers the order of steps for granting and removing access through group membership.

1. Confirm the request and pick the right mailbox

Check three things before you change anything: who needs access, which mailbox, and who approved it. Organisations usually have one shared mailbox per team, so a request for "the shared mailbox" can mean more than one. If the ticket does not make clear which one, ask. Confirm that the person is in the team the mailbox belongs to, or that the mailbox owner has approved the request.

2. Check what the user already has

Look at the user's current groups first. They may already have access, or they may be in a group that suggests the request is for a different mailbox than the one named.

Get-ADPrincipalGroupMembership -Identity treyes

3. Add the user to the mailbox's group

In many organisations, access to a shared mailbox is granted to a security group, and people get access by being in that group. Add the user to the group for the right mailbox, and nothing else.

Add-ADGroupMember -Identity Shared-Mailbox-Nursing -Members treyes

Adding someone to every mailbox group "to be safe" is a mistake. It gives access to messages they have no reason to see, which can include patient or staff information. Grant only what was asked for.

4. Remove access that should not be there

Requests also come the other way: someone moved teams, was added to the wrong mailbox, or is going on leave. Remove them from the mailbox group only. Their other groups, such as their department group, stay as they are.

Remove-ADGroupMember -Identity Shared-Mailbox-Nursing -Members lchen

Check that you are removing the right person. Someone with a similar name or role, who legitimately needs the mailbox, must keep their access.

5. Expect a delay, then confirm

A change to group membership may not show up straight away. The user may need to sign out and back in, and the mailbox may take some time to appear in their email program. Tell them this when you reply, so they do not report a fault. Ask them to confirm they can open it.

6. Record what you did

Note in the ticket who asked, who approved, which mailbox, who was added or removed, and when. Access to shared mailboxes is something auditors and managers ask about later.

What about Exchange Online?

This lesson is for organizations where access to a shared mailbox is controlled by an Active Directory group, as in on-premises or hybrid Exchange. If your mail runs only in Exchange Online, access is usually granted directly on the mailbox, as Full Access, Send As, or Send on Behalf. The checks are the same: confirm the request, pick the right mailbox, grant only what was asked, and record it. The commands are different, and the Exchange Online lesson covers them.