Chapter purpose
Translate the historical Exchange warning about mailbox rights into modern permission types, approval and audit practice.
Learning objectives
- Distinguish Full Access, Send As and Send on Behalf.
- Understand that Full Access does not automatically grant send permission.
- Require approval and ownership for sensitive delegation.
- Review and remove stale mailbox permissions.
Why this matters in a real company
Delegation lets assistants, teams and shared mailboxes work efficiently, but invisible or stale access can expose confidential mail or enable impersonation.
3.1 Full Access is mailbox content access
Microsoft describes Full Access as permission to open and manage mailbox contents. It does not, by itself, grant Send As or Send on Behalf.
Full Access can expose items marked Private, so it should never be treated as a harmless convenience permission.
3.2 Send As and Send on Behalf communicate different identity
Send As makes the message appear to come from the mailbox/group. Send on Behalf visibly identifies the delegate. Choose based on business requirement and transparency.
Do not grant both by habit.
3.3 Shared mailbox governance
Shared mailboxes should have a named business owner, approved members, purpose and review cycle. Remove access when staff change roles.
Where group-based permission assignment is supported and operationally appropriate, it can improve reviewability compared with many individual entries.
3.4 Review with PowerShell
Exact cmdlets and outputs differ between Exchange Server and Exchange Online. Use the correct environment and read-only inventory before changes.
Get-MailboxPermission shared@example.com
Get-RecipientPermission shared@example.com
Get-Mailbox shared@example.com | Select-Object GrantSendOnBehalfTo3.5 Emergency access
Break-glass or investigation access should be exceptional, approved, time-limited and logged. Administrator capability does not remove privacy obligations.
Executive assistant needs to send calendar responses
The assistant needs mailbox access and must sometimes send messages representing the executive.
Decision: Choose the minimum permission set that meets the workflow, document approval and set review/expiry expectations.
What to prove: Test mailbox access and sender display behavior, then retain permission inventory.
Hands-on lab
Create a permission matrix for a shared mailbox, executive mailbox and helpdesk mailbox. Decide Full Access, Send As or Send on Behalf for each role and justify the choice.
Troubleshooting exercise
- User can open mailbox but cannot send. Check send permission separately.
- Message shows delegate on behalf when business expected mailbox identity. Check permission type.
- Former employee still appears in delegation. Review stale permissions.
Field checklist
- Business owner approves access.
- Permission type matches task.
- Sensitive mailboxes reviewed more frequently.
- Stale delegation removed.
- Emergency access time-limited.
- Audit evidence retained.
Chapter summary
Mailbox delegation is an identity and privacy decision, not merely a convenience setting. Grant the minimum capability and keep ownership visible.
Current technical references
The supplied historical books are used as curriculum and operational context. Current implementation details are checked against current Microsoft documentation.