Add-MailboxPermission | Office 365 Mailbox Delegation

Sometimes you need to grant a user access to another Office 365 mailbox. This is standard practice for shared mailboxes.

You may also need to delegate access to regular user mailboxes, e.g. if a secretary should manage a manager’s mailbox.

In Office 365, there are three types of delegation on a regular user mailbox:

Send As
Send on Behalf
Full Access

This post will show you how to perform the delegation using the PowerShell command Add-MailboxPermission.

You’ll also see how to do it via the Exchange Admin Center and via the standard AD Users & Computers management console.

Mailbox Delegation Using PowerShell

Use the Add-MailboxPermission PowerShell command to delegate access to your Office 365 mailbox. The below example shows you how:

Connect-ExchangeOnline
Add-MailboxPermission tycho.brahe@observatory.dk -User ole.roemer@observatory.dk -AccessRights FullAccess

Start by establishing a connection with Exchange Online (lines 1).
Delegate access to the mailbox using the Add-MailboxPermission command (line 2).

To review your change, use Get-MailboxPermission. The output may look similar to this:

PS C:\Windows\system32> Get-MailboxPermission tycho.brahe@observatory.onmicrosoft.com | ft User,AccessRights,IsInherited,Deny

User                                           AccessRights                                                            IsInherited Deny
----                                           ------------                                                            ----------- ----
NT AUTHORITY\SELF                              {FullAccess, ReadPermission}                                                  False False
niels.bohr@observatory.onmicrosoft.com         {FullAccess}                                                                  False False
EURP189\Administrator                          {FullAccess}                                                                   True True
EURP189\Domain Admins                          {FullAccess}                                                                   True True
EURP189\Enterprise Admins                      {FullAccess}                                                                   True True
EURP189\Organization Management                {FullAccess}                                                                   True True
EURP189\AM5P18901MB0148$                       {FullAccess}                                                                   True True
NT AUTHORITY\SYSTEM                            {FullAccess}                                                                   True False
NT AUTHORITY\NETWORK SERVICE                   {ReadPermission}                                                               True False
EURP189\Administrator                          {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner}        True False
EURP189\Domain Admins                          {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner}        True False
EURP189\Enterprise Admins                      {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner}        True False
EURP189\Organization Management                {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner}        True False
EURP189\Public Folder Management               {ReadPermission}                                                               True False
EURP189\Exchange Servers                       {FullAccess, ReadPermission}                                                   True False
EURP189\Exchange Trusted Subsystem             {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner}        True False
EURP189\Managed Availability Servers           {ReadPermission}                                                               True False
EURP189\AM5P18901MB0148$                       {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner}        True False
S-1-5-21-1589316702-2032257147-3807288276-5106 {ReadPermission}                                                               True False
PRDTSB01\JitUsers                              {ReadPermission}                                                               True False

Notice that there are a lot of default permissions.

You can clean up your output by using some filtering:

PS C:\Windows\system32> Get-MailboxPermission tycho.brahe@observatory.onmicrosoft.com | ? {$_.User -like 'ole.roemer*'} | ft User,AccessRights,IsInherited,Deny

User                                   AccessRights     IsInherited Deny
----                                   ------------     ----------- ----
ole.roemer@observatory.onmicrosoft.com {FullAccess}           False False

Mailbox Delegation Using Active Directory Users & Computers

A more convenient option is to perform the mailbox delegation using the Active Directory Users & Computers management console.

You need to have the Easy365Manager snapin installed to follow this procedure. You can download a free, fully-functional 30-day trial here.

Open up user properties and go to the Mailbox tab. Click on Mailbox Delegation. Then add the delegatees to the selected type of delegation:

Delegating Mailbox Access Using Exchange Admin Center

You can also delegate mailbox access using the Exchange Admin Center. Follow the below steps to delegate permissions to a mailbox.

Open up the Exchange Admin Center using your admin account and locate the mailbox you want to delegate access to:

Open up mailbox properties and select Mailbox Delegation:

Select what type of access you want to delegate and add the delegates.

Summary

We’ve been looking at delegating mailbox permissions using PowerShell, AD Users & Computers (with the Easy365Manager snap-in), and Exchange Admin Center.

With Easy365Manager you can

Manage all mail attributes and mailbox delegation in AD Users & Computers
Manage Office 365 licenses and Office 365 mailboxes in AD Users & Computers
Remove your on-premises Exchange Server

For the most common questions regarding installation, licensing and security read our FAQ.

For a complete list of features look here.