Add-MailboxPermission

Sometimes you need to grant a user access to another Office 365 mailbox. This is standard practice for shared mailboxes and Room and Equipment mailboxes.

You may also need to delegate access to regular user mailboxes e.g. in case a secretary should be able to manage the mailbox of a manager.

In Office 365 there are three types of delegation on a regular user mailbox:

  • Send As
  • Send on Behalf
  • Full Access
This post will show you how to perform the delegation using the PowerShell command Add-MailboxPermission.
You’ll also learn how to do it via the Exchange Admin Center and via the standard AD Users & Computers management console.

Mailbox Delegation Using PowerShell

Use the Add-MailboxPermission PowerShell command to delegate access to your Office 365 mailbox. The below example shows you how:
  1. $UserCredential = Get-Credential
  2. $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
  3. Import-PSSession $Session -DisableNameChecking
  4. Add-MailboxPermission tycho.brahe@observatory.dk -User ole.roemer@observatory.dk -AccessRights FullAccess
  5. Remove-PSSession $Session
  1. Start by establishing a connection with Exchange Online (line 1 – 3).
  2. Delegate access to the mailbox using the Add-MailboxPermission command (line 4).
  3. End your Exchange Online session when done (line 5). If you don’t explicitly close the session you risk depleting the number of available sessions.

To review your change use Get-MailboxPermission. The output may look similar to this:

PS C:\Windows\system32> Get-MailboxPermission tycho.brahe@observatory.onmicrosoft.com | ft User,AccessRights,IsInherited,Deny User AccessRights IsInherited Deny ---- ------------ ----------- ---- NT AUTHORITY\SELF {FullAccess, ReadPermission} False False niels.bohr@observatory.onmicrosoft.com {FullAccess} False False EURP189\Administrator {FullAccess} True True EURP189\Domain Admins {FullAccess} True True EURP189\Enterprise Admins {FullAccess} True True EURP189\Organization Management {FullAccess} True True EURP189\AM5P18901MB0148$ {FullAccess} True True NT AUTHORITY\SYSTEM {FullAccess} True False NT AUTHORITY\NETWORK SERVICE {ReadPermission} True False EURP189\Administrator {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner} True False EURP189\Domain Admins {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner} True False EURP189\Enterprise Admins {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner} True False EURP189\Organization Management {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner} True False EURP189\Public Folder Management {ReadPermission} True False EURP189\Exchange Servers {FullAccess, ReadPermission} True False EURP189\Exchange Trusted Subsystem {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner} True False EURP189\Managed Availability Servers {ReadPermission} True False EURP189\AM5P18901MB0148$ {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner} True False S-1-5-21-1589316702-2032257147-3807288276-5106 {ReadPermission} True False PRDTSB01\JitUsers {ReadPermission} True False

Notice that there are a lot of default permissions.

You can clean up your output by using some filtering:

PS C:\Windows\system32> Get-MailboxPermission tycho.brahe@observatory.onmicrosoft.com | ? {$_.User -like 'ole.roemer*'} | ft User,AccessRights,IsInherited,Deny User AccessRights IsInherited Deny ---- ------------ ----------- ---- ole.roemer@observatory.onmicrosoft.com {FullAccess} False False

Delegating Mailbox Access Using Exchange Admin Center

You can also delegate mailbox access using the Exchange Admin Center. Follow the below steps to delegate permissions to a mailbox.

Open up the Exchange Admin Center using your admin account and locate the mailbox you want to delegate access to:

Office 365 Mailbox Delegation User Properties

Open up mailbox properties and select Mailbox Delegation:

Select what type of access you want to delegate and add the delegatees.

Mailbox Delegation Using Active Directory Users & Computers

The final option is to perform the mailbox delegation using the Active Directory Users & Computers management console. You need to have the Easy365Manager snapin installed to follow this procedure. You can download a free fully functional trial here.

Open up user properties and go to the Mailbox tab. Click on Mailbox Delegation. Then add the the delegatees to the selected type of delegation:

Easy365Manager Mailbox Delegation Grant Access
Did you like this post? Maybe your friends will too!
Facebook
Twitter
LinkedIn