Mailbox Delegation 101

Mailbox Delegation

You may encounter various situations where a user needs to “delegate” or share their mailbox with another user inside of their organization. I personally have been various business cases where sharing user mailboxes is a critical function. Sometimes a team needs to access a single user’s mailbox so they can all work a similar load. Or an executive assistant needs to help executives work through their mountain of emails. And I have even seen cases of an overly paranoid manager needing to see what their users are up to. This permission type is called “Full Access”. But gaining access to another user’s mailbox is not the only function of mailbox delegation. You can also establish “Send As” and “Send on Behalf” permissions so delegated users can send mail as another user. Again, there are tons of situations where this would needed.
So let’s look at each Mailbox Delegation permission, what they do, and how they should be used.

 

Send As

Send As is literally as it sounds. It enables a user to use, or impersonate another user's email address when sending email. You can configure a mailbox to allow a user inside of your organization (from your domain) to use another user's email address to send emails to whoever they would like. Personally, I would take great care when setting this permission. It is key to understand the implications tied to this permission. As I said, this is impersonation. If I delegate my co-worker’s (Rob) mailbox to allow me to send as him, whenever I send emails as Rob it looks like it came directly from Rob. To the recipient there is nothing they can see that would identify me. Take care when setting this permission as abuse of this permission is completely possible.

Using Nuvolex to set Send As permissions:

Step 1: Select a Customer, and go to the Users Page

Step 2: Select the user who needs to give Send As permissions to someone else.

Step 3: under mailbox delegation, click on the plus (+) and then select the user who needs Send As access. Check the box for “Send As

Step 4: Click Save.

 

Using Outlook to Send As

Let’s walk through how the end user would Send As another user using outlook.

Step 1: open a new email, and click on the “from” drop down. Then Click on “Other E-Mail Address…”

Step 2: In the “From…” field begin typing the user who you wish to send email as. Or you can click on “From…” to choose a user from the global address list.

Select the user and click OK.

Step 3: You can see the change made in the “From” field. Prepare your email, and send it off as another user!

Results:

Above is a sample of what it looks like to a recipient of an email that was sent as another user. The user has no indication this was sent by Josh, it completely looks like it was Rob who sent the message. 

 

 

Send on Behalf

Send on Behalf is very similar to Send As. However the main difference being the message recipient will be able to see that the message was sent from someone using another person’s email address. This is nearly as much impersonation as you would get from a Send As permission.

 

Using Nuvolex to set Send on Behalf permissions:

Step 1: Select a Customer, and go to the Users Page

Step 2: Select the user who needs to give Send on Behalf permissions to someone else.

Step 3: under mailbox delegation, click on the plus (+) and then select the user who needs Send As access. Check the box for “Send on Behalf

Step 4: Click Save.

 

 

Using Outlook to Send on Behalf

Let’s walk through how the end user would Send on Behalf another user using outlook.

Step 1: open a new email, and click on the “from” drop down. Then Click on “Other E-Mail Address…”

 

Step 2: In the “From…” field begin typing the user who you wish to send email on behalf. Or you can click on “From…” to choose a user from the global address list.

Select the user and click OK.

Step 3: You can see the change made in the “From” field. Prepare your email, and send it off on behalf of another user!

Results:

 As you can see here, it is VERY clear this email was sent by Josh and not Rob. Where as in the previous example for Send As, there is nothing the recipient sees that will tell them that Josh sent the email, only Rob. Again, use Send As sparingly and Send on Behalf more often. Of course every situation will dictate which permission to set, but keep in mind what the outcome is for each of these permissions.

 

Full Access

There is no mystery on what to expect when you give a user “Full Access” to another users mailbox. Full Access will give a user the ability to open another user’s mailbox and look at everything in there. Everything in the inbox, sent mail, junk, and whatever else that is inside of the mailbox. This would be ideal for users who are trying to share their email data with another person inside of their organization. One interesting note, giving Full Access does NOT give Send As or Send on Behalf permissions. Each permission type is exclusive of each other.

Please keep in mind, this function will give access to anything inside of another user's mailbox. So be absolutely sure your users are very aware of what you’ll be doing. Giving Full Access opens up the possibility for data leaking, or various other malicious activities. Always set Full Access with care!

 

Using Nuvolex to set Full Access permissions:

Step 1: Select a Customer, and go to the Users Page

Step 2: Select the user who needs to give “Full Access” permissions to someone else.

Step 3: under mailbox delegation, click on the plus (+) and then select the user who needs Send As access. Check the box for “Full Access”

Step 4: Click Save.

 

Using Outlook to access another users Mailbox

Step 1: Click file and go to the Info Panel. Click on Account Settings. And then Account Settings… again.

Step 2: Click on Change…

Step 3: Click on More Settings…

Step 4: Click on the Advanced Tab, then click Add…

Step 5: Enter the email address of the User you want to open then click OK.

Results:

You will see the opened mailbox appear in the left side panel underneath the other mailbox's folder tree.

 

Auto-mapping?

Auto-mapping is a feature of Exchange that will automatically add the delegated mailbox to a user’s outlook. The steps seen above are what a user would have to do if auto-mapping is disabled. If you have auto-mapping enabled, the steps shown above are done automatically. Auto-mapping is the preferred method for when granting delegation to a user’s mailbox. By default, Nuvolex creates all Full Access delegation with auto-mapping enabled. This greatly simplifies the end user experience, because they do not need to go through any extra steps in order to gain access to another user’s mailbox.  

Questions?

Feel free to drop me a message: josh@nuvolex.com

If you would like to learn more about Nuvolex, I would be more than happy to give you a full demo and help you understand how Nuvolex can enhance the way you manage Office 365 users and mailboxes.