Mailbox delegation: FullAccess and SendAs, the silent accumulation of access
An assistant who moves to another department, a temporary assignment that ends, a shared mailbox created for a forgotten project: mailbox delegations are granted in seconds and almost never removed. After a few years, nobody knows who can read the executives' mail any more.
Four types of delegation not to confuse
| Permission | What it allows | Read command |
|---|---|---|
| FullAccess | Open the mailbox and read all its content | Get-MailboxPermission |
| SendAs | Send a message that appears to come from the owner | Get-RecipientPermission |
| SendOnBehalf | Send "on behalf of", visible to the recipient | GrantSendOnBehalfTo property |
| Folder permissions | Read or modify a specific folder (calendar, inbox) | Get-MailboxFolderPermission |
FullAccess and SendAs are independent: a user can read a mailbox without being able to send as its owner, and vice versa. For an attacker who compromises an account, every delegation is additional access with no further authentication.
How permissions accumulate
The causes are always the same:
- delegations granted to cover an absence or a replacement, never removed;
- role changes where new access is added and old access is kept;
- shared mailboxes whose members are never reviewed;
- permissions granted to disabled accounts, or directly to users instead of groups;
- migrations from Exchange on-premises that carried historical permissions across.
Automapping
When FullAccess is granted, Outlook adds the delegated mailbox to the user's profile by default. Automapping is convenient, but it makes the delegation invisible in day-to-day administration: the user simply "sees" one more mailbox. It can be disabled when granting the permission with -AutoMapping $false, which is useful for temporary access or large mailboxes.
Reviewing with PowerShell
The Exchange Online module lets you extract every explicit delegation, excluding system and inherited entries:
Get-EXOMailbox -ResultSize Unlimited | ForEach-Object {
Get-EXOMailboxPermission -Identity $_.UserPrincipalName |
Where-Object { $_.User -notlike 'NT AUTHORITY\SELF' -and -not $_.IsInherited }
} | Select-Object Identity, User, AccessRights
Get-EXORecipientPermission -ResultSize Unlimited |
Where-Object { $_.Trustee -notlike 'NT AUTHORITY\SELF' } |
Select-Object Identity, Trustee, AccessRights
Get-EXOMailbox -ResultSize Unlimited -Properties GrantSendOnBehalfTo |
Where-Object { $_.GrantSendOnBehalfTo } |
Select-Object UserPrincipalName, GrantSendOnBehalfTo
On a large tenant, export the results to CSV and have each delegation validated by the mailbox owner or their manager.
Priority. Start with the mailboxes of executives, finance, HR and legal: they are the favourite targets of CEO fraud and espionage, and they usually carry the most delegations.
In short
Delegation is not a problem in itself; the lack of review is. Grant permissions to groups rather than individuals, document sensitive delegations, build their removal into your mover and leaver processes, and schedule at least an annual review of privileged mailboxes.