Learn to assign mailbox access permissions in Microsoft 365 Admin Center, enabling users to read and manage another user's mailbox through the web interface and PowerShell.
Evan MaelMailbox delegation is a critical administrative function in Microsoft 365 environments, enabling secure collaboration and workflow management across organizations. Whether you're setting up executive assistant access, creating shared departmental mailboxes, or managing temporary coverage during employee absences, understanding how to properly configure mailbox permissions ensures smooth business operations while maintaining security standards.
Microsoft 365 offers several permission levels for mailbox access. The most common is "Full Access" (displayed as "Read and manage" in the Admin Center), which allows users to open, read, create, modify, and delete items in another user's mailbox. This permission level does not include the ability to send emails on behalf of the mailbox owner - that requires separate "Send As" or "Send on Behalf" permissions configured through the Exchange Admin Center.
When you configure mailbox permissions through the Microsoft 365 Admin Center, changes propagate across Exchange Online servers within 60 minutes. During this time, permissions may appear configured in the admin interface but not yet be functional for end users. This propagation delay is normal and ensures consistency across Microsoft's global infrastructure. Understanding this timing helps set proper expectations when implementing mailbox delegation in your organization.
Start by logging into the Microsoft 365 Admin Center with your administrator credentials. This is where you'll manage all mailbox permissions for your organization.
https://admin.microsoft.comOnce logged in, navigate to the user management section. Click on Users in the left navigation pane, then select Active users. This displays all licensed users in your organization who have mailboxes.
You'll see a list of all active users with their display names, usernames, and license status. The user you select here will be the mailbox owner whose email another user will access.
Verification: Confirm you can see the complete user list and that the target user appears with an active status and assigned license.
Locate and click on the user whose mailbox you want to share. This opens their user profile page with various configuration options.
In the user details pane, click on the Mail tab. This section contains all email-related settings for the selected user, including forwarding, aliases, and permissions.
Look for the Mailbox permissions section (also labeled as Read and manage permissions in some interface versions). This is where you'll configure who can access this user's mailbox.
User Profile > Mail Tab > Mailbox permissionsVerification: Confirm you're on the Mail tab and can see the Mailbox permissions section with options to edit access rights.
In the Mailbox permissions section, locate Read and manage (Full Access). This permission level allows the delegate user to open, read, create, modify, and delete items in the target mailbox, but does not include send permissions.
Click the Edit button next to the Read and manage section. This opens the permission assignment dialog where you can add users who should have access to this mailbox.
Click Add permissions to start adding users. A search dialog will appear where you can find the user who needs access to this mailbox.
Read and manage (Full Access) > Edit > Add permissionsType the name or email address of the user who needs mailbox access. The system will search your organization's directory and display matching results. Select the correct user from the dropdown list.
Verification: Confirm the selected user appears in the permissions list with "Read and manage" access level displayed.
After selecting the appropriate user, click Save changes to apply the mailbox permissions. The system will process your request and begin propagating the changes across Microsoft 365 services.
Selected User: john.doe@company.com
Permission Level: Read and manage (Full Access)
Status: Saving changes...Microsoft 365 will display a confirmation message indicating that the permissions have been updated. However, the changes may take up to 60 minutes to fully propagate across all Exchange Online servers.
During this propagation period, you might notice that the permissions appear in the Admin Center but the user cannot yet access the mailbox in Outlook or Outlook Web App.
Verification: Check that the user now appears in the "Read and manage" permissions list for the target mailbox. The Admin Center should show the permission as active.
For more detailed permission verification, access the Exchange Admin Center (EAC). Navigate to the EAC either directly or through the Microsoft 365 Admin Center.
https://admin.exchange.microsoft.comAlternatively, from the Microsoft 365 Admin Center, click Show all in the left navigation, then select Exchange under Admin centers.
In the Exchange Admin Center, go to Recipients > Mailboxes. Find and select the target mailbox, then click the mailbox name to open its properties.
Navigate to the Delegation tab. Here you'll see more granular permission settings including Full access, Send as, and Send on behalf permissions.
EAC Path: Recipients > Mailboxes > [Target User] > Delegation
Full access: [Delegate User] - Inherited: YesThe Full access section should now show your delegate user with inheritance enabled. This confirms that the permission was properly applied at the Exchange level.
Verification: Confirm the delegate user appears under "Full access" in the Delegation tab with proper inheritance settings.
Now that permissions are configured, the delegate user needs to know how to access the shared mailbox. The easiest method is through Outlook Web App (OWA).
Instruct the delegate user to log into Outlook Web App using their own credentials:
https://outlook.office.comOnce logged in, the user should click on their profile picture or initials in the top-right corner of the interface. From the dropdown menu, select Open another mailbox.
In the dialog box that appears, the user should enter the email address of the mailbox they've been granted access to. The system will validate the permissions and add the mailbox to their interface.
Profile Menu > Open another mailbox
Enter email: target.user@company.com
Click: OpenVerification: The delegate user should see the target mailbox appear in their folder list and be able to read emails, create folders, and manage content.
For users who prefer the desktop Outlook client, additional configuration is required to access the shared mailbox. This process varies slightly depending on the Outlook version.
In Outlook desktop, go to File > Account Settings > Account Settings. Select the user's email account and click Change.
In the account configuration dialog, click More Settings, then navigate to the Advanced tab.
File > Account Settings > Account Settings
Select account > Change > More Settings > Advanced tabIn the "Open these additional mailboxes" section, click Add and enter the email address of the shared mailbox. Click OK to save the settings.
Restart Outlook completely for the changes to take effect. The shared mailbox should appear in the folder pane alongside the user's primary mailbox.
Verification: After restarting Outlook, the shared mailbox should appear in the navigation pane, and the user should be able to expand its folder structure and access emails.
For administrators managing multiple mailbox permissions or preferring command-line tools, PowerShell provides a more efficient approach. First, install the Exchange Online Management module if not already present.
Install-Module -Name ExchangeOnlineManagement -Force -AllowClobberConnect to Exchange Online using your administrator credentials:
Connect-ExchangeOnline -UserPrincipalName admin@company.comGrant Full Access permissions using the Add-MailboxPermission cmdlet:
Add-MailboxPermission -Identity "target.user@company.com" -User "delegate.user@company.com" -AccessRights FullAccess -InheritanceType AllFor bulk operations, you can grant a user access to multiple mailboxes:
# Grant access to all mailboxes in a specific department
Get-Mailbox -Filter "Department -eq 'Sales'" | Add-MailboxPermission -User "manager@company.com" -AccessRights FullAccessVerification: Verify the permissions were applied correctly:
Get-MailboxPermission -Identity "target.user@company.com" | Where-Object {$_.User -like "*delegate.user*"}After configuring permissions, perform comprehensive testing to ensure everything works correctly. Have the delegate user attempt to access the shared mailbox using both Outlook Web App and the desktop client.
Common issues and their solutions:
Access Denied Errors: If the user receives access denied messages, verify the permissions are properly configured and wait for full propagation (up to 60 minutes).
# Check current permissions
Get-MailboxPermission -Identity "target.user@company.com" | Format-Table User,AccessRights,IsInherited -AutoSizeMailbox Not Appearing: In Outlook desktop, try removing and re-adding the account, or manually add the mailbox through Account Settings as described in Step 7.
Partial Access Issues: Ensure the user has Full Access permissions, not just folder-level permissions. Full Access is required for complete mailbox functionality.
If issues persist, check the user's license status and ensure both the mailbox owner and delegate have active Microsoft 365 licenses with Exchange Online included.
Verification: The delegate user should be able to read, create, modify, and delete emails in the shared mailbox, create folders, and access all mailbox features except sending (unless explicitly configured).
Microsoft MCSA-certified Cloud Architect | Fortinet-focused. I modernize cloud, hybrid & on-prem infrastructure for reliability, security, performance and cost control - sharing field-tested ops & troubleshooting.
Deepen your knowledge with related resources
Share your thoughts and insights
Sign in to join the discussion