Skip to content
Browse

/commands/exchange-online/grant-fullaccess-sendas-sendonbehalf

Exchange Online: grant FullAccess, SendAs and SendOnBehalf permissions with PowerShell

The commands on this page have not been executed by our verification runner yet.updated
tool
Exchange Online PowerShell
versions
Exchange Online, ExchangeOnlineManagement 3.x
os
windows, linux, macos

The three mailbox delegation permissions in Exchange Online are set with three different cmdlets. Connect with Connect-ExchangeOnline first; you need a role that includes these cmdlets (for example the Recipient Management role group or the Exchange Recipient Administrator role).

powershell
# Full Access: open the mailbox and read everything in it
Add-MailboxPermission -Identity sales@contoso.com -User anna@contoso.com -AccessRights FullAccess -InheritanceType All

# Send As: send mail that appears to come from the mailbox itself
Add-RecipientPermission -Identity sales@contoso.com -AccessRights SendAs -Trustee anna@contoso.com

# Send on Behalf: "Anna on behalf of Sales"
Set-Mailbox -Identity sales@contoso.com -GrantSendOnBehalfTo @{Add="anna@contoso.com"}

Add-RecipientPermission asks for confirmation; add -Confirm:$false in scripts.

The three permissions

PermissionAddCheckRemove
FullAccessAdd-MailboxPermission -AccessRights FullAccess -UserGet-EXOMailboxPermission -Identity MBXRemove-MailboxPermission -AccessRights FullAccess -User
SendAsAdd-RecipientPermission -AccessRights SendAs -TrusteeGet-EXORecipientPermission -Identity MBXRemove-RecipientPermission -AccessRights SendAs -Trustee
SendOnBehalfSet-Mailbox -GrantSendOnBehalfTo @{Add="user"}(Get-EXOMailbox MBX -Properties GrantSendOnBehalfTo).GrantSendOnBehalfToSet-Mailbox -GrantSendOnBehalfTo @{Remove="user"}

MBX stands for the mailbox you are changing. -GrantSendOnBehalfTo user1,user2 without @{Add=...} replaces the whole list; use the @{Add=...; Remove=...} form to change one entry.

FullAccess and Outlook auto-mapping

By default (-AutoMapping $true) Outlook adds the mailbox to the user's profile automatically. To grant access without auto-mapping:

powershell
Add-MailboxPermission -Identity sales@contoso.com -User anna@contoso.com -AccessRights FullAccess -InheritanceType All -AutoMapping $false

Auto-mapping does not work when the permission is granted to a security group, and it cannot be switched off for an existing grant: remove the permission with Remove-MailboxPermission and add it again with -AutoMapping $false.

In Exchange Online, FullAccess also gives access to calendar items marked Private. A mailbox can hold at most 500 permission entries; for more users, grant the permission to a mail-enabled security group.

Copies of sent items

When a delegate sends as or on behalf of a shared mailbox, the message is saved in the delegate's Sent Items only. To also keep a copy in the shared mailbox:

powershell
Set-Mailbox -Identity sales@contoso.com -MessageCopyForSentAsEnabled $true -MessageCopyForSendOnBehalfEnabled $true

Sources

Related pages

commands · exchange-onlineConvert a user mailbox to a shared mailbox: Set-Mailbox -Type SharedSet-Mailbox -Identity user@contoso.com -Type Shared converts a mailbox and keeps all mail. Then remove the license if under 50 GB and block the sign-in.compare · exchange-onlineGet-EXOMailbox vs Get-Mailbox in Exchange Online PowerShellGet-EXOMailbox is built into the EXO V3 module and returns a minimum property set fast; Get-Mailbox comes from the connection and returns every property.cheat sheets · exchange-onlineExchange Online PowerShell cheat sheet (ExchangeOnlineManagement V3)Exchange Online PowerShell by task: connect, find mailboxes, permissions, forwarding, shared mailboxes, auto-replies, distribution groups and message trace.