Exchange Online Delegate Access: Full Access, Send As, Send on Behalf, and Calendar Permissions

The old way to cover for a colleague was to give them your password. That cannot be audited, it breaks MFA, it cannot be revoked without a password change, and it makes it impossible to tell who did what. Delegation replaces it with explicit, reviewable, revocable rights.

The Permission Model

Four separate controls exist, and they are independent:

Permission	What it allows	What it does not allow
Full Access	Open the mailbox, read, move, and delete mail, and see all folders	Sending as the owner
Send As	Send mail that looks like it came directly from the owner	Reading the mailbox
Send on Behalf	Send mail marked "*Delegate* on behalf of *Owner*"	Reading the mailbox
Folder permissions (calendar, inbox, contacts, tasks)	Specific rights to a folder, from reviewer to owner	Anything outside the folder

Two things surprise people. First, Full Access does not let you send as the owner; add Send As or Send on Behalf. Second, Send As and Send on Behalf do not let you read the mailbox; add Full Access or inbox rights.

Where Each Pattern Fits

Scenario	Permissions to grant	Why
Executive assistant	Full Access, Send on Behalf, calendar delegate (Editor with delegate flag)	Reads and answers mail and manages the calendar, and recipients see it was the assistant
Role address (support@, hr@)	Full Access and Send As, via a group	See shared mailboxes
Coverage during leave	Full Access, time-limited	Colleague handles mail for a few weeks
Manager access to a leaver's mailbox	Full Access on the converted mailbox	Business continuity and handover
Investigator or compliance reviewer	Full Access, or Content Search through Purview, with approval	Leaves an audit trail; prefer Purview for formal reviews
Calendar-only help	Calendar delegate	Least privilege
Read-only visibility	Inbox folder permission *Reviewer*	See mail without moving or deleting
Service or application	Application access policy, not a user delegate	Limits an app to specific mailboxes

The principle is least privilege: give the smallest permission that does the job, for the shortest time.

Full Access in Depth

Full Access gives the delegate the entire mailbox, not individual folders. By default it applies to all folders (-InheritanceType All).

Auto-mapping adds the mailbox to the delegate's Outlook automatically. It is convenient, but it can cause trouble: a large mailbox loads in the background and slows Outlook, and a delegate with Full Access to many mailboxes gets a crowded folder list. Turn it off when the delegate does not need constant access:

A delegate who only needs the mailbox occasionally can add it themselves in Outlook on the web: click their name in the folder pane, Open another mailbox.

Auto-mapping and groups. When you grant Full Access to a *group*, the mailbox does not auto-map for its members. Grant to individuals for auto-mapping, or have group members add the mailbox manually.

Removing auto-mapping later. Removing the permission removes the mapping, but it can take time to disappear from Outlook; a restart or profile refresh may be needed.

Send As and Send on Behalf in Depth

Choosing between them.

• Use Send As when the recipient should not know a delegate exists, for example a role address like support@. It is also the right choice for automation and shared mailboxes.
• Use Send on Behalf when openness matters, such as an assistant sending for an executive. The recipient sees both names, and replies go to the owner.
• Do not grant both to the same person. If both exist, Send As wins, and the "on behalf of" text never appears.

Where the sent mail is saved. By default, mail sent as or on behalf of another mailbox is saved in the *sender's* Sent Items. For a shared mailbox, enable copying to the shared mailbox (MessageCopyForSentAsEnabled, MessageCopyForSendOnBehalfEnabled) so the owner sees what was sent. For a person's mailbox, decide whether the owner should see the delegate's replies and set it accordingly.

Time to apply. Send As changes can take a while, sometimes an hour or more, to take effect. Test before the person depends on it.

Folder-Level Delegation

Folder permissions let you delegate calendar, inbox, contacts, or tasks without opening the whole mailbox.

Role	Rights
Owner	Everything, including permissions
PublishingEditor	Create, edit, delete all items, and create subfolders
Editor	Create, edit, delete all items
PublishingAuthor	Create items and subfolders, edit and delete own
Author	Create items, edit and delete own
NonEditingAuthor	Create items, delete own
Reviewer	Read only
Contributor	Create items only
None	No access

Rules to remember:

• To change an existing permission, use Set-MailboxFolderPermission. Add- fails if one already exists.
• Permissions on a parent folder do not automatically apply to child folders for Inbox; you may have to grant on subfolders.
• The Delegate flag matters. A calendar *Editor* without the flag can edit the calendar but does not receive meeting requests on the owner's behalf.
• In non-English mailboxes the folder is not named "Calendar". Find it with Get-MailboxFolderStatistics jsmith@contoso.com -FolderScope Calendar.
• Private items stay hidden from delegates unless you grant that right. Remind owners to mark sensitive items as private.

How Delegates Use the Mailbox

Outlook for Windows. The mailbox appears under the delegate's own (if auto-mapped). To open another mailbox manually: File, Open & Export, Other User's Folder. To send as: in a new message, show the From line (Options, From) and type the owner's address. Replies to the owner's mail can be sent from the owner's address.

Outlook on the web. Right-click your mailbox in the folder pane and choose Add shared folder or mailbox. When composing, click From to choose the address. The first time, you may need to add it manually.

Mobile. Delegate access in Outlook mobile is limited. Test it before promising it, because the experience depends on the app version and the permission type.

Meeting requests. An owner can choose, under File, Account Settings, Delegate Access, whether meeting requests go only to the delegate, to both, or only to the owner. The delegate should handle responses on the owner's behalf.

What Owners Can Do Themselves

Owners can delegate without an admin:

• Outlook for Windows: File, Account Settings, Delegate Access, Add, choose the person, set permission levels for Calendar, Tasks, Inbox, Contacts, and Notes, and tick whether the delegate sees private items.
• Outlook on the web: Settings, Calendar, Shared calendars to share the calendar, and Settings, Mail, Accounts, Delegate access (where available) to grant mailbox rights.

Admin-managed rights are better for auditing, because they are visible in PowerShell and can be reviewed centrally. Owner-granted rights can be invisible to IT unless you query for them.

Design: Grant Through Groups

Granting by person creates a mess when roles change. Use security groups:

Pros: one change adds or removes a person, access reviews are easier, and you can use dynamic or Entra groups tied to HR data. Cons: no auto-mapping for group-based Full Access, and nested groups can be hard to trace. Document the group name and owner in your records.

For larger environments, use Microsoft Entra access reviews on the groups so owners must confirm membership regularly.

Delegation for Leavers and Investigations

• Leaver handover. Convert the mailbox to a shared mailbox, grant Full Access to the manager, and set an automatic reply. The full pattern, including licensing and holds, is in our shared mailbox guide.
• Investigations. Do not use Full Access to browse a user's mailbox for an HR or legal reason. Use Content Search or eDiscovery in Microsoft Purview, which is permissioned, scoped, and audited. See recovering deleted email.
• Break-glass access. If an admin must open a mailbox urgently, grant time-limited Full Access with a ticket number, and remove it afterwards.
• Temporary access. Add an expiry to your process: set a calendar reminder, or script removal. Exchange does not expire Full Access by itself.

Review and Audit Delegation

To find every mailbox a person can open:

This is slow on large tenants; run it in batches or use the audit log. Review executive, finance, HR, and shared mailboxes on a schedule, and always when someone changes role. Mailbox auditing records delegate actions, so you can see what a delegate did:

Removing Access

Removing a permission may leave the mailbox in the former delegate's Outlook for a while, until the next refresh.

Security Considerations

• A delegate's account compromise exposes every mailbox they can open. Protect delegates with MFA and review their reach.
• Do not grant Full Access to admin accounts for daily use. Use separate admin accounts.
• Delegates can create inbox rules in the owner's mailbox. Include that in your rule audits.
• Mark sensitive calendar items private and do not grant CanViewPrivateItems unless needed.
• Avoid nested groups and dynamic groups for sensitive mailboxes unless you can see exactly who is in them.
• Consider an application access policy for automation instead of a user account with Full Access.

How to Check It Worked

• Ask the delegate to open the mailbox (allow up to an hour for propagation).
• For Send As, send a test message and check the recipient sees only the owner's address. For Send on Behalf, check that "on behalf of" appears.
• Confirm the delegate can edit the calendar and receives meeting requests as intended.
• Confirm a non-delegate cannot access it.
• Run the review commands and compare against the approved list.

Troubleshooting

Symptom	Likely cause
Mailbox does not appear in Outlook	Auto-mapping disabled, group-based grant, or propagation delay. Add it manually or wait
"You do not have permission to send on behalf"	Only Full Access was given. Add Send As or Send on Behalf
Delegate can read but not send	Missing Send As or Send on Behalf
Delegate can send but cannot read	Missing Full Access or inbox rights
Calendar editable, but no meeting requests	The Delegate flag was not set
Add-MailboxFolderPermission says an entry exists	Use Set-MailboxFolderPermission
Sent mail lands in the delegate's Sent Items only	Expected default; enable message copy for shared mailboxes
Access still works after removal	Cached Outlook profile or a second grant through a group
Mailbox loads slowly for a delegate	Auto-mapping of a very large mailbox. Disable auto-mapping and add it in the web client

A Short Decision Guide

• Assistant for an executive: Full Access, Send on Behalf, calendar delegate.
• Team address: shared mailbox, group with Full Access and Send As.
• Cover for leave: Full Access with an end date and a reminder to remove it.
• Calendar only: folder permission with the delegate flag.
• Investigation: Purview, not Full Access.
• Automation: application access policy.

Related guides: shared mailboxes, sharing calendars, and access from anywhere.

Permission behavior, propagation times, and portal steps change, and I have not run these commands against your tenant. Test with a non-critical mailbox before changing an executive's. If you want help tidying delegation across a tenant, get in touch.