Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsTo restrict mailbox permissions in Exchange Online, review Full Access, Send As, and Send on Behalf separately, remove delegates who no longer need them, and verify any access granted through groups. To audit use, search Microsoft Purview audit records with the mailbox, actor, operation, and time range in view. A permission inventory shows who is authorized now; audit records can show logged activity, but missing records do not prove that no access occurred.
What Exchange Online mailbox permissions actually allow
These three delegate permissions answer different questions: can someone open mailbox contents, and can they send as the mailbox? Microsoft documents them as distinct grants. Manage permissions for recipients in Exchange Online
As an Amazon Associate I earn from qualifying purchases.
| Permission | What it allows | How the sender appears |
|---|---|---|
| Full Access | Open the mailbox and view, add, or remove its contents. It does not grant the ability to send. | Not a sending permission. |
| Send As | Send messages from the mailbox. | The message appears to come directly from the mailbox. |
| Send on Behalf | Send messages on behalf of the mailbox. | The delegate is shown as sending on behalf of the mailbox. |
Do not treat a Full Access list as a complete access review: a person may have a send permission without Full Access, or content access without either send permission.
How to review and restrict permissions
1. Define which mailboxes are in scope
Identify the shared mailboxes and any user or resource mailboxes covered by your policy. Record the mailbox identity and review date so the result can be tied to a specific review.
#1 Best Overall
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
2. Inspect all three permission types
In the Exchange admin center, open the mailbox’s Mailbox delegation settings and review Full Access, Send As, and Send on Behalf. Remove a delegate when the business need has ended. EAC and Exchange Online PowerShell are both administration surfaces documented by Microsoft; use the one appropriate to your workflow.
3. Use PowerShell without conflating grants
For a PowerShell-led review, enumerate Full Access assignments and inspect Send As and Send on Behalf independently. Microsoft documents permission assignment and removal through Exchange Online PowerShell, but a Full Access result alone does not reveal the send-right inventory. See Microsoft’s recipient permission guidance.
4. Check group-based access
Determine whether a permission is assigned to a group rather than directly to an individual, then review the group’s membership against the intended access. Removing an individual delegate will not address authorization that still comes through a group.
Recommended Free Tools
Rank #2
- equipped with atom n2600 d2700 processor, compatible with many freebsd based router systems, linux distros, or win.os supported, easy configuration and management
- Please note, this is a barebone only. A system memory, a storage drive and an operating system are needed to complete this system
- 13-19 inches 1u, 50w power, with power cord, make sure to use a big brand memory and ssd/hdd with quality assurance
- Designed with console, 2 x usb, 4 x lan, vga, power switch, size at 290 x 180 x 44mm
- There are 2 inside reserved fans on chassis, which could be removed freely or be turned on in a high temperature environment to ensure the best function of the product
5. Remove excess access and document the outcome
Remove grants that are no longer justified, then recheck the permission lists. Keep a change record containing the mailbox, permission type, principal (user or group), review date, and disposition. Set a recurring review cadence as organizational policy; Microsoft’s administration guidance does not establish a universal schedule.
Outlook auto-mapping is a convenience associated with Full Access grants to individual users. Hiding a mailbox or changing auto-mapping does not revoke the underlying permission.
How to audit delegated mailbox activity
Start with a bounded investigation
In Microsoft Purview, use the audit search for mailbox activities to select the relevant mailbox and a defined time range, then narrow the search by actor and operation as the question requires. Verify that the action you are investigating is covered for the relevant sign-in type before interpreting results. Microsoft’s guide explains the mailbox activity search: Search the audit log for mailbox activities in specific mailboxes.
Rank #3
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
For a shared mailbox investigation, Microsoft also documents using Purview audit together with Exchange Online PowerShell. Its examples include searching with Search-UnifiedAuditLog using time bounds and an operation such as SendAs, and inspecting permissions with Get-MailboxPermission. Treat these as examples to adapt to your tenant and current cmdlet syntax, not as a complete investigation script. See Investigate shared mailbox activities using audit logs.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the event that matches the question
- Who changed authorization? Look for relevant permission or delegation change activities, such as
Add-MailboxPermissionorUpdateCalendarDelegation, where applicable. - Was a message sent using delegated authority? Search for
SendAsorSendOnBehalf, matching the permission and question under investigation. - Was a folder accessed?
FolderBindis related to folder access, but its coverage and recording behavior need careful interpretation.
Microsoft’s activity reference lists audit operations, while its mailbox auditing and search guidance explains relevant coverage and caveats. Consult Audit log activities alongside the mailbox-specific guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What a missing audit event does—and does not—mean
A permission inventory and an activity search establish different things. The inventory describes authorization state when it is checked; an audit search can return records of actions within its searchable coverage. Neither should be substituted for the other, and no result is not proof that a user did not access the mailbox.
Rank #4
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
- Operation coverage varies by sign-in type. Confirm that the particular action is expected to be audited for the actor’s sign-in type before drawing conclusions.
- FolderBind records may be consolidated. Do not interpret a missing individual record as conclusive evidence that a folder was not accessed.
- Audit bypass can omit activity. A user configured for mailbox audit bypass can have actions omitted, including delegate actions on other mailboxes.
- Search coverage depends on retention. Current Microsoft guidance says audit retention is managed through Microsoft Purview retention policies. The older mailbox
AuditLogAgeLimitsetting is no longer applicable for managing current mailbox audit record retention. Check your tenant’s policy and licensing or configuration before defining how far back an investigation can reach.
Microsoft’s mailbox auditing guidance covers retention and bypass considerations: Manage mailbox auditing.
How to write up the review or investigation
Keep three findings distinct in the final record: the permission state observed now, the logged activity found within the searchable time window, and evidence that may be absent because of operation coverage, sign-in type, bypass, or retention. State the mailbox, actor, operation, and search window used; do not turn an empty result into a claim that no access took place.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
