Support work regularly needs an admin to open a user's mailbox — investigating a mail-flow complaint, recovering an item, confirming a rule. The mechanism is Full Access delegation, and it's trivial to grant. That's exactly the problem: because it's so easy to add and invisible once added, delegations accumulate. Every one is an account that can silently read someone else's mail, and a pile of forgotten grants is a genuine confidentiality and audit exposure.
The discipline is simple and non-negotiable: grant it, do the task, remove it. Treat the removal as part of the same task, not a later cleanup you'll get to.
01Grant access (portal)
Exchange Admin Center — the quick path.
In the Exchange Admin Center, go to Mailboxes and open the target mailbox. Under Mailbox delegation, edit the Read and manage (Full Access) list and add your account. Save. After a short propagation delay, open Outlook on the web, click your profile initials, choose Open another mailbox, enter the mailbox name, and open it.
02Or by PowerShell
Faster, scriptable, and easier to audit.
# grant Full Access Add-MailboxPermission -Identity [email protected] ` -User [email protected] -AccessRights FullAccess -InheritanceType All # ...do the task... # REMOVE it when done — this is the step that matters Remove-MailboxPermission -Identity [email protected] ` -User [email protected] -AccessRights FullAccess -Confirm:$false
Adding -AutoMapping:$false to the grant stops the mailbox from auto-appearing in your Outlook profile — useful when you only need programmatic or brief access and don't want it lingering in your folder list.
03Audit what's already delegated
Before you trust the environment, find the grants nobody removed.
# who has Full Access to a given mailbox? Get-MailboxPermission -Identity [email protected] | Where-Object { $_.AccessRights -match "FullAccess" -and -not $_.IsInherited } | Format-Table User, AccessRights -Auto
Run that across sensitive mailboxes (executives, HR, legal, finance) periodically. Standing Full Access grants that outlived their reason are exactly the kind of quiet exposure that turns into an incident when the wrong account is compromised.
Access to someone's mailbox is access to their identity's inbox
Full Access lets the delegate read everything, including password-reset and MFA-enrollment mails. A forgotten grant on a privileged user's mailbox is a lateral-movement gift. Removal isn't housekeeping — it's containment.
The rule
Delegation is a loan, not a gift. Grant it, use it, remove it — in the same task — and audit for the ones that slipped through. The access you forget to remove is the access someone else eventually uses.
Further reading
- Manage permissions for recipients — Microsoft LearnFull Access, Send As, auto-mapping
- Add-MailboxPermission — Microsoft Learnthe grant/remove cmdlets and parameters
Comments
Questions or corrections welcome. Sign in with GitHub to join the thread.