5

We have migrated from Exchange 2010 to Exchange 2013.

We have multiple shared mailboxes and we have always granted users Full Access and Send on Behalf permission so that if a shared mailbox receives an e-mail and a user replies it appears to come from Doe, John On Behalf Of Sales.

In ECP in Exchange 2013 there is only Full Access and Send As permissions in the online control panel. How do I grant Full Access and Send On Behalf?

Edit: I don't want "Send As". I want "Send on Behalf".

I do not want Send As. I do not want the e-mails to look as if they were sent by the shared mailbox. I want the Exchange 2010 behavior so that when an employee replies to an e-mail sent to a shared mailbox the recipient sees Doe, John On Behalf Of Sales.

4 Answers 4

8

You can use Powershell to configure, Send on Behalf, Send as, Full Mailbox Access.

Below are examples.

  • Send on Behalf

    This will grant Charles permissions to send on behalf of Gert.

    Set-Mailbox gert.mailbox -GrantSendOnBehalfTo charles.surname
    
  • Send As

    This will grant Charles permissions to send as Gert.

    Add-ADPermission gert.mailbox -ExtendedRights Send-As -user charles.surname
    
  • Full Mailbox Access

    This will grant Charles full access to Gert's mailbox.

    Add-MailboxPermission -Identity gert.mailbox -User charles.surname

Update: Microsoft Example

Here is a way from Microsoft: (Exchange 2016: Create a shared mailbox. Archived here.)

Use the Shell to create a shared mailbox

This example creates the shared mailbox Sales Department and grants Full Access and Send on Behalf permissions for the security group MarketingSG. Users who are members of the security group will be granted the permissions to the mailbox.

Note: This example assumes that you’ve already created the security group MarketingSG and that security group is mail-enabled. See Manage mail-enabled security groups.

New-Mailbox -Shared -Name "Sales Department" -DisplayName "Sales Department" -Alias Sales |
    Set-Mailbox -GrantSendOnBehalfTo MarketingSG |
    Add-MailboxPermission -User MarketingSG -AccessRights FullAccess -InheritanceType All
0

You can set Send on behalf permissions with PowerShell / EMS if it is not available in ECP:

Set-Mailbox mailbox.domain -GrantSendOnBehalfTo userIdentity

But actually I am not sure if this is possible with shared mailboxes. Is there any special reason why you don't want to use Send As?

Regards

EDIT: I just found that it is not possible to set Send on behalf for shared mailboxes in the Exchange 2013 online help: Manage Permissions for Recipients - Exchange Online Help

EDIT2: In another Microsoft document, you'll find the sentence:

You can’t use the EAC to grant Send on Behalf permissions, you must use Set-Mailbox cmdlet with the GrantSendonBehalf parameter.

Create a shared Mailbox - Exchange 2013 Help

So, maybe you should just give a try to the EMS trick?

2
  • EDIT: I just found that it is not possible to set "Send on behalf" for shared mailboxes in the Exchange 2013 online help: Manage Permissions for Recipients - Exchange Online Help. Then why do the existing continue to work?
    – SMW
    Apr 21, 2015 at 10:25
  • See my second edit above, there are two different articles from Microsoft, one says "impossible", the other says "only with EMS".
    – Sebastian
    Apr 21, 2015 at 10:41
0

GrantSendOnBehalfTo and Full Access Rights for bulk AD Users from CSV file This script generates a brief of all current users have access to send on behalf then based on the template CSV file will import and grant Full Mailbox Access and send on behalf access to the AD users. https://gallery.technet.microsoft.com/exchange/Grant-SendOnBehalf-and-175fee83

0

We had an issue using client credentials grant flow to authenticate connections where none of the already mentioned commands worked.

https://stackoverflow.com/questions/73558889/azure-ad-service-principal-client-credentials-grant-authenticate-failed-accessin

https://docs.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth#use-client-credentials-grant-flow-to-authenticate-imap-and-pop-connections

We used this command to give our application's service principal access to one mailbox:

Add-MailboxPermission -Identity "[email protected]" -User <SERVICE_PRINCIPAL_ID> -AccessRights FullAccess

https://docs.microsoft.com/en-us/powershell/module/exchange/add-mailboxpermission?view=exchange-ps

However when trying to use the commands below we encountered errors:

Set-Mailbox gert.mailbox -GrantSendOnBehalfTo charles.surname

Add-ADPermission gert.mailbox -ExtendedRights Send-As -user charles.surname

Set-Mailbox could not find the service principal object and Add-ADPermission is not available in Exchange Online.

https://docs.microsoft.com/en-us/powershell/module/exchange/set-mailbox?view=exchange-ps

https://docs.microsoft.com/en-us/powershell/module/exchange/add-adpermission?view=exchange-ps

enter image description here

We could however solve it with:

Add-RecipientPermission -Identity "[email protected]" -Trustee <SERVICE_PRINCIPAL_ID> -AccessRights SendAs

https://docs.microsoft.com/en-us/exchange/recipients/mailbox-permissions?view=exchserver-2019

https://docs.microsoft.com/en-us/powershell/module/exchange/add-recipientpermission?view=exchange-ps

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .