How to Configure Automated Mailbox Delegation, Send on Behalf Permissions, and Automapping in Outlook

In enterprise administration and executive support workflows, shared communication channels—such as department helpdesks (e.g. [email protected]) and executive inboxes—require multi-user delegation. Granting multiple staff members access to a central mailbox without structured governance introduces severe security and operational hazards: unauthorized message deletion, recipient confusion over sender identities, and Outlook desktop client performance degradation.

Microsoft Exchange Online provides a tripartite permission architecture governing mailbox delegation: Full Access, Send As, and Send on Behalf. When properly managed via Exchange Online PowerShell, administrators can assign granular rights, control whether delegated mailboxes automatically mount into client profiles via MAPI Automapping, and enforce auditing to track every message transmitted on behalf of another entity.

Architectural Overview: The Exchange Online Delegation Framework

Understanding the operational boundaries between Exchange Online permission types is essential for maintaining corporate compliance and security:

Permission Type	PowerShell Cmdlet / Parameter	Recipient Header Appearance	MAPI Automapping Impact
Full Access	Add-MailboxPermission -AccessRights FullAccess	No sending rights granted; permits reading, creating folders, and deleting mail items.	Triggers automated profile mounting in Outlook if -AutoMapping $true.
Send As	Add-RecipientPermission -AccessRights SendAs	From: [email protected] (Recipient cannot detect delegate identity).	Does not mount the mailbox; operates purely at the transport submission layer.
Send on Behalf	Set-Mailbox -GrantSendOnBehalfTo	From: [email protected] on behalf of [email protected]	Explicitly discloses the sender identity in email client headers.

Granting Mailbox Delegation via Exchange Online PowerShell

While basic delegation can be configured via the Microsoft 365 Admin Centre, Exchange Online PowerShell V3 is required to control advanced transport parameters such as automapping suppression.

Step 1: Connect to Exchange Online PowerShell

# Import management module and authenticate
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName "[email protected]"

Step 2: Assign Full Access with Automapping Disabled

By default, granting Full Access automatically mounts the target mailbox into the delegate’s Outlook desktop profile. For large shared mailboxes (exceeding 20 GB), automapping causes Outlook search indexing crashes and severe startup lag. Suppress automapping using the -AutoMapping $false flag:

# Grant Full Access without forcing Outlook client automapping
Add-MailboxPermission -Identity "[email protected]" `
    -User "[email protected]" `
    -AccessRights FullAccess `
    -AutoMapping $false

Step 3: Assign Send As or Send on Behalf Rights

Choose the sending model required by corporate compliance policy:

# Option A: Grant Send As (clean executive identity)
Add-RecipientPermission -Identity "[email protected]" `
    -Trustee "[email protected]" `
    -AccessRights SendAs -Confirm:$false

# Option B: Grant Send on Behalf (transparent audit trail)
Set-Mailbox -Identity "[email protected]" `
    -GrantSendOnBehalfTo @{Add="[email protected]"}

Manually Mounting Delegated Mailboxes in Outlook Desktop

When automapping is disabled, delegates mount the shared mailbox manually within their Outlook desktop profile.

Step 1: Open Account Settings

1. In Outlook for Windows, click File > Info > Account Settings > Account Settings….
2. Select your primary Exchange email account and click Change….
3. Click More Settings in the lower-right corner.
4. Navigate to the Advanced tab.

Step 2: Add the Additional Mailbox

1. Under Mailboxes, click Add….
2. Type the email address or alias of the delegated mailbox (e.g. [email protected]) and click OK.
3. Click Apply, then OK, and complete the account wizard.
4. The delegated mailbox immediately appears in the Outlook navigation sidebar as an independent folder hierarchy.

Configuring Sent Items Storage for Delegated Senders

By default, when a delegate sends an email from a shared mailbox, Exchange stores a copy of the outgoing message exclusively in the delegate’s personal Sent Items folder. To ensure transparency across all delegates, configure Exchange to save a copy directly in the shared mailbox’s Sent Items folder.

# Save sent copy in both delegate and shared mailbox Sent Items
Set-Mailbox -Identity "[email protected]" `
    -MessageCopyForSentAsEnabled $true `
    -MessageCopyForSendOnBehalfEnabled $true

Now, whenever an assistant dispatches an email on behalf of leadership, the sent communication is automatically mirrored into the executive’s Sent Items folder, preserving an immutable communication record.

Troubleshooting Outlook Mailbox Delegation Failures

Consult this diagnostic reference table to debug permission propagation delays and client synchronization errors:

Error / Symptom	Underlying Root Cause	Remediation Procedure
You do not have permission to send on behalf of the specified user.	Active Directory token caching delay, or Outlook is attempting Send As using an outdated local Address Book cache.	Wait 30–60 minutes for Exchange token replication. In Outlook, download the offline address book: Send / Receive > Send/Receive Groups > Download Address Book.
Outlook client hangs on “Loading Profile…” after granting delegation.	Automapping mounted a massive shared mailbox that overloaded the local OST cache file.	Remove Full Access via Remove-MailboxPermission. Re-grant Full Access with -AutoMapping $false and instruct the user to access via Outlook on the Web (OWA) or mount with cached mode disabled.
Delegate can read emails but cannot delete items from the shared mailbox.	Full Access was granted via folder-level Outlook permissions rather than Exchange Online mailbox-level rights.	Execute Add-MailboxPermission -AccessRights FullAccess in PowerShell to grant root container rights.
“Send As” emails bounce with Non-Delivery Report (NDR) 550 5.7.60.	Conflicting permissions: the user possesses both Send-on-Behalf and Send-As rights, confusing the transport agent.	Clear Send-on-Behalf if Send-As is required: Set-Mailbox -Identity <target> -GrantSendOnBehalfTo @{Remove="<delegate>"}.

Configuring structured mailbox delegation, explicit transport permissions, and controlled automapping policies guarantees seamless collaboration across enterprise teams while safeguarding executive privacy and mailbox stability.