Adding Mailbox Permissions to a User in Server 2016: A Comprehensive Guide

Managing permissions is crucial for maintaining a secure and efficient Microsoft Exchange Server 2016 environment. Granting users the right level of access to mailboxes ensures collaboration and operational continuity. This guide provides a comprehensive walkthrough on how to effectively use the Add-MailboxPermission cmdlet in Exchange Server 2016 to add permissions to user mailboxes, enhancing your control over mailbox access and data security.

Understanding Mailbox Permissions in Exchange Server 2016

Mailbox permissions in Exchange Server 2016 dictate what actions a user can perform on another user’s mailbox. These permissions are essential for various scenarios, such as administrative delegation, shared mailbox management, and providing assistants access to executives’ calendars and emails. The Add-MailboxPermission cmdlet is the primary tool in PowerShell for granting these permissions, offering granular control over access rights.

Before diving into the practical steps, let’s understand the key permission levels you can assign using this cmdlet:

• Full Access: This permission grants a user complete access to the mailbox, allowing them to open the mailbox, view and manage its contents (emails, calendar, contacts, tasks, notes), and even send emails on behalf of the mailbox owner. It’s commonly used for administrative access or when an assistant needs full control over a manager’s mailbox.

• Send As: This permission allows a user to send emails as if they are the mailbox owner. Recipients will see the email as coming directly from the mailbox owner. This is particularly useful for shared mailboxes representing departments or roles, where multiple users need to send emails with a consistent sender identity.

• Send on Behalf: With this permission, a user can send emails “on behalf of” the mailbox owner. Recipients will clearly see that the email was sent by the delegate “on behalf of” the mailbox owner, showing both the delegate and the owner in the sender information. This is suitable for scenarios where delegation needs to be transparent.

• DeleteItem: This permission allows the designated user to delete items from the mailbox.

• ReadPermission: Grants the user the ability to read the permissions set on the mailbox.

• ChangePermission: Allows the user to modify the permissions of the mailbox.

• ChangeOwner: Enables the user to change the owner of the mailbox.

• ExternalAccount: This permission is for external accounts to access the mailbox.

It’s crucial to select the appropriate permission level based on the user’s role and the required access. Over-permissioning can pose security risks, while insufficient permissions can hinder productivity.

Utilizing the Add-MailboxPermission Cmdlet in Server 2016

The Add-MailboxPermission cmdlet is a powerful tool for managing these permissions. Here’s a breakdown of its syntax and key parameters to effectively add mailbox permissions in your Server 2016 environment.

The basic syntax of the cmdlet is as follows:

Add-MailboxPermission -Identity <MailboxIdentity> -User <UserIdentity> -AccessRights <MailboxRights>

Let’s explore the essential parameters:

• -Identity: This parameter specifies the target mailbox to which you are adding permissions. You can identify the mailbox using various attributes such as:

  • Name
  • Alias
  • Email Address
  • Distinguished Name (DN)

• -User: This parameter defines the user or group to whom you are granting the permissions. You can specify users or mail-enabled security groups using:

  • User Principal Name (UPN) – e.g., [email protected]
  • DomainSamAccountName – e.g., domainuser
  • Email Address

  It is generally recommended to use UPN or DomainSamAccountName for clarity and to avoid ambiguity. Using mail-enabled security groups is advisable when granting permissions to multiple users, simplifying management and reducing the number of individual permission entries.

• -AccessRights: This is a crucial parameter where you define the specific permission you are granting. You can specify one or more of the following values, separated by commas: FullAccess, SendAs, SendonBehalf, DeleteItem, ReadPermission, ChangePermission, ChangeOwner, ExternalAccount. Choose the AccessRights that aligns with the intended level of access for the user.

• -AutoMapping: This parameter, particularly relevant when granting FullAccess, controls whether the mailbox is automatically added to the user’s Outlook profile.

  • $true (default): The mailbox is automatically mapped to the user’s Outlook.
  • $false: The mailbox is not automatically mapped. This is useful in scenarios where a user has Full Access for administrative purposes but doesn’t need to constantly access the mailbox in Outlook, preventing clutter in their Outlook profile.

• -InheritanceType: This parameter determines how the permissions are inherited by folders within the mailbox. Common values include All (default, permissions are inherited by all folders), Children, Descendents, SelfAndChildren, and None. In most cases, All is suitable for consistent permission application across the mailbox.

• -Deny: Using this switch instead of -AccessRights sets explicit deny permissions, overriding any previously granted allow permissions. Use this cautiously as deny permissions can be complex to manage and troubleshoot.

• -Owner: This parameter allows you to change the owner of the mailbox. This is different from granting permissions and changes the actual ownership of the mailbox object. It cannot be used with -AccessRights or -User parameters.

Step-by-Step Guide: Adding Full Access Permission in Server 2016

Let’s illustrate adding permissions with a practical example: granting ‘Full Access’ permission to a user named “John Doe” to the mailbox of “Jane Smith” in your Server 2016 environment.

Step 1: Open Exchange Management Shell

Log in to your Exchange Server 2016 and open the Exchange Management Shell as an administrator.

Step 2: Execute the Add-MailboxPermission Cmdlet

Use the following command, replacing "Jane Smith" with the actual identity of Jane Smith’s mailbox and "John Doe" with John Doe’s identity:

Add-MailboxPermission -Identity "Jane Smith" -User "John Doe" -AccessRights FullAccess -InheritanceType All

In this command:

• -Identity "Jane Smith": Specifies Jane Smith’s mailbox as the target.
• -User "John Doe": Identifies John Doe as the user receiving permissions.
• -AccessRights FullAccess: Grants John Doe ‘Full Access’ permission.
• -InheritanceType All: Ensures permissions are applied to all folders in Jane Smith’s mailbox.

Step 3: Verify Permissions (Optional)

To verify that the permissions have been successfully applied, you can use the Get-MailboxPermission cmdlet:

Get-MailboxPermission -Identity "Jane Smith" -User "John Doe"

This command will display the permissions John Doe has on Jane Smith’s mailbox, confirming the successful application of ‘Full Access’.

Example Scenarios for Adding Mailbox Permissions

Beyond granting Full Access, here are a few more practical scenarios showcasing the versatility of Add-MailboxPermission:

Scenario 1: Granting “Send As” permission to a Distribution Group

Suppose you have a distribution group named “Marketing Team” and want members of this group to be able to send emails as the shared mailbox “[email protected]”.

Add-MailboxPermission -Identity "[email protected]" -User "Marketing Team" -AccessRights SendAs

This command ensures that any member of the “Marketing Team” distribution group can now send emails appearing to be from [email protected].

Scenario 2: Granting “Send on Behalf” permission to an Assistant

To allow an assistant, “Alice”, to send emails on behalf of her manager, “Bob”:

Add-MailboxPermission -Identity "Bob" -User "Alice" -AccessRights SendonBehalf

Now, when Alice sends an email from Bob’s mailbox, recipients will see it as “Alice on behalf of Bob”.

Scenario 3: Removing Auto-mapping for Full Access Permissions

If you’ve granted Full Access for administrative purposes and don’t want the mailbox to automatically appear in Outlook:

Add-MailboxPermission -Identity "Jane Smith" -User "John Doe" -AccessRights FullAccess -AutoMapping $false -InheritanceType All

By adding -AutoMapping $false, you prevent Jane Smith’s mailbox from automatically appearing in John Doe’s Outlook profile, even with Full Access permissions.

Best Practices and Considerations

• Principle of Least Privilege: Always grant the minimum permissions necessary for the user to perform their tasks. Avoid over-permissioning to enhance security.
• Use Security Groups: For managing permissions for multiple users, leverage mail-enabled security groups. This simplifies administration and reduces the complexity of individual permissions.
• Auto-mapping Awareness: Understand the implications of auto-mapping, especially when granting Full Access. Disable auto-mapping when necessary to prevent Outlook profile clutter.
• Regular Audits: Periodically review mailbox permissions to ensure they are still appropriate and remove any unnecessary access rights.
• Documentation: Maintain clear documentation of granted mailbox permissions for auditing and troubleshooting purposes.

Conclusion

Mastering the Add-MailboxPermission cmdlet is essential for effectively managing mailbox access and security in Exchange Server 2016. By understanding its parameters and applying best practices, you can ensure a well-controlled and efficient Exchange environment. This guide has provided you with the knowledge and practical examples to confidently add mailbox permissions to users, enhancing your Server 2016 administration capabilities. Remember to always prioritize security and grant permissions judiciously based on user roles and responsibilities.