Overview of delegation in an Office 365 hybrid environment

Applies to: Exchange Online

Symptoms


Microsoft Exchange Online customers have problems in the functionality of their Full Access, Send As, Send on Behalf of, and Folder permissions.

Cause


For Office 365 hybrid delegation to work as expected, multiple requirements must be met.

Resolution


Office 365 hybrid delegation requires a specific configuration in the cloud and in the on-premises Active Directory Domain Services (AD DS) environment. The following list discusses the different permissions and how they work in a hybrid deployment.

    Full Access

    • Full Access permissions provide access to all mailbox contents.
    • Full Access permissions are granted by administrators only by using Exchange Admin Center or Remote PowerShell (Add-MailboxPermission).
    • Full Access permissions will work cross forest together with the Outlook client for Windows.
    • Autodiscover is used to find the mailbox even when it’s in another forest (by using the target address redirect).
    • The following differences apply, depending on how a user tries to access an additional mailbox:
       

    Send As

    • Send As permissions enable mail to be sent from another mailbox that enabled the mail user object’s primary email address.
    • Permissions are granted by administrators by using the Exchange Admin Center or Remote PowerShell (Add-ADPermission in on-premises Active Directory and Add-RecipientPermission in Exchange Online).
    • Permissions must exist in the sending user’s forest. For example, if a user’s mailbox is moved to Exchange Online, the Send As permissions must be listed on the mail user object that represents the on-premises mailbox.
    • Permissions are not synchronized by Azure AD Connect.
    • Permissions set in on-premises AD DS must be manually added in the Exchange Online for full functionality. For more information, see https://technet.microsoft.com/en-us/library/jj200581(v=exchg.150)#considerations.

    Folder access

    Send on Behalf of

    • "Send on Behalf of" permissions enable mail to be sent on behalf of another email address
    • Permissions can be granted by users by using Outlook or by administrators by using Exchange Admin Center or Remote PowerShell (Set-Mailbox cmdlet).
    • Permissions must exist in the sending user’s forest.
    • By default, the PublicDelegates attribute (also known as the GrantSendOnBehalfTo attribute in Exchange on-premises) is synchronized to Exchange Online by Azure AD Connect.
    • Additional configuration is required to synchronize the PublicDelegates attribute with on-premises AD DS. This configuration requires enabling Exchange hybrid deployment settings in Azure AD Connect. For more information, see Exchange hybrid writeback

      Optional features
    • If Exchange hybrid deployment setting is not enabled, the "Send on Behalf of" permission has to be added manually by an administrator by using Remote PowerShell. To do this, refer to https://support.microsoft.com/en-US/help/4039613.

    Delegates

    • Delegates can be granted combination of different rights in Outlook:
       
      • Folder rights
      • Sending on behalf of
      • Meeting request forwarding rules (hidden rules)
      • The ability to see private items (calendar)
      Delegates window
    • Some of these rights can be seen and managed by an administrator (such as Folder and "Send on Behalf of" rights). However, some are stored only in the Exchange mailbox (such as meeting-related messages, forwarding rules, and private item visibility).
    • Basic functionality works cross-forest by using Outlook for Windows. The following conditions apply:
       
      • Users can access other user folders (Folder rights and Full Access).
      • Users can send on behalf of a user from another forest.
      • Rules to forward meeting invitations will be delivered successfully.
      • New delegates can be added if users exist in different forests.
    • In the Scheduling Assistant, no details or limited free/busy information is listed for mailboxes in another forest. The following conditions apply: 
       
    • Some functionality does not work in Outlook Web App (OWA). For more information, see the following articles:
    • Workflows between the manager and delegate users differ, and problems may be experienced.
    • We recommend that you move your manager and delegate users together as much as possible. The following conditions apply: