How to Grant a User Access to Another Mailbox in the Microsoft 365 Admin Center
Learn how to grant one user access to another user's mailbox from the Microsoft 365 admin center, using Read and manage (Full Access), Send as, and Send on behalf of permissions, plus the PowerShell equivalents.
- Difficulty
- Beginner
- Time required
- About 10 minutes
- Steps
- 7
- Platform
- Microsoft 365
Table of contents
Quick Answer
Go to the stepsTo grant access to another mailbox, open the Microsoft 365 admin center, go to Users then Active users, and select the mailbox owner. On the Mail tab, choose Read and manage permissions, add the delegate, and save. Add Send as or Send on behalf of permissions if the delegate also needs to send. Allow up to 60 minutes for the change to take effect.
- Sign in to the Microsoft 365 admin center as a Global or Exchange administrator.
- Go to Users, then Active users, and select the mailbox owner.
- On the Mail tab, open Read and manage permissions.
- Add the delegate and save the change.
- Add Send as or Send on behalf of if the delegate also needs to send.
Microsoft 365 admin center > Users > Active users > select the mailbox owner > Mail > Read and manage permissions > Add permissions > select the delegate > AddExpected result: The delegate can open the other mailbox in Outlook or Outlook on the web and read and manage its messages.
Key takeaways
- How to grant one user access to another user's mailbox from the Microsoft 365 admin center, and how to pick the right permission for the job.
- Delegated mailbox access is a common request, such as an assistant handling a manager's email, and doing it correctly avoids access gaps and confusion over sending.
- Grant mailbox access from the owner's Mail tab in the Microsoft 365 admin center, and match the permission to the need: Read and manage to open the mailbox, plus Send as or Send on behalf of if the delegate must send.
Introduction
As an administrator, you often need to let one person work in another person's mailbox. A classic example is an assistant who reads and answers email for a manager, or a team member covering for a colleague who is away. The Microsoft 365 admin center makes this straightforward, but the key is choosing the right permission, because each one does something different.
There are three permissions you can grant. Read and manage, also called Full Access in the Exchange admin center, lets the delegate open the mailbox and read, organize, and delete its messages. Send as lets the delegate send email that looks exactly as if the mailbox owner sent it. Send on behalf of lets the delegate send email that shows as sent by the delegate on behalf of the owner. Importantly, Read and manage on its own does not let the delegate send anything, so if they need to send too, you add Send as or Send on behalf of as well.
This tutorial walks through granting each permission from the Microsoft 365 admin center, shows the PowerShell equivalents for admins who prefer scripting, and explains how to verify the access once it is set. All of this happens inside your own organization; you can't grant these permissions to users in another tenant.
Who this is for: IT administrators, help desk staff, and MSP technicians who manage Microsoft 365 mailboxes and permissions for their organization.
Before you start
- Access
- Sign-in to the Microsoft 365 admin center with a role that can manage mailbox permissions.
- Required roles
- Global Administrator or Exchange Administrator
- Required licenses
- An Exchange Online mailbox for both the owner and the delegate
- An Exchange Online mailbox for each user involved
- Environment
- Both users must be in the same Microsoft 365 organization. You can't grant mailbox permissions to users in another tenant.
- Vendor
- Microsoft
- Tested environment
- Microsoft 365 admin center and Exchange Online, July 2026
- Administrator permissions required
Steps reflect the Microsoft 365 admin center as of July 2026. Menu names can shift as the portal evolves, so labels may vary slightly.
The change itself takes a couple of minutes; allow up to an hour for the permission to take effect for the user.
This tutorial changes permissions on a mailbox, so it is not read-only. It does not delete or move any mail, and permissions can be removed the same way they are added.
Note: Full Access does not allow sending
Read and manage (Full Access) lets the delegate open and manage the mailbox, but not send from it. Add Send as or Send on behalf of if they need to send.
Note: Allow time to propagate
Changes can take up to 60 minutes to take effect, and Outlook may need a restart before the mailbox appears.
Warning: Mailbox must be visible in the GAL
Send as and Send on behalf of can fail in the Outlook desktop client if the mailbox is hidden from the address list, since those permissions need it visible in the Global Address List.
1Sign in to the Microsoft 365 admin center
Open the admin center with a role that can manage mailbox permissions.
admin.microsoft.comGo to the Microsoft 365 admin center at admin.microsoft.com and sign in with an account that has the Global Administrator or Exchange Administrator role. Without one of these roles, the mailbox permission options won't be available to you.
Expected result: The admin center home page loads, and you can see the Users section in the left navigation.
Note
If you don't see the full navigation, select Show all at the bottom of the left menu.
2Open the mailbox owner in Active users
Select the user whose mailbox you want to share.
Users > Active users > select the mailbox ownerIn the left navigation, go to Users, then Active users. Find and select the name of the mailbox owner, the person whose mailbox the delegate needs to access. This opens their properties pane. You always start from the owner's account, not the delegate's.
Expected result: The owner's properties pane opens, showing tabs including Account, Devices, Licenses and apps, and Mail.
Note
Use the search box on the Active users page to find the owner quickly by name or email address.
3Grant Read and manage (Full Access) permission
Let the delegate open and manage the owner's mailbox.
Mail > Read and manage permissions > Add permissions > select the delegate > AddIn the owner's properties pane, select the Mail tab. Under Mailbox permissions, select Read and manage permissions. Choose Add permissions, then select the delegate, the user you want to grant access to, and select Add.
This is the main permission for mailbox access. It lets the delegate open the mailbox and read, organize, and delete messages, but it does not let them send mail as or on behalf of the owner.
Expected result: The delegate now appears in the Read and manage permissions list for the owner's mailbox.
Note
In the Exchange admin center, this same permission is called Full Access. By default it auto-maps the mailbox into the delegate's Outlook profile.
4Grant Send as permission (optional)
Let the delegate send mail that appears to come from the owner.
Mail > Send as permissions > Add permissions > select the delegate > AddIf the delegate also needs to send email as the owner, stay on the Mail tab and select Send as permissions. Choose Add permissions, select the delegate, and select Add.
With Send as, the recipient sees the message as coming directly from the owner, with no sign that someone else sent it. Users can't grant this permission themselves; only an admin can.
Expected result: The delegate appears in the Send as permissions list and can send mail as the owner once it takes effect.
Note
Use Send as when the delegate should be invisible, for example a shared role account that staff send from.
5Grant Send on behalf of permission (optional)
Let the delegate send mail shown as on behalf of the owner.
Mail > Send on behalf of permissions > Add permissions > select the delegate > AddIf you'd rather recipients see who actually sent the message, use Send on behalf of instead of Send as. On the Mail tab, select Send on behalf of permissions, choose Add permissions, select the delegate, and select Add.
With this permission, sent messages show as from the delegate on behalf of the owner, so the relationship is clear to the recipient.
Expected result: The delegate appears in the Send on behalf of list and can send on behalf of the owner once it takes effect.
Note
Grant either Send as or Send on behalf of, depending on whether you want the sender hidden or shown. You rarely need both.
6Alternative: grant the permissions with PowerShell
Set the same permissions from Exchange Online PowerShell.
Exchange Online PowerShellIf you prefer scripting or need to grant access in bulk, you can set the same permissions from Exchange Online PowerShell after running Connect-ExchangeOnline. The commands below grant Full Access, Send as, and Send on behalf of respectively.
Add -AutoMapping $false to the Full Access command if you don't want the mailbox to open automatically in the delegate's Outlook profile.
Connect-ExchangeOnline
Add-MailboxPermission -Identity owner@contoso.com -User delegate@contoso.com -AccessRights FullAccess -InheritanceType All
Add-RecipientPermission -Identity owner@contoso.com -Trustee delegate@contoso.com -AccessRights SendAs
Set-Mailbox -Identity owner@contoso.com -GrantSendOnBehalfTo delegate@contoso.comExpected result: The cmdlets complete without error, and the permissions match what you'd set in the admin center.
Note
Replace the sample addresses with the real owner and delegate. Run only the lines for the permissions you actually want to grant.
7Verify the access as the delegate
Confirm the delegate can reach the mailbox.
Outlook or Outlook on the web (as the delegate)Allow up to 60 minutes for the change to take effect. Then, as the delegate, open Outlook or Outlook on the web. With Read and manage granted, the mailbox usually appears automatically in Outlook thanks to auto-mapping; you may need to restart Outlook first. In Outlook on the web, you can also select your profile picture and choose Open another mailbox to open it manually.
Expected result: The delegate can open the owner's mailbox and, if granted, send mail as or on behalf of the owner.
Note
If it still isn't working after an hour, have the delegate sign out and back in, and check the troubleshooting section below.
Confirm the mailbox access is working
Confirm configuration
Once the permissions have propagated, the delegate should be able to work in the other mailbox exactly as you intended. With Read and manage in place, they can open the mailbox and read, organize, and delete its messages. If you also granted Send as, mail they send from that mailbox will look as if the owner sent it. If you granted Send on behalf of instead, their messages will show as sent by the delegate on behalf of the owner.
You can confirm the setup from two sides. In the admin center, reopen the owner's Mail tab and check that the delegate is listed under the permission you granted. As the delegate, open the mailbox and send a quick test message to confirm the sending behavior matches what you expect.
Normal result: The delegate opens the owner's mailbox and can read and manage it, and sending behaves as granted (as the owner for Send as, or on behalf of the owner for Send on behalf of).
Abnormal result: The mailbox doesn't appear, or the delegate gets a permission error when opening it or sending. This usually means the change hasn't propagated yet, Outlook needs a restart, or the wrong permission was granted.
Assistant with Read and manage plus Send as
Opens the manager's mailbox in Outlook and sends a reply that appears to come from the manager.
Team member with Send on behalf of
Sends an update that shows as from them on behalf of the shared owner account.
Troubleshooting
The delegate still can't open the mailbox after granting access
Warning
Cause: The change hasn't propagated yet, or Outlook hasn't picked it up.
Wait up to 60 minutes for the permission to take effect. Then have the delegate restart Outlook, or open the mailbox in Outlook on the web using Open another mailbox. If it still fails, confirm the delegate is listed under Read and manage permissions on the owner's Mail tab.
The mailbox doesn't appear automatically in Outlook
Note
Cause: Auto-mapping is off, was disabled, or the permission was granted to a group.
Auto-mapping only works for individual users granted Full Access, not groups. If it's off, the delegate can add the mailbox manually in Outlook, or you can re-grant Full Access with auto-mapping enabled using Add-MailboxPermission in PowerShell.
Send as or Send on behalf of fails in Outlook
Warning
Cause: The mailbox is hidden from the address list, or address book data is cached.
Make sure the owner's mailbox is visible in the Global Address List, since Send as and Send on behalf need it visible in the Outlook desktop client. Then clear the Outlook cache, or test in Outlook on the web, which reflects permission changes more quickly.
You can't find the mailbox permission options
Note
Cause: Your account lacks the required admin role.
Confirm your account has the Global Administrator or Exchange Administrator role. Without one of these, the Read and manage, Send as, and Send on behalf of options won't appear on the user's Mail tab.
Frequently asked questions
What's the difference between Read and manage and Full Access?
They are the same permission. Read and manage is the name used in the Microsoft 365 admin center, while Full Access is the name used in the Exchange admin center. Both let the delegate open and manage the mailbox, but not send from it.
Does Read and manage let the delegate send email?
No. Read and manage (Full Access) only lets the delegate open, read, and manage the mailbox. To let them send, you also grant Send as, so mail appears from the owner, or Send on behalf of, so mail shows as sent on behalf of the owner.
How long does it take for mailbox access to work?
Once you save the permission, it can take up to 60 minutes to propagate and take effect. Outlook may also need a restart before the mailbox appears, so allow some time before assuming something is wrong.
What's the difference between Send as and Send on behalf of?
With Send as, the message looks like it came straight from the owner, with no sign a delegate sent it. With Send on behalf of, the recipient sees the message as from the delegate on behalf of the owner, so the relationship is visible.
Can I grant access to a mailbox in another organization?
No. Mailbox permissions can only be set within your own Microsoft 365 organization. You can't grant a user in another tenant access to a mailbox in yours.
Should I use a shared mailbox instead?
If several people need to monitor and send from one common address, a shared mailbox is usually a better fit than delegating a personal mailbox. Use delegated access when one person is helping with another individual's mailbox.
Conclusion
Granting a user access to another mailbox in Microsoft 365 comes down to choosing the right permission and applying it from the owner's account. In the Microsoft 365 admin center, go to Users then Active users, select the mailbox owner, and use the Mail tab. Read and manage lets the delegate open and manage the mailbox, Send as lets them send as the owner, and Send on behalf of lets them send on behalf of the owner. You can do the same from Exchange Online PowerShell when you need to script or bulk-apply changes.
Remember that Read and manage alone does not allow sending, that changes can take up to 60 minutes to take effect, and that everything happens within your own organization. Verify the result by opening the mailbox as the delegate and sending a test message.
Grant mailbox access from the owner's Mail tab in the Microsoft 365 admin center, and match the permission to the need: Read and manage to open the mailbox, plus Send as or Send on behalf of if the delegate must send.
Microsoft 365 admin center > Users > Active users > select the mailbox owner > Mail > Read and manage permissions > Add permissions > select the delegate > AddSources4
