Comprehensive Guide to Configuring Mailbox Moderation and Permissions in Microsoft 365 Exchange Online

Comprehensive Guide to Mailbox Moderation and Permissions in Microsoft 365 Exchange Online

Managing mailbox permissions and message moderation in Microsoft 365 Exchange Online is crucial for maintaining communication security, accountability, and workflow efficiency. This guide provides detailed explanations and configuration steps for setting up moderated recipients, delegating mailbox access, and assigning Send As or Send on Behalf permissions—using both the Exchange Admin Center (EAC) and PowerShell.

---

1. Configure a Moderated Recipient in Exchange Online

Purpose

Moderated recipients allow administrators to control the flow of emails sent to sensitive mailboxes or distribution groups. Messages are first reviewed by an assigned moderator before delivery, ensuring confidential or high-impact emails are approved.
This is especially useful for departments such as Finance, HR, or Legal where information sensitivity and data control are essential.

Key benefits:

• Prevents accidental or unauthorized emails.
• Ensures compliance with internal communication policies.
• Enables human oversight of group communication.

Configuration Steps

Exchange Admin Center (EAC)

1. Sign in to https://admin.exchange.microsoft.com as a Global or Exchange Administrator.
2. Navigate to Recipients → Mailboxes or Groups.
3. Select the target mailbox or group.
4. Under Mail flow settings, click Message approval.
5. Enable “Messages sent to this recipient must be approved by a moderator.”
6. Add one or more moderators (individuals responsible for approvals).
7. Configure sender notification preferences to alert senders of message approval or rejection.
8. Save your configuration.

PowerShell

Connect-ExchangeOnline
Set-DistributionGroup -Identity "FinanceDept" -ModerationEnabled $true `
-ModeratedBy user1@contoso.com -SendModerationNotifications Always
Get-DistributionGroup -Identity "FinanceDept" | Format-Table DisplayName,ModerationEnabled,ModeratedBy

Validation

• Send a test email to the moderated recipient (e.g., FinanceDept@contoso.com).
• Confirm the moderator receives an approval request.
• Once approved, the message should appear in the target mailbox or group.
• Check moderation logs using: Get-MessageTrace -Recipients FinanceDept@contoso.com -StartDate (Get-Date).AddHours(-1)

Best Practices

• Assign responsible and available moderators to prevent communication delays.
• Use moderation sparingly for critical mailboxes.
• Schedule periodic audits to confirm assigned moderators are active.
• Communicate to senders that moderation is in effect to reduce confusion.

Use Case

The Finance Department manages sensitive data.
A moderated distribution group FinanceDept@contoso.com is configured with the department head as moderator.
All incoming emails require approval before delivery, ensuring only relevant and authorized messages reach the group.

---

2. Assign Full Access Permission on Mailboxes

Purpose

Full Access permission allows a user to open and manage another mailbox—read, reply, delete, and organize messages.
However, it does not grant the ability to send emails as that mailbox; for that, Send As or Send on Behalf permissions are needed.

This permission is ideal for:

• Departmental or shared mailboxes (e.g., support@contoso.com).
• Assistants or delegated roles managing executive mailboxes.
• Multi-user teams collaborating via a shared inbox.

Configuration Steps

Exchange Admin Center (EAC)

1. Sign in to https://admin.exchange.microsoft.com.
2. Navigate to Recipients → Mailboxes.
3. Select the target mailbox.
4. Go to Mailbox delegation → Full Access → Edit.
5. Add the required users or groups and click Save.

PowerShell

Connect-ExchangeOnline
Add-MailboxPermission -Identity "SupportTeam" -User user1@contoso.com `
-AccessRights FullAccess -InheritanceType All
Get-MailboxPermission -Identity "SupportTeam" | Where-Object {$_.User -like "user1*"}

Validation

• User should be able to open the delegated mailbox from Outlook or OWA.
• Test reading and moving emails.
• Verify permissions: Get-MailboxPermission -Identity "SupportTeam"

Best Practices

• Limit access to only necessary users to reduce risk.
• Review permissions quarterly for accuracy.
• Use Access Review policies in Entra ID for auditing.
• Combine with Send As or Send on Behalf for complete mailbox collaboration.
• Document all permission changes for compliance.

Use Case

A shared mailbox SupportTeam@contoso.com is managed by five agents.
Each agent is given Full Access, allowing them to read and respond to customer inquiries collectively while maintaining visibility over all incoming messages.

---

3. Grant Send As Permission on Mailboxes

Purpose

Send As permission allows a user to send messages that appear to come directly from another mailbox.
The recipient sees only the mailbox name (e.g., SupportTeam@contoso.com), maintaining a professional and consistent identity.

This is commonly used for:

• Shared or department mailboxes.
• Executive assistants sending on behalf of their manager.
• Teams using a unified external communication identity.

Configuration Steps

Exchange Admin Center (EAC)

1. Sign in to the Exchange Admin Center.
2. Navigate to Recipients → Mailboxes.
3. Select the target mailbox → Mailbox permissions → Send As → Edit.
4. Add the user(s) who require Send As permissions → Save.

PowerShell

Connect-ExchangeOnline
Add-RecipientPermission -Identity "SupportTeam" -Trustee user1@contoso.com -AccessRights SendAs
Get-RecipientPermission -Identity "SupportTeam" | Where-Object {$_.Trustee -like "user1*"}

Validation

• The delegated user sends a test email.
• Verify that the message appears to come from SupportTeam@contoso.com.
• Check permissions: Get-RecipientPermission -Identity "SupportTeam"

Best Practices

• Restrict Send As to trusted users only.
• Log and document permission changes for audits.
• Revoke permissions for inactive or transferred users immediately.
• Combine with Full Access for complete mailbox management.

Use Case

Customer support agents reply to customers as SupportTeam@contoso.com, maintaining a single sender identity.
This ensures consistent branding and prevents confusion when multiple team members manage client communication.

---

4. Assign Send on Behalf Permission

Purpose

Send on Behalf allows a user to send messages on behalf of another mailbox.
Recipients see the message as:

“From: User on behalf of Mailbox.”

This is useful when the sender needs to represent someone (e.g., an assistant sending emails for a manager) but the organization requires transparency.

Configuration Steps

Exchange Admin Center (EAC)

1. Go to https://admin.exchange.microsoft.com.
2. Navigate to Recipients → Mailboxes.
3. Select the mailbox → Mailbox delegation → Send on behalf → Edit.
4. Add delegated users → Save changes.

PowerShell

Connect-ExchangeOnline
Set-Mailbox -Identity "SupportTeam" -GrantSendOnBehalfTo user1@contoso.com
Get-Mailbox -Identity "SupportTeam" | Format-Table DisplayName,GrantSendOnBehalfTo

Validation

• Send a test email from the delegated user.
• The message should show “From: user1 on behalf of SupportTeam.”
• Confirm delegation in Outlook or PowerShell.

Best Practices

• Assign only to trusted delegates or executive assistants.
• Maintain transparency with recipients by using this method instead of Send As.
• Combine with Full Access if mailbox management is required.
• Regularly audit Send on Behalf permissions.

Use Case

An executive assistant sends meeting invitations and updates on behalf of the CEO.
The recipient sees “From: Assistant on behalf of CEO,” maintaining transparency while ensuring efficient delegation.

---

Summary and Recommendations

Microsoft 365 Exchange Online provides fine-grained control over mailbox permissions and email moderation to protect sensitive communication.
Administrators should:

• Use Moderation for sensitive or high-risk groups.
• Assign Full Access for internal collaboration.
• Apply Send As or Send on Behalf based on required transparency.
• Conduct quarterly audits to maintain compliance and security integrity.

Through proper configuration and ongoing management, organizations can streamline collaboration while maintaining control, privacy, and accountability across all communication channels.

 

---

1. What is a Moderated Recipient in Exchange Online, and why is it used?

Answer:
A moderated recipient is a mailbox or distribution group that requires approval from a designated moderator before messages are delivered.
It is used to prevent unauthorized or accidental emails from reaching sensitive recipients such as HR, Finance, or Legal departments.

Explanation:
Moderation ensures that only approved communications are distributed. This helps maintain compliance and reduces the risk of data exposure. Moderation can be applied to mailboxes, distribution groups, or shared mailboxes via the Exchange Admin Center or PowerShell.

---

2. How do you enable message moderation using PowerShell?

Answer:

Connect-ExchangeOnline
Set-DistributionGroup -Identity "FinanceDept" -ModerationEnabled $true `
-ModeratedBy user1@contoso.com -SendModerationNotifications Always

Explanation:
This command enables moderation for the FinanceDept group and assigns user1 as the moderator. The -SendModerationNotifications parameter controls whether senders receive notifications about approval status.

---

3. What is the difference between “Send As” and “Send on Behalf” permissions?

Answer:

• Send As: The user sends an email that appears to come directly from the mailbox (e.g., support@contoso.com).

• Send on Behalf: The user sends on behalf of another, and recipients see: “From: John on behalf of Support Team.”

Explanation:
Use Send As when you want a unified sender identity (like a department mailbox), and Send on Behalf when transparency is needed (e.g., assistants sending emails for executives).

---

4. Which PowerShell command allows a user to manage another mailbox without sending as that mailbox?

Answer:

Add-MailboxPermission -Identity "SupportTeam" -User user1@contoso.com `
-AccessRights FullAccess -InheritanceType All

Explanation:
The Full Access permission allows a user to read, reply to, and organize emails but does not allow sending messages as the mailbox. For that, Send As or Send on Behalf permissions are needed.

---

5. What could cause delays in moderated email delivery and how can you fix them?

Answer:
Possible causes:

1. Moderator mailbox is full or unavailable.

2. Transport rules conflict with moderation settings.

3. Moderation notifications disabled or blocked by policies.

Fix:

• Verify the moderator’s mailbox health.

• Review transport rules for overrides.

• Ensure moderators receive approval notifications (-SendModerationNotifications Always).

Explanation:
Moderation depends on mail flow and approval delivery. If moderators miss notifications, the messages remain pending indefinitely.

---

6. How can you verify that a user has been granted Full Access permission?

Answer:

Get-MailboxPermission -Identity "SupportTeam" | Where-Object {$_.User -like "user1*"}

Explanation:
This command lists users with access to the mailbox. If user1@contoso.com appears with FullAccess under AccessRights, the permission is correctly assigned.

---

7. When converting a user mailbox to a shared mailbox, what is the correct command and what happens to licensing?

Answer:
Command:

Set-Mailbox -Identity "John Doe" -Type Shared

Explanation:
Converting a user mailbox to a shared mailbox preserves all data while removing the need for a user license—provided the mailbox size remains under 50 GB. Shared mailboxes allow multiple users to access and manage messages collectively.

---

8. How do you set up email moderation for a large distribution group in Exchange Admin Center?

Answer:

1. Go to https://admin.exchange.microsoft.com.

2. Navigate to Recipients → Groups → Select the group.

3. Choose Mail flow settings → Message approval.

4. Enable “Messages sent to this recipient must be approved by a moderator”.

5. Assign moderators and configure sender notifications.

6. Save changes.

Explanation:
Moderation helps prevent email floods or irrelevant messages from reaching all members of a large distribution group. It’s especially effective for company-wide groups.

---

9. How can an admin audit all users with Send As permissions across mailboxes?

Answer:

Get-Mailbox -ResultSize Unlimited | Get-RecipientPermission | 
Where-Object {$_.AccessRights -match "SendAs"} | 
Select Identity, Trustee

Explanation:
This script lists all mailboxes with Send As permissions, including which users have delegated access. Regular audits are important for compliance and to prevent misuse.

---

10. A company wants agents to reply to customers as support@contoso.com, but internal audits should still show who sent the message. What configuration should be used?

Answer:
Use Send on Behalf permission.
This lets agents send messages as “Agent Name on behalf of Support Team,” ensuring visibility in both Outlook and audit logs.

Explanation:
“Send on Behalf” balances unified communication and transparency. Recipients see messages from the department but can identify the actual sender, which helps with accountability.

---

✅ Summary

These questions reinforce key Exchange Online administration skills:

• Moderation for message approval

• Delegated mailbox access

• Permission differentiation (Full Access, Send As, Send on Behalf)

• PowerShell management and auditing

By understanding these configurations, admins can manage permissions securely, reduce communication errors, and maintain compliance in Microsoft 365 environments.