Setting SendAs of Send on Behalf Of Permissions in Exchange Online / BPOS

Until recently a Service Requested needed to be sent in to grant users SendAs of SendOnBehalfOf permissions to another users mailbox. With the availability of the new Migration Tools and Microsoft Online Services administrators are now able to grant these permissions themselves through PowerShell.

• GrantFullAccess: Grant full permissions of one Exchange Online user to the mailbox of another Exchange Online user.
• GrantSendAs: This allows an Exchange Online user to send mails As another user.
• GrantSendOnBehalfOf: An Exchange Online User is now able to send mails on behalf of another user.

The command used in PowerShell to grant other users access to a mailbox is Add-MSOnlineMailPermission.

So in order to grant user1@msonline.com Send As permissions on the mailbox of user2@msonline.com the following command would be used:

PS> Add-MSOnlineMailPermission Identity user1@msonline.com -TrustedUser user2@msonline.com–GrantSendAs True

The full string for this command is:

Add-MSOnlineMailPermission [-GrantSendAs] [-Identity] <String> [-Credential <PSCredential>] -TrustedUser <string> [-GrantFullAccess]

Or

Add-MSOnlineMailPermission [-GrantSendOnBehalfOf] [-Identity] <String> [-Credential <PSCredential>] -TrustedUser <string> [-GrantFullAccess]

Next to setting the user permissions the user permission can also be deleted. For this the command Remove-MSOnlineMailPermission is used.

The full string for this command is:

Remove-MSOnlineMailPermission [-RemoveSendAs] [-Identity] <String> [-Credential <PSCredential>] [-RemoveSendAs] [-RemoveFullAccess] -TrustedUser <string>

Or

Remove-MSOnlineMailPermission [-RemoveSendOnBehalfOf] [-Identity] <String> [-Credential <PSCredential>] [-RemoveSendAs] [-RemoveFullAccess] -TrustedUser <string>

Comments

[Scharmers]

The problem is that the SendAs switch is broken for a lot of users, due to occassional mismatches between a user's CN and their SMTP alias. If this happens and you're POSITIVE you're typing in the command correctly (not a forgone conclusion here, believe me), you will still need to call BPOS to have the permissions granted.

[Richard Thornton]

Hi Danny, thanks for the article. In your example for Add-MSOnlineMailPermission you are missing the hyphen on Identity. It's a really simple thing but it took me a few minutes to find it! :)

[Jørgen Staun]

THANK YOU!!! for mention the missing hyphen, the MS documentation is missing this as well and I've been fighting with this for an hour now.