Shared mailboxes and auto-mapping

When you grant Full Access to a mailbox, Exchange writes the trustee onto the

mailbox's msExchDelegateListLink attribute. Outlook for Windows reads that

attribute when it builds a profile and silently adds any mailbox it finds there.

That behaviour is called auto-mapping.

Two consequences follow, and they cause most shared-mailbox tickets.

"It works in the browser but not in Outlook"

Outlook on the web does not use auto-mapping. It opens whatever the user has

permission to open. So a mailbox that opens on the web but never appears in desktop

Outlook has correct permissions and no auto-mapping — which is almost always

because the grant was made with -AutoMapping $false.

Add-MailboxPermission -Identity ap@contoso.com -User marcus.bell@contoso.com `
    -AccessRights FullAccess -AutoMapping $false

Check what was actually run:

Get-MailboxPermission -Identity ap@contoso.com |
  Where-Object { $_.User -like '*marcus*' } |
  Format-List User, AccessRights, IsInherited, Deny

The auto-mapping flag is not shown by Get-MailboxPermission. Read the audit log

for the Add-MailboxPermission entry and its parameters, or infer it from

behaviour: permission present, mailbox absent from the profile.

Fixing it

Remove and re-add the permission with auto-mapping enabled:

Remove-MailboxPermission -Identity ap@contoso.com -User marcus.bell@contoso.com `
    -AccessRights FullAccess -Confirm:$false
Add-MailboxPermission -Identity ap@contoso.com -User marcus.bell@contoso.com `
    -AccessRights FullAccess -AutoMapping $true

Then have the user fully exit Outlook and reopen it. Closing the window is not

enough; the attribute is only read when the profile is built. Allow a few minutes

for directory propagation before they restart.

Rebuilding the Outlook profile does not help. A new profile reads the same

server-side attribute and reaches the same conclusion — at the cost of a full

re-sync of the user's primary mailbox.

"There are too many mailboxes in my Outlook"

The reverse problem. Users who accumulate Full Access to many shared mailboxes end

up with all of them auto-mapped, which slows profile build and clutters the folder

list. Grant those with -AutoMapping $false and have the user add the mailbox

manually as an additional account — that is what the flag is for.

Licensing

A shared mailbox does not need a licence while it stays under 50 GB and has no

archive or litigation hold. Adding a licence does not change auto-mapping, and it

does not fix visibility. If the mailbox is over 50 GB, or needs an in-place archive

or litigation hold, it needs an Exchange Online Plan 2 licence — that is a

different problem with a different symptom.

Troubleshooting an Outlook profile
Mailbox quotas and archiving

"It works in the browser but not in Outlook"

Fixing it

"There are too many mailboxes in my Outlook"

Licensing

Related