Forum Discussion
Non-owners deleting conversations from Outlook on iOS
Well everyone in the group has equal access, thus you do not need to be an owner in order to delete stuff. At least that was the initial intention, as at some point Microsoft seems to have changed the behavior. Looking at the mailbox folder permissions now, you can see that members of the Group get Author permissions, in other words they can only delete items they've created. You can easily confirm this by looking at the permissions, or by performing tests in OWA/Outlook.
# Get-MailboxFolderPermission default -GroupMailbox
FolderName User AccessRights
---------- ---- ------------
Top of Informatio... Default {None}
Top of Informatio... Anonymous {None}
Top of Informatio... Owner@local {ReadItems, CreateItems, EditOwnedItems, DeleteOwnedItems, DeleteAllItems, ...
Top of Informatio... Member@local {Author}
I imagine the tests you did via iOS were with the Author of the message, thus you were able to delete it.
On a side note, are your O365 Groups associated with your onmicrosoft.com domain, or a custom one?
Sorry if I wasn't clear but no, I'm talking about members deleting other people's messages, not their own.
It's affecting both groups that are associated with our custom domain, and ones that are .onmicrosoft.com, it doesn't seem to matter.
I confirmed the permissions on the group are what you described, and as far as I can remember it has worked that way at least as far back as 2015.
get-mailboxfolderpermission -GroupMailbox -Identity groupname@example.onmicrosoft.com
FolderName User AccessRights SharingPermissionFlags
---------- ---- ------------ ----------------------
Top of Informatio... Default {None}
Top of Informatio... Anonymous {None}
Top of Informatio... Owner@local {ReadItems, CreateItems, EditOwnedI...
Top of Informatio... Member@local {Author}
in other words they can only delete items they've created.
That's exactly what I'm saying, they SHOULD only be able to delete items they created, not anyone's items. In Outlook on the Web and Desktop Outlook 2019 it works as expected. But Outlook on iOS (And as far as I can tell, Android too) it completely ignores those permissions and allows any member to delete any message, including other users'.
I'm just curious if anyone else can try it with a test group in their own tenant to give me a hint whether it's a bug in the iOS app itself, or just a misconfiguration on our tenant. I have tickets open with both Office 365 support and the iOS Outlook in-app support but I'm not sure which side to pressure more.
I don't have iOS to test, but on the Android app I can only delete my own messages. Unless I'm an owner that is.