Restrict users from deleting emails in Shared Mailbox

[MiSum83]

Hi team,

is there a way to restrict ppl from deleting emails in a shared mailbox? We are using Exchange Online.

[#2]

You can use folder-level permissions for that. If you are using Full Access, there is no way to restrict deleting.

[#3]

is there any guide about how to utilize folder-level permission? Have no idea aobut how to do it :) ...I can remove full access if required.

[#4]

Right-click on a folder > Properties > Permissions :) If you want to automate things, use PowerShell and the Add-MailboxFolderPermission cmdlet: https://docs.microsoft.com/en-us/powershell/module/exchange/add-mailboxfolderpermission?view=exchang...

[#5]

ideally I do it via GUI and so.... Not good with PowerShell :)

Folder - should I do it in Outlook? ... I mean... right-click on Inbox folder of shared mailbox and do it there?

How do I remove full access please? Should I remove delegates in EAC?

[#6]

You can do it in both Outlook or OWA, although if you want to grant Calendar permissions, only Outlook exposes them. For full access, use the EAC or PowerShell.

[#7]

thanks Vasil for being patient with me :).... One last question I hope - how to remove full access via EAC? Are we talking about removing users from Delegation -> Read/Manage?

[#8]

Yes, that's how it's shown in the EAC.

[#9]

cool... that seems to be working..... I've set permission on "Inbox" folder to reviewer in that mailbox and seems to be working fine. Just looks that it does not apply to subfolders..... so would need to manually change permissions for each manually.... For emails stored directly in INBOX, it works fine and cannot delete emails anymore

[#10]

Yes, you need to configure permissions on each folder individually. Here's a script that can automate the process: https://www.michev.info/Blog/Post/2063/managing-mailbox-permissions-on-the-folder-level-in-bulk

[#11]

well... so when I rmeoved from Delegation ->Read/Manage (to modify full access) and added reviewer for the testuser on Inbox directly.... The shared mailbox disappeared...... So looks like the Delegation can't be removed like that :\

[#12]

That's expected, you need to add the mailbox manually, only Full access permissions will result in auto-magically appearing in the list.

[#13]

ok... so I've tested a little bit and here is the result...

I have used outlook and EAC and tried to follow the steps.... Avoiding powershell for now :) ... Below is what I've done and result:

• I have removed testuser from "Read & Manage" delegation and kept in "Sent as" via EAC for shared folder
• In outlook, I've modified I've changed permission to REVIEWER on INBOX in that shared mailbox

Result:

• when kept outlook openend, after a while the persmissions were applied and I could not delete emails. When I checked permissions they were greyed out and were showing Reviewer, so looked nice. 
• When did restarting outlook, shared maiblox disappeard after a while. So I've added it manually via account/email/more and advanced. The shared mailbox was added BUT I can not expand even to see inbox. I get message "Cannot expand the folder"

:\

[#14]

You need to add at least "Folder visible" permissions on each folder in the path, including the Root one (the one with the shared mailbox address).

[#15]

cool.... You were right, ... the problem was with subfolders... When I created a test shared mailbox with Inbox only and no subfolders, it was working fine.... :)