Access to Shared Mailbox for non trusted domain users?

[Admin O365]

Scenario: Office365 Tenant: abc.com Users able to access shared mailbox residing on trusted client domain: xyz (using Exchange 2016) Recently, XYZ has moved all mailboxes (user mailbox and shared mailbox) to its Office365 Tenant: xyz.com Since then, users from abc.com can no longer access the shared mailboxes. Any suggestion on what can be done?

[#2]

Hello,

Unfortunately you cannot assign permissions to a shared mailbox for a user that rests outside of the tenant.

In the previous setup you had, I would think you had an organizational relationship setup with your exchange 2016 server that allowed you to do this. That is not possible between O365 tenants.

I would approach this in a few different ways, based on what you find works best:
1. To me the easiest would be to setup a forward on that mailbox to send to a mailbox on your tenant. So any mail that comes into shared@xyz.com forwards to shared@abc.com. You could use "Set-Mailbox shared@xyz -ForwardingSmtpAddress shared@abc.com -DeliverToMailboxAndForward $True" and it should work, just make sure you, you have the last flag to keep a copy.

2. If that solution doesnt work because the XYZ company doesn't want to forward mail externally, I would maybe look at cheap alternatives like an extra account on the xyz.com tenant that can be used by your users abc@xyz.com, that has access, and then your users would just need to setup abc@xyz.com in their outlook profile as well.

Hope this helps give you some ideas, but ultimately you will need to do something like the above as what you are looking to do just does not work across tenants.

Adam

[#3]

Hi Adam,

Thanks for the clarity.

So Office365 Tenants cannot be federated to the external domain, even though they are federated with the on-premise Active Directory and they are using Azure AD?

[#4]

Hey @Admin O365,

In short yes.

If you have the organizational relationship setup, with all the needed connectors etc, then you can do the permissions as you are talking (to the one exchange system you own that your AD is linked too, etc).

But just an external domain, that is not in a hybrid setup with your O365 tenant, cannot do the permissions.

Adam