Office 365, Email, Shared mailbox permissions

Full access and send-as permissions on Exchange mailboxes need to be granted to mail-enabled universal security groups

Full Access and Send-as Permissions on Shared Mailboxes in Exchange Online (Office 365)

Exchange Online (Office 365) requires that groups that are used for full access and send-as permissions on mailboxes be mail-enable universal security groups.  Global and domain.local groups will not work and will be dropped from permissions upon migration to Exchange Online (Office 365).  We have about 5,000 groups that will need to corrected before the impacted mailboxes are migrated.

We are creating a daily report in CSV format that lists the current groups that need attention.  That file is available here:


You have a few options on how to correct these groups:
  • Do nothing and no longer use a group for permissions on the mailbox
  • Change the group type to Universal using Active Directory Users and Computers (ADUC) or PowerShell, then mail-enable it using ADtools or a request to exchange@illinois.edu
  • Request that we use a script to read the current group's membership and create a new universal security group in your OU with the same name and a suffix of -O365 and populate it with the members of the original group, then mail enable it and hide it from the GAL
  • Create a new Universal security group using Active Directory Users and Computers (ADUC) or PowerShell, then mail-enable it and grant it full access and send-as rights using ADtools or a request to exchange@illinois.edu





Keywords:Exchange, migrations, office 365, email, permissions   Doc ID:81943
Owner:Office 3.Group:University of Illinois Technology Services
Created:2018-04-27 14:55 CDTUpdated:2018-05-02 13:24 CDT
Sites:University of Illinois Technology Services
Feedback:  1   0