EXCHANGE ONLINE ADMINISTRATION & ACCESS AUDITING

01 // EXECUTIVE SUMMARY

Project Overview

This project demonstrates Exchange Online administration and access auditing through a controlled Microsoft 365 Business Premium lab environment.

I configured shared mailbox delegation, investigated an Outlook access-denied error, verified mailbox access and Send As functionality, examined message tracing, and developed a PowerShell script to retrieve and export mailbox permissions.

03 // ACCESS CONFIGURATION

Shared Mailbox Delegation

The Security shared mailbox was used to demonstrate delegated access administration in Exchange Online.

A test identity received Full Access permissions to open and manage mailbox contents, along with Send As permissions to send messages using the shared mailbox identity.

These permissions were assigned individually to support least privilege. The test user did not require Exchange Administrator privileges to access the mailbox.

04 // TROUBLESHOOTING

Outlook Access-Denied Investigation

During initial testing, Outlook returned an access-denied error when attempting to open the Security shared mailbox.

I confirmed that the user's primary Outlook mailbox was accessible, verified the assigned delegation permissions, and tested an alternative shared mailbox access method.

Access succeeded during a later test after additional time had passed. Permission propagation was a possible explanation, but the exact cause of the initial error was not conclusively established.

05 // MAIL FLOW ANALYSIS

Send As Verification & Message Tracing

I verified Send As functionality by sending a controlled test message using the Security shared mailbox identity. The message was received with Security displayed as the sender.

I then used Exchange Online message trace to investigate the message's processing and examine delivery-related information.

This exercise reinforced the distinction between message delivery and recipient readership. A delivered message is not necessarily one that the recipient has opened or read.

06 // POWERSHELL AUDITING

Programmatic Permission Verification

Using the ExchangeOnlineManagement PowerShell module, I independently retrieved the Security mailbox's Full Access and Send As assignments.

I also compared two similarly named accounts using Exchange recipient information and verified that they represented distinct Entra ID objects.

I developed and executed a reusable PowerShell script that reports delegated mailbox permissions and exports the results to a CSV file.

07 // EVIDENCE ARCHIVE

Full Technical Report

The technical report documents the mailbox configuration, access troubleshooting, Send As verification, message tracing, PowerShell audits, and CSV reporting. Supporting screenshots capture the configuration, investigation, and verified results.

08 // LESSONS LEARNED

Key Takeaways

This exercise strengthened my understanding of Exchange Online delegation, least privilege, Outlook access troubleshooting, message tracing, Exchange Online PowerShell, and structured permission reporting.

It also demonstrated how administrative configuration can be supported by repeatable, read-only access auditing rather than relying exclusively on graphical management tools.