Delegated Mailbox Access

The question it answers: Who has Full Access, Send As or Send on Behalf rights on which mailbox?

Note

Exchange.ManageAsApp is on the Office 365 Exchange Online API; the app also needs an Exchange read role (Global Reader is enough). One permission lookup per mailbox, so this runs as a scan.

At a glance

Where in the app	Exchange Online › Security › Delegated Mailbox Access
Workload	Exchange Online
Kind	Table
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online.
Report id (API and MCP)	exchange.security.exchange-online-mailbox-delegation-settings

Columns

Column	Key	Type
Mailbox	UserPrincipalName	Text
Mailbox Smtp Address	PrimarySmtpAddress	Text
Mailbox Directory Object Id	ExternalDirectoryObjectId	Text
Delegate User UPN	DelegateUserUPN	Text
Delegate (as Exchange lists it)	DelegateUser	Text
Delegate User Object Id	DelegateUserID	Text
Access Rights	AccessRights	Text
Is Inherited	IsInherited	YesNo

What it needs

Licence: Exchange Online.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application	Office 365 Exchange Online API

Data sources it reads

• Get-EXOMailbox -Properties GrantSendOnBehalfTo
• Get-EXOMailboxPermission (per mailbox)
• Get-EXORecipientPermission (per mailbox)
• Get-EXORecipient

Through the API and MCP

GET /ir-api/v1/reports/exchange.security.exchange-online-mailbox-delegation-settings?size=100
POST /ir-api/v1/reports/exchange.security.exchange-online-mailbox-delegation-settings/scan

An AI assistant reads it with the MCP tool get_report and the id exchange.security.exchange-online-mailbox-delegation-settings. The client needs the Run scan grant for Exchange Online. See Using the API.