In today’s collaborative workplaces, employees often need access to specific mailbox folders rather than an entire mailbox. Executive assistants may need to manage an executive’s Inbox, project coordinators might require access to shared contacts, and legal teams frequently collaborate on active case correspondence. In these situations, granting Full Access to a mailbox is unnecessary and often exposes information that users don’t need to see.
Exchange Online supports folder-level permissions, allowing administrators to delegate access to individual folders such as Inbox, Calendar, and Contacts without granting unrestricted access to the entire mailbox. In this guide, let’s see Exchange Online folder permissions work and show you how to delegate access to Inbox, Calendar, and Contacts folders.
Folder Permission Levels in Exchange Online
When managing folder-level access, Exchange Online simplifies administrative work by packaging complex access control lists into human-readable roles. Behind the scenes, these roles control specific actions like reading, creating, or deleting items.
Understanding these roles ensures you never accidentally give away more access than intended:
- Owner: Full control of the folder. The delegate can read, create, modify, and delete all items, create subfolders, and even alter folder permissions.
- Publishing Editor: Can read, create, modify, and delete all items, as well as create subfolders.
- Editor: Can read, create, modify, and delete all items within that specific folder (cannot create subfolders).
- Publishing Author: Can read and create items, create subfolders, and edit/delete items they created.
- Author: Can read and create items and edit/delete items they created (cannot create subfolders).
- Non-Editing Author: Can read and create items and delete items they created.
- Reviewer: Purely read-only access. The delegate can view items but cannot create, modify, or delete anything.
- Contributor: Can create items (such as dropping a file or sending a draft into the folder) but cannot view the contents of the folder.
- None: Completely revokes or blocks access to the folder.
How to Delegate Access to Inbox and Contact Folders
There are two common ways to delegate folder-level permissions in Exchange Online. End users can share folders directly through Outlook, while administrators can use Exchange Online PowerShell to manage permissions centrally across the organization.
Method 1: Delegation via Outlook (Web & Desktop)
For standard users, the most direct path to share an Inbox or Contacts folder is through the standard Outlook interfaces.
Utilizing Outlook on the Web
- Open your mailbox and locate your folder sidebar on the left.
- Right-click on the specific folder (e.g., Inbox or Contacts) and select Sharing and permissions.
- Input the email address or name of the employee requiring access.
- Pick the appropriate role from the drop-down menu and save your changes.
Utilizing Outlook Desktop
- Open the Outlook application and locate your folder hierarchy.
- Right-click the Inbox (or navigate to the People section and right-click your Contacts folder).
- Select Properties and switch to the Permissions tab.
- Click Add, select the target user from your Global Address List (GAL), define their role, and click Apply.
The native Exchange Admin Center lacks a dedicated graphical interface to manage individual folder permissions for end-users, meaning admins must rely on alternative methods for enterprise-wide changes.
Method 2: Delegation via Exchange Online PowerShell
Exchange Online PowerShell provides administrators with precise control over mailbox folder permissions. Before running the following commands, connect to Exchange Online PowerShell using an account with the required administrative permissions.
Scenario 1: Delegating Access to the Inbox Folder
Suppose an executive wants their assistant to manage incoming emails without granting access to the rest of the mailbox.
Before assigning permissions to the Inbox itself, the assistant should be able to access the mailbox root folder.
Add-MailboxFolderPermission -Identity "executive@contoso.com" -User "assistant@contoso.com" -AccessRights Reviewer Next, target the Inbox specifically. In this example, we will assign the Editor role so the assistant can manage emails fully:
Add-MailboxFolderPermission -Identity "executive@contoso.com:\Inbox" -User "assistant@contoso.com" -AccessRights Editor Never assume a permission has taken effect without checking. Run a quick verification query:
Get-MailboxFolderPermission -Identity "executive@contoso.com:\Inbox" -User "assistant@contoso.com" Scenario 2: Delegating Access to the Contacts Folder
The same approach applies when sharing a Contacts folder. First, ensure the delegate has access to the mailbox root.
Add-MailboxFolderPermission -Identity "executive@yourdomain.com" -User "assistant@yourdomain.com" -AccessRights Reviewer Then you can assign contacts permission like Reviewer or Read-Only role.
Add-MailboxFolderPermission -Identity "executive@contoso.com:\Contacts" -User "assistant@contoso.com" -AccessRights Reviewer Finally, verify the assigned permissions.
Get-MailboxFolderPermission -Identity "executive@contoso.com:\Contacts" -User "assistant@contoso.com" Working with Localized Folder Names
One important consideration when using Exchange Online PowerShell is that folder names depend on the mailbox’s language settings.
For mailboxes configured in English, folder names such as Inbox and Contacts work as expected. However, if the mailbox uses another language, you must reference the localized folder name instead. For example, a German mailbox uses Kontakte, a Spanish mailbox uses Contactos, and other languages have their own folder names. If you receive a “folder not found” error despite using the correct cmdlet, verifying the mailbox language and folder names should be one of your first troubleshooting steps.
Method 3: Delegate Folder Permissions Using EasyEntra
Exchange Online PowerShell gives administrators complete control over folder permissions, but it also requires remembering cmdlets, mailbox paths, localized folder names, and permission levels. While this may be manageable for occasional tasks, it quickly becomes time-consuming when you’re managing permissions across dozens or hundreds of mailboxes.
EasyEntra simplifies the entire process through an intuitive graphical interface. Instead of manually running PowerShell commands, administrators can browse a mailbox, select the required folder, search for the delegate, and assign the appropriate permission level in just a few clicks.
The Folder Permissions window provides a complete overview of the selected folder and its delegates.
- Folder Type lets you quickly switch between supported Exchange Online folders, including Inbox, Calendar, Contacts, Drafts, Sent Items, Tasks, Notes, and more.
- Search Box allows you to quickly locate users and grant new permissions.
- Permission List displays all existing delegates together with their current permission levels.
- Remove instantly revokes delegated access for the selected user.
- Permission Level allows you to modify a selected delegate’s access without recreating the permission.
- Sharing Permission Flags provides additional Exchange Online sharing options where applicable.
How to Configure Folder Permissions in EasyEntra
Follow these steps to delegate access to an Inbox, Contacts, Calendar, or other mailbox folder:
- Open EasyEntra and locate the user whose mailbox you want to manage.
- Open the user’s Properties window and navigate to the Mailbox tab.
- Click Folder Delegation to open the Folder Permissions window.
- From the Folder type drop-down menu, choose the mailbox folder you want to manage, such as Inbox, Contacts, Calendar, Drafts, or Sent Items.
- In the Search box, search for and select the user who should receive delegated access.
- Select the appropriate Permission Level from the available Exchange Online roles, such as Reviewer, Editor, Publishing Editor, or Owner.
- If required, modify or remove existing delegates directly from the permissions list.
- Click OK to apply the changes.
You can also change existing permissions by selecting the delegate and adjusting the Permission level.
EasyEntra automatically performs the required Exchange Online operations in the background, eliminating the need to remember PowerShell cmdlets or worry about localized folder names!
