who has access to a mailbox in Office 365
Who else can read the CFO's mailbox? The CFO probably doesn't know.
A typical mid-size tenant runs hundreds of shared mailboxes and thousands of delegate, send-as and send-on-behalf grants that nobody has reviewed since they were created - and reviewing them mailbox by mailbox is a job nobody finishes. 1Security records how every message was actually sent, makes each sending method a filter across the whole tenant, and flags the pattern that looks like a successful phish on its own.
The problem
Every mailbox has more keys than its owner knows about.
An assistant with Full Access from 2021. A shared mailbox created for a campaign that ended two years ago, still with six delegates. A send-as grant from a project nobody remembers. Each one is a way to read or impersonate a mailbox, and each is granted per mailbox, per permission type. Auditing them across the whole tenant by hand ends in a spreadsheet nobody trusts a week later.
Attackers know this. A compromised account rarely mails from itself: it sends on behalf of someone trusted, or from a shared mailbox where nobody owns the Sent folder. The message looks internal because, technically, it is. Business email compromise still costs organisations more than ransomware, and delegated sending is its favourite disguise.
1Security classifies every message by how it was really sent - direct, send as, send on behalf, shared mailbox, delegate access - and keeps that classification filterable across the tenant, next to who the recipients were, what was attached and whether the exchange got replies.
In practice
The mailbox access review, as one filter.
From "who can touch this mailbox" to a standing watch, in four steps.
- 01
Filter by sending method
Open Emails and filter to send as, send on behalf, shared mailbox or delegate access. Pull it across the tenant or scope it to one mailbox. Delegated sending becomes a list with dates and counterparties - typically hundreds of delegated sends a month in a mid-size tenant, most legitimate, a handful not.
- 02
Flag the two-way exchange
Switch to Conversations. Every thread rolls into one row and an outside sender who is getting internal replies is flagged - what a successful phish or invoice-fraud attempt looks like, a signal no single message carries. Combine with the phishing flag and you have the exchanges to look at first.
- 03
Follow what left
Classic attachments, cloud attachments and unique uploads - files sent by mail that exist nowhere in your SharePoint or OneDrive - are separate columns, with sensitive-information detections on top. "What left through this mailbox last quarter" has a precise answer instead of a search of the Sent folder.
- 04
Turn the review into a standing watch
Save the filter as a policy: sending method + external recipients + sensitive content. From then on the review runs continuously and you get an instant alert or a daily digest when a delegated identity is used to send something sensitive outside.
What makes it work
Email as a security signal, not an archive.
The mailbox access review rides on the platform's email intelligence and the permission graph around it.
Office 365 Access Management
The permission graph resolves who can reach what - mailboxes included - through every kind of grant, group and delegation.
Explore access management →Microsoft 365 Monitoring Tool
Email activity flows through the same real-time engine as files and sign-ins - a delegated send shows up in minutes.
Explore monitoring →Microsoft 365 Audit Tool
Up to three years of history behind every mailbox question, each event tied to the actor, device and location.
Explore the audit tool →
FAQ
Common questions.
Does 1Security read everyone's email?
No. The platform stores message metadata and detection results, not a browsable archive of message bodies. Content is streamed into analysis for sensitive-data detection and discarded; matched values are never written to the database. Nobody in IT gets a new way to read a colleague's inbox.
Is this a mailbox permission export?
It answers a better question. A permission export tells you who could use a mailbox on the day you ran it. 1Security shows who actually did - every send-as, send-on-behalf, delegate and shared-mailbox send, with dates, recipients and attachments, up to three years back - and keeps that view live instead of a snapshot you re-run each quarter.
Can 1Security act on a malicious message?
Yes, through the separately approved Mailbox Management module: delete to Deleted Items, move to Junk, mark read or unread. There is no permanent deletion, so nothing is destroyed by an automated action, and every action is logged.
What about shared mailboxes specifically?
Shared-mailbox sending is one of the five first-class methods, so you can list every message that left through a shared mailbox, who sent it, who received it and whether sensitive content travelled with it - the review most tenants have never done for the hundreds of shared mailboxes they run.
The 1Security platform
Mailbox Access Review is just the beginning
Mailbox Access Review is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Security scoreThe score, its history, the controls behind it and the benchmarks, so the number on the board report means something.
- ComplianceNIS2, DORA, GDPR, EU AI Act, SOC 2 and HIPAA as requirements with a live status, attestations, dated snapshots and evidence packs.
- ReportsSix report types in PDF, PowerPoint, HTML, CSV and JSON, under your brand with the client’s name, one report per client across the whole book.
- AlertingInstant and digest channels per client, routed to the right people, themed under your brand or theirs.
- Trends and the daily briefWhat moved this month, what needs a decision today, ranked, for the client meeting and for your own morning.
- LocationsWhere every sign-in and every action really comes from, on a map, per tenant. Breaches by location, impossible travel, allow lists per person. Works without premium sign-in logs.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
Make mailbox access a question with an answer.
Connect read-only and the sending-method classification starts the same day - the delegation review becomes a filter, and the filter becomes a standing watch.
Or keep auditing delegates one mailbox at a time.