[ Platform guides ]

Microsoft 365 shared and delegated mailboxes: verify the identity that is authenticated

Separate shared-mailbox delegation permissions from the domain identities that external receivers authenticate.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Keep shared-mailbox ownership clear
  • Test permission and authentication separately
  • Preserve individual accountability
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Separate shared-mailbox delegation permissions from the domain identities that external receivers authenticate.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Test permission and authentication separately

Each failure belongs to a different control layer.

Next steps

  1. Inspect grants before editing DNS.
  2. Capture Send As and Send on Behalf external headers.
  3. Retain separate delegation and authentication evidence.

CISO / SecOps

Preserve individual accountability

Domain authentication cannot replace a user audit trail.

Next steps

  1. Require scoped delegation instead of shared credentials.
  2. Verify removal of grants during offboarding.
  3. Audit group-based grants as well as individual grants.

Founder / Non-technical

Keep shared-mailbox ownership clear

Shared access should not erase accountability.

Next steps

  1. Assign a business owner for each shared identity.
  2. Review delegate access when teams change.
  3. Confirm shared-address continuity after staff changes.

[ FAQs ]

Frequently asked questions

Does Full Access permit Send As?

No. Microsoft documents sending permissions separately from Full Access.

Manage permissions for recipients in Exchange Online | Microsoft Learn

Does DKIM identify the employee who clicked Send?

No. DKIM authenticates a signing domain and covered message data, not the individual operator.

How to use DKIM for email in your custom domain - Microsoft Defender for Office 365 | Microsoft Learn RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Is the delegate’s login domain the DMARC reference?

No. Compare authenticated domains with the message’s visible From domain.

RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Do shared mailboxes need individual SPF records?

No. Evaluate the actual envelope domain and its domain-level SPF policy.

Why inspect Sender as well as From?

It helps explain delegation presentation, while the From domain remains central to DMARC alignment.

Manage permissions for recipients in Exchange Online | Microsoft Learn RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Should DNS change when Send As is denied?

Investigate permission and client behavior first; a submission denial is not proof of a DNS fault.

Manage permissions for recipients in Exchange Online | Microsoft Learn

Should offboarding remove the domain’s DKIM selectors?

Not merely for a delegate change. Those records may serve many remaining senders.

What should a hybrid test include?

Mailbox and delegate locations, supported permissions management, connector route and final external headers.

[ Sources ]

Sources

  1. Shared mailboxes in Exchange Online | Microsoft Learn

    Sections Provider procedure and operational considerations

  2. Manage permissions for recipients in Exchange Online | Microsoft Learn

    Sections Provider procedure and operational considerations

  3. How to use DKIM for email in your custom domain - Microsoft Defender for Office 365 | Microsoft Learn

    Sections Syntax for DKIM CNAME records · Enable DKIM signing · Verify DKIM signing · Troubleshooting

  4. RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

    Sections Identifier alignment · Policy and receiver handling

[ Glossary ]

Glossary

Send As
Permission to send with the shared mailbox presented as the sender.
Send on Behalf
Permission to send while exposing the delegate relationship.
From domain
The domain in the message’s RFC5322.From field used for DMARC alignment.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base