Shared mailbox administration, done right

What each Exchange permission allows, where it is stored, the common mistakes, and how to audit each one.

Permission, AutoMapping and Outlook behavior are three separate layers. Why rebuilding the profile doesn’t fix it.

What a departed user still has in Exchange delegation, how to find it, and how to keep it from coming back.

Why offboarding doesn’t clean up Exchange delegation, how an orphaned SID shows up in a Send As audit, and how to verify before removing it.

Microsoft’s own performance guidance for many AutoMapped mailboxes, why Full Access and AutoMapping are separate decisions, and the documented way to turn it off.

Why an AutoMapped mailbox lands under Shared with me instead of appearing automatically, why its Inbox doesn’t sync until you Convert it, and what’s still Coming soon.

A documented Microsoft issue in hybrid environments: Send As/Send on Behalf mail lands as a wrapper message in the Inbox instead of Sent Items. Scope, symptom and Microsoft’s workaround.

Why permission drift accumulates, the exact findings a delegation audit checks for, and why a one-time CSV export can’t catch it.

The full reconciliation architecture: desired state, additions, removals, ownership, existing-access adoption, logging and scheduled execution.

Mail-enabled vs. plain security groups vs. distribution groups, and which one a desired-state delegation model actually requires.

How to remove stale managed mailbox delegation safely when users leave a mapped on-prem AD group, with two-way reconciliation.

Why security-group delegation and Outlook AutoMapping conflict, the manual PowerShell reconciliation model, and how to detect permission drift.