Why is add-only automation risky for shared mailbox permissions?

Add-only scripts never remove stale managed delegation when users leave the mapped group, so Full Access and Send As entries accumulate over time.

Should automation remove every permission not present in one group?

No. Automation should remove only permissions inside its configured management scope and preserve unrelated manual or administrative entries.

Can Tenvero adopt existing mailbox delegations?

Yes. Tenvero includes an adoption workflow for existing direct delegations so teams can start from current state without rebuilding each mailbox first.

Shared Mailbox Offboarding: Remove Full Access and Send As When Users Leave an AD Group

Using an AD or Entra security group as the source of truth for shared mailbox access makes onboarding straightforward. Add the user to the group, reconcile permissions, and the user gets the required access.

The part that often gets missed is the reverse direction: what happens when the user leaves the group?

If your automation only adds missing permissions, stale access can remain in Exchange Online long after a role change. A production workflow needs two-way reconciliation.

The add-only script problem

Most basic scripts implement one condition:

User is in the group
AND
User does not have Exchange permission
-> Add permission

That helps onboarding, but not offboarding.

You also need:

User has a managed Exchange permission
AND
User is no longer in the group
-> Remove managed permission

Use the group as desired state

AD / Entra security group
        ↓
Expected users
        ↓
Compare with Exchange permissions
        ↓
Add missing managed permissions
        ↓
Remove stale managed permissions

The group represents who should have access. Exchange shows who currently has access. Reconciliation aligns the two.

Full Access and Send As removal examples

Full Access and Send As are separate permissions and require separate checks in any script-driven workflow.

Remove-MailboxPermission `
  -Identity "[email protected]" `
  -User "[email protected]" `
  -AccessRights FullAccess `
  -Confirm:$false

Remove-RecipientPermission `
  -Identity "[email protected]" `
  -Trustee "[email protected]" `
  -AccessRights SendAs `
  -Confirm:$false

Removal should apply only to permissions owned by the configured reconciliation scope. Do not remove unrelated manual or administrative entries.

Audit checks that matter

Disabled users with Full Access or Send As
Delegates that no longer exist
Group members missing expected permissions
Exchange delegates outside the managed group
Failed reconciliation runs

How Tenvero handles this

Tenvero keeps on-prem AD security groups as source of truth and reconciles to explicit Exchange permissions, including additions and managed removals. It also supports existing-access adoption so you can start from current delegation state instead of rebuilding first.

Review architecture scope: Tenvero Security. MSP context:For MSPs.