Prevent delegated users from reading private emails

Peter 100

We have several mailboxes, where assistants have fullaccess permission to the mailboxes.
The owners would like to prevent the delegated users, from reading private emails.
How can this be achieved?

Regards
Peter

1 answer

Vasil Michev 105.1K Reputation points MVP

2024-09-24T16:29:08.4433333+00:00

Protect the items with a sensitivity label, and make sure that the delegates have not been granted access to the label and to IRM protected messages in the user's mailbox. The latter is done via the set of *-MailboxIRMAccess cmdlets, if you need additional details check this article: https://office365itpros.com/2022/06/09/delegate-access-encrypted-email/

Do not rely on the "private" flag, as certain clients can actually access such items (see https://ingogegenwarth.wordpress.com/2022/02/15/outlook-and-private-items/).
Please sign in to rate this answer.
Alex Zhang-MSFT 785 Reputation points Microsoft Vendor

2024-09-25T07:22:08.4633333+00:00

Hello, @Peter,

Welcome to the Microsoft Q&A platform!

Based on your description, I understand that some owners of mailboxes in your organization want to prevent delegate users from reading private emails and you wonder how to achieve this.

Vasil Michev have provided an efficient and safe method, I am just going to make some additions and provide some official documentation for your reference.

You can create sensitivity labels as shown in the diagram below in Microsoft Purview. For information on how administrators can configure encryption., please refer to Apply encryption using sensitivity labels | Microsoft Learn. About how senders can apply sensitivity labels, please click on Apply encryption using sensitivity labels | Microsoft Learn for reference.

For information about running the Set-MailboxIRMAccess cmdlet in Exchange Online PowerShell to ensure that access to labeled and IRM-protected messages in a user's mailbox is not granted to an agent, please see Consistently block delegates or shared mailbox members from accessing protected messages in Outlook - Microsoft Community Hub. You can directly copy the command below for your convenience.

1.Check who is blocked from accessing mailbox owner’s encrypted messages:

Get-MailboxIRMAccess -Identity <MailboxIdParameter> -User <SecurityPrincipalIdParameter>

2.Block a user from reading encrypted messages in a shared or delegated mailbox:

Set-MailboxIRMAccess -Identity <MalboxIdParameter> -User <SecurityPrincipalIdParameter> -AccessLevel <Block>

3.Remove a user from the block list and allowing them to read encrypted mail:

Remove-MailboxIRMAccess -Identity <MalboxIdParameter> -User <SecurityPrincipalIdParameter>

(Note: After any of the above mailbox settings are changed, the Outlook client must be restarted.)

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thank you for your support and understanding.

Best Wishes,

Alex Zhang

Alex Zhang-MSFT 785 Reputation points Microsoft Vendor

2024-09-27T09:32:51.5533333+00:00

Hello, @Peter,

Is there any update on this thread? If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well. Thanks for your understanding.

Best Wishes,

Alex Zhang
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Prevent delegated users from reading private emails

1 answer

Your answer