Permissions to allow a self-service user to set out-of-office replies on mailboxes they have direct full control over

Question

Good Afternoon,

I'm looking for some clarification on what security settings I would need to apply to the Self-Service Users to allow them to update both their own out of office, and that of any secondary email account they have full access to in exchange.

For example: User1 has access to update the exchange properties of their own mailbox via self-service User1 also has a disabled account called "User1secondary" which they have full control of that mailbox so that they can send and receive emails to an alternate email address.

I want to know if there is a way in Adaxes to set security so a user can change the out of office replies for this secondary account but only the accounts they have full access to.

Please let me know if this requires more clarification.

Comments

Hello,

For us to suggest a solution, please, specify how the primary and secondary accounts are related to each other. In your example, you mentioned accounts names User1 and User1secondary. What property is this related to? Is it the name property?

Any additional details will be much appreciated.

---

Thank you for the follow up.

So let me clarify further

• There are 2 user accounts. One that is an enabled user and acts as the users primary account. let's call it "jtop"
• The 2nd user account is configured as a shared mailbox, the user account is disabled and in exchange the jtop user is given full access permissions to the mailbox allowing the primary user to send and receive.

Previously user would be able to set Out Of Office replies via OWA, but we've disabled it due to security concerns with the platform.

We currently have a means for Managers to set the out of office for all their direct reports, but we would like an option for the user to set their own. Preferably using the Self-Service portal providing permission to the user as long as they have full-access permission to the mailbox. If that's not possible, maybe we could use last name as a field to connect the two or similar display names.

I'm not sure if this helps clear up the request, but please let me know if you need further specifics.

---

Hello,

Is there any way to get further assistance with this request?

---

Hello,

Sorry for the delayed reply. Unfortunately this does not clear how the accounts are related to each other. In your example, the primary account is jtop and it has full access permissions to the mailbox of the secondary account. Is this the only relationship between the two accounts? If it is, would it be possible to set some AD property of the secondary account to the sAMAccountName of the primary one to relate the accounts?

---

To answer your question, yes the only substantial connection between the two accounts is that the primary has full access permissions on the secondary accounts mailbox (mainly the only reason the secondary accounts exist)

That being said I do see what you're saying about an AD property to link the user accounts together, I was just hoping there was a way for Adaxes to see the full control option and allow the user to manage the out of office that way.

---

Unfortunately, there is no way to conveniently grant the permissions to an account over another account if the only relationship they have is "the first account has full access to the mailbox of the second account". You need to establish a more concrete relationship between such accounts, for example "a specific property of the second account contains the Logon name of the first account".