How do shared mailboxes and permissions move in a migration?

Key facts

• Shared mailboxes in Exchange Online generally do not need a license unless you need extra storage, an archive or a hold.
• In hybrid, Microsoft recommends moving delegates and the mailboxes they access together because some cross-premises permissions are limited.
• Permissions from Google Workspace, IMAP and other platforms do not map automatically to Exchange Online.
• Full Access granted directly to users auto-maps in Outlook; access granted through a group does not.
• A permissions export before migration is the single most useful document for cutover day.

Start with a permissions inventory

Before any migration, export who has access to what. For Exchange Server or Exchange Online sources, PowerShell can list Full Access, Send As and Send on Behalf permissions on every mailbox, and folder permissions on calendars and other key folders. For Google Workspace, list delegated mailboxes, shared calendars and groups used as shared inboxes.

This export drives batch design, becomes the script for reapplying permissions, and is how you answer the inevitable question on day one: who used to have access to the accounts inbox?

• Full Access: open the mailbox and read mail.
• Send As: send mail that appears to come from the mailbox.
• Send on Behalf: send mail shown as on behalf of the mailbox.
• Folder permissions: calendar delegates, specific folders shared to others.
• Groups used for access, and any nested groups.

Exchange hybrid migrations

In a hybrid migration, shared mailboxes move with the same remote move requests as user mailboxes. Mailbox permissions are stored with the mailbox and generally come across. Cross-premises access, where a user is in Exchange Online and the shared mailbox is still on-premises or the reverse, is supported for some permissions but not all, and depends on directory synchronization settings and Exchange versions.

The safest approach is the one Microsoft recommends: put users, their delegates and the shared mailboxes they work in together in the same migration batch. Test Send As and calendar delegation with pilot users, because those are the permissions most likely to need attention.

Cutover, Google, IMAP and tenant-to-tenant

In these migrations the target is a new directory, so permissions need to be rebuilt. Create the shared mailboxes in Exchange Online first, then use the inventory to apply Add-MailboxPermission for Full Access, Add-RecipientPermission for Send As, Set-Mailbox with GrantSendOnBehalfTo for Send on Behalf, and Add-MailboxFolderPermission for calendars and folders.

Google Workspace delegation and collaborative inbox groups do not map one to one. Decide whether each becomes a shared mailbox, a Microsoft 365 group or a distribution list. In tenant-to-tenant moves, some third-party tools can migrate permissions; native cross-tenant mailbox migration moves the mailbox content, so plan to reapply permissions unless your tool covers them.

Licensing and design decisions

Shared mailboxes generally do not need a license in Exchange Online up to the standard size limit. A license is needed if the mailbox needs more storage, an online archive or litigation hold, and nobody should sign in to a shared mailbox directly. Block sign-in on the shared mailbox account.

Decide whether to grant access to individuals or through a mail-enabled security group. Groups are easier to manage, but Outlook auto-mapping only works for direct grants. Many organizations grant directly for small teams and use groups with manual Outlook setup for large ones.

Cutover day checks

Test each important shared mailbox: it appears in Outlook for its users, they can send as or on behalf of it, sent items save where expected, and calendar delegates can manage meetings. Microsoft provides a setting to save sent items in the shared mailbox's own Sent Items for Send As and Send on Behalf; set it if teams expect that behavior.

Have the permissions script ready to rerun for any gap. Most day-one access tickets after a migration are about shared mailboxes.

How Accred Consulting approaches it

Accred Consulting treats shared mailboxes and permissions as a tracked workstream in every email migration. Discovery exports mailbox, folder and delegate permissions and maps them to the target design, and the proposal sets scope, fixed price and timeline. The US-based specialists assigned to your engagement group delegates and shared mailboxes into batches, rebuild permissions with PowerShell where needed, configure sent item behavior and test with pilot users before each wave. Handover includes the permissions documentation and knowledge transfer, with optional support retainers.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions