Send As vs Send on Behalf vs Full Access: Outlook Permissions Explained

Send As vs Send on Behalf: the short answer#

Send As sends mail that looks exactly like the mailbox sent it, so the recipient sees [email protected] and nothing else. Send on Behalf shows the delegate too: “Priya Shah on behalf of Sales Team”. Full Access (Read and manage) opens and manages the mailbox but cannot send. Pick Send As when the recipient should not know who typed it; pick Send on Behalf when they should.

None of the three includes another. Exchange stores each as a separate permission, so a shared mailbox where people both read and reply usually needs Full Access plus one sending permission. If a person ends up with both Send As and Send on Behalf, Microsoft says Send As always wins.

What does Send on Behalf mean in Outlook?#

Send on Behalf lets a delegate send from another mailbox while the From line discloses them: “Delegate on behalf of Mailbox”. Replies still go to the mailbox, not to the delegate, and the permission does not let the delegate read anything in that mailbox.

It is the classic assistant setup: an EA sending for an executive, or a colleague covering a manager’s inbox. For a personal mailbox, the owner can grant it themselves; here is how to set up delegate access in Outlook.

Send As vs Send on Behalf vs Full Access at a glance#

This is the full comparison, led by the question most people search for: what the other person actually sees. The last column is where an admin grants it in Microsoft 365 today.

The same reply, sent three ways#

A support agent replies to the same customer ticket. The From line the customer gets depends only on which permission the agent holds, not on anything they typed.

Send As or Send on Behalf? Which one to use#

Decide by what the recipient should know, not by the sender’s job title. The table below shows each option’s best use, what the recipient sees and the risk you take on.

Shared mailbox Full Access: does Read and manage include Send As?#

No. Read and manage is just what the Microsoft 365 admin center calls Full Access. Microsoft’s documentation says plainly that Full Access doesn’t grant Send As or Send on Behalf, so a person can see the shared mailbox in Outlook and still be unable to send from it.

When Full Access is granted to an individual, automapping usually adds the shared mailbox to their Outlook after a restart. It doesn’t automap when access comes through a security group. If you ever need to convert a user mailbox to a shared mailbox, re-check these grants afterwards.

Full Access covers the whole mailbox. If someone needs only one folder, give them folder-level permissions instead; Outlook folder permission levels covers what each level allows.

Where each permission is granted#

Full Access and Send As are in the Exchange admin center under Recipients > Mailboxes: select the mailbox, then Mailbox delegation. In the Microsoft 365 admin center, a user’s Mail tab (Users > Active users) shows Read and manage, Send as and Send on behalf permissions.

Send on Behalf for a shared mailbox is where this post used to be wrong. The older on-premises EAC can’t set it, and Microsoft’s Exchange Online pages don’t agree on whether its EAC can. Microsoft’s troubleshooting note says Microsoft 365 customers can assign it in the Microsoft 365 admin center (Teams & groups > Shared mailboxes, then the mailbox’s permissions), and labels can differ in your tenant.

The route that always works is PowerShell: Set-Mailbox -Identity [email protected] -GrantSendOnBehalfTo @{Add="[email protected]"}. The Add syntax keeps existing delegates; a plain value replaces them. For the sending side once permissions exist, see how to send email from a shared mailbox in Outlook.

How do I see who has Send on Behalf, Send As or Full Access?#

Run these three commands in Exchange Online PowerShell to audit a mailbox. Between them they cover all three permissions on one mailbox.

• Send on Behalf: Get-Mailbox -Identity [email protected] | Format-List GrantSendOnBehalfTo
• Send As: Get-RecipientPermission -Identity [email protected], then look for SendAs in AccessRights
• Full Access: Get-MailboxPermission -Identity [email protected] | where {$_.AccessRights -like "Full*"}

Without PowerShell, open the mailbox in the Exchange admin center and check Mailbox delegation, or check the user’s Mail tab in the Microsoft 365 admin center. A delegate can also test it: send one message from the shared address to yourself and read the From line on the copy you receive.

Microsoft says a permission change can take up to 60 minutes to take effect. If a fresh grant doesn’t work, restart Outlook or test in Outlook on the web before assuming it failed.

Auditing Send As and Send on Behalf#

Mailbox audit logging is on by default in Exchange Online, including for shared mailboxes. By default it records SendAs and SendOnBehalf actions by delegates, which is how you answer “who sent this?” when the header can’t.

To confirm a mailbox still uses Microsoft’s default audit set, run Get-Mailbox -Identity [email protected] | Format-List DefaultAuditSet. Then search the records in Microsoft Purview Audit or with Search-UnifiedAuditLog. Granting the permission needs no extra logging setup: Add-RecipientPermission -Identity [email protected] -Trustee [email protected] -AccessRights SendAs -Confirm:$false.

Common problems after granting a permission#

• 550 5.7.13 or “you don’t have permission to send as”: the grant hasn’t propagated yet, or it’s missing. Work through SMTP 550 5.7.13 Send As permission denied.
• Sent mail lands in your own Sent Items: by default, Exchange Online saves Send As and Send on Behalf messages in the sender’s Sent Items. An admin can change that with MessageCopyForSentAsEnabled and MessageCopyForSendOnBehalfEnabled; see shared mailbox Sent Items not saving.
• The mailbox can’t be selected in From at all: Microsoft notes that Send As and Send on Behalf don’t work in Outlook desktop when the mailbox is hidden from the address list.
• Licence and size: a shared mailbox usually needs no licence, but Microsoft requires Exchange Online Plan 2 once it holds more than 50 GB or uses archiving or litigation hold. Details in does a shared mailbox need a license.

Where a mail client fits, honestly#

These are Exchange permissions. Every client, ours included, inherits whatever an admin granted; no client can grant itself Send As, and AI Emaily doesn’t change Exchange permissions.

What a client can add is a check before sending. Send As already hides the person behind the reply, so a wrong-voice draft goes out under the team’s name. In AI Emaily’s Copilot mode, the AI drafts and nothing sends until a person approves it. Autopilot handles routine replies within rules you set, with undo and an audit log. That sits alongside Exchange’s audit log, not in place of it.