Microsoft 365 administration
Review Shared Mailbox Delegation Quarterly
How to inventory mailbox permissions, separate full access from send-as, test before removal, and leave an approval trail that survives staff turnover.
Start with repeatable IT work that has a clear owner, clear access limits, and a review cadence. Keep risky technical decisions with the manager or provider who owns the system.
Delegation playbook
On this pageJump to section
Shared mailbox permissions accumulate the way desk drawers do. Someone covers for a colleague for two weeks, the permission stays, and three years later a dozen people can read a finance inbox that now receives invoices.
A quarterly review is not a purge. It is a short, documented check that every permission still has a reason and an owner who will defend it.
Inventory the mailbox and its permissions
Export the mailbox list with the owner, purpose, and the team it serves. For each mailbox, export full access, send-as, and send on behalf permissions separately. The three mean different things and carry different risk.
Record how each permission was granted and when. If the admin center does not store a reason, note that the reason is unknown. Unknown permissions are the first ones to review.
Include rules, forwarding addresses, and connected apps in the export. A mailbox can look clean while a hidden rule forwards every invoice to an external address.
Separate the permission types
Full access lets a delegate read and manage the mailbox. Send-as lets them send as the mailbox without a visible delegate marker. Send on behalf shows both names. The business need should determine which one is granted, not habit.
Most coverage arrangements need full access for a defined period. Send-as is closer to an impersonation capability and should be rarer, time-bound, and approved by the mailbox owner.
Check group-based permissions as well. A user may inherit access from a security group that nobody remembers adding to the mailbox.
Ask the owner, then test
Send the owner a one-page list and ask them to mark each entry as keep, remove, or temporary with an end date. Give them a deadline and explain that unmarked entries will be removed at the next review.
Before removing anything, test with a pilot account. Confirm that the delegate can still open the mailbox through the client they actually use, and that removing send-as did not break a workflow such as a shared billing address.
Do not remove the last full-access delegate on a mailbox that has no owner. That creates a mailbox nobody can manage.
Document the approval and the change
Store the owner's response with the change ticket. Record who approved each removal, the effective time, and the rollback step.
If an owner does not respond, escalate to their manager. Do not remove access based on silence, and do not keep it indefinitely either. Park the entry with a named decision date.
Keep a short history per mailbox so the next reviewer can see why a permission exists, not just that it does.
Set the next review before closing
Calendar the next quarterly review at the close of the current one. Include the export, the owner questionnaire, and the pilot test in the estimated effort.
Track two numbers: permissions removed and permissions granted since the last review. A rising grant count suggests the intake process needs a time limit by default.
Report exceptions to the security lead, not the whole company. The point is accountability, not embarrassment.
Operating brief
What this guide should help you decide
Routine intake, status updates, records, screenshots, and documentation upkeep.
Approvals, risky system changes, security decisions, and final technical judgment.
How to use this guide
Use this page to decide what an IT virtual assistant should handle first. If the task is recurring, documented, and easy to review, it is usually a better first delegation candidate than work that requires live technical judgment.
Treat the article as an operating brief, not just a topic overview. The goal is to turn loose IT work into a named workflow with inputs, outputs, permissions, review cadence, and a handoff rule that protects the business while reducing manager load.
Workflow
Recommended operating workflow
Define the request
Write what review shared mailbox delegation quarterly means in your company, where requests enter, and what finished work looks like.
Limit the access
Give the assistant only the tool permissions needed for intake, records, status updates, or documentation.
Run a pilot
Use a two-week sample period so the manager can review accuracy before expanding the workflow.
Review patterns
Summarize repeat issues, blocked requests, and escalation volume so the technical owner can improve the process.
Decision rules
| Question | VA fit signal | Escalate when |
|---|---|---|
| Is the work repeatable? | The same request appears weekly and can be described in steps. | The request changes business policy or system design. |
| Can quality be reviewed? | The manager can inspect the output without redoing the work. | Only a senior technical person can judge correctness. |
| Is access contained? | The assistant can work with read-only or role-limited access. | Admin rights, customer data, or security settings are involved. |
Delegation checklist
- Write the intake source, expected output, and manager review cadence.
- Confirm the assistant has only the permissions needed for the workflow.
- List the events that require escalation before work continues.
- Track examples for two weeks before changing the workflow.
- Save examples of good and bad outputs so the assistant has concrete references.
- Review the workflow monthly and remove permissions that are no longer needed.
Example first-week agenda
Day one should cover the workflow owner, tools, allowed actions, forbidden actions, and escalation language. By the end of week one, the assistant should have produced a small sample of completed work, a list of unclear requests, and a manager-reviewed improvement note.
What to review before delegating
Confirm the owner, access level, review cadence, and escalation path before assigning any recurring IT workflow to a remote assistant.
What should an IT virtual assistant handle first?
Start with repeatable, reviewable work such as ticket summaries, account records, documentation updates, and checklist follow up.
Get free IT support review