MELTr
Home Vendors Search Download
Login
Vendors / Microsoft Corporation / Office 365 / Mailbox Permission Delegation
Microsoft Corporation logo

Event type

Mailbox Permission Delegation

Add-MailboxPermission - Persistent Mailbox Access

Records Add-MailboxPermission operations that grant mailbox access rights (FullAccess, SendAs, SendOnBehalf) to other users, providing persistent access that survives password resets

JSON 25 fields Low Generator

exchange mailbox-permissions delegation persistence privilege-escalation
Preview Sample View Schema
CLI Install
meltr templates install microsoft

Overview

What this event covers

Captures Add-MailboxPermission operations that grant mailbox access rights to other users. FullAccess permissions are particularly concerning as they provide complete mailbox access, survive password resets, and can enable long-term persistence for attackers.

When generated

  • ›Administrator delegates mailbox access for legitimate business needs
  • ›Executive assistant granted access to executive mailbox
  • ›Attacker establishes persistence via mailbox delegation
  • ›Service account configured with mailbox access permissions
  • ›Shared mailbox permissions configured

Security relevance

High

Compliance

GDPR (Data Access Controls) HIPAA (PHI Access Authorization) SOX (Financial Data Access) PCI-DSS (Least Privilege) NIST 800-53 (AC-2, AC-6)

Frequency notes

Low frequency under normal operations. Suspicious patterns: FullAccess granted to contractor/external accounts, permissions granted to recently created accounts, automapping enabled (automatically adds mailbox to Outlook), and off-hours activity (2.5x night multiplier). FullAccess to executive/finance mailboxes requires elevated scrutiny.

Resources

Docs and tools

Office 365 Management Activity API Schema official Add-MailboxPermission PowerShell Reference official Mailbox Permissions in Exchange Online official MITRE ATT&CK - Account Manipulation (T1098) reference Get-MailboxPermission PowerShell Query and audit mailbox permission delegations Microsoft 365 Defender Native detection for suspicious mailbox permission changes Hawk PowerShell Module Hunt for suspicious mailbox delegations and permissions

Generation

Configuration

Base frequency
3 events/hour
Time patterns
business_hours night_hours
Business hours
2.0x
Night hours
2.5x
Weekend
2.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

CreationTime
DateTime Required

Timestamp when the mailbox permission was granted

Source: now() | iso8601

Format ISO 8601
Example 2024-12-15T11:42:18Z
Id
String Required

Unique identifier for this audit record

Source: random_guid()

Format GUID
Example d5e6f7a8-b9c0-1d2e-3f4a-5b6c7d8e9f0a
Operation
String Required

Exchange PowerShell cmdlet executed

Source: Static value 'Add-MailboxPermission'

Example Add-MailboxPermission
OrganizationId
String Required

Microsoft 365 tenant identifier

Source: Derived from organization domain

Format GUID
Example b4c5d6e7-8f9a-0b1c-2d3e-4f5a6b7c8d9e
RecordType
Integer Required

Office 365 audit log record type (1 = ExchangeAdmin)

Source: Static value 1

Example 1
ResultStatus
String Required

Outcome of the permission grant operation

Source: random_choice(['Success', 'Success', 'Success', 'Failed'])

Example Success
Values
  • Success Permission granted successfully
  • Failed Permission grant failed (insufficient permissions or validation error)
UserKey
String Required

Unique identifier for the administrator who granted the permission

Source: registry.get_random_user().email

Example it.admin@contoso.com
UserType
Integer Required

Type of user performing the action (should be admin)

Source: Static value 2 (Administrator)

Example 2
Values
  • 2 Administrator - required for Add-MailboxPermission
Workload
String Required

Office 365 service where the operation occurred

Source: Static value 'Exchange'

Example Exchange
UserId
String Required

User principal name of the administrator account

Source: registry.get_random_user().email

Format Email/UPN
Example it.admin@contoso.com
ClientIP
String Required

IP address and port from which the operation was performed

Source: random_choice([random_private_ip(), random_public_ip()])

Format IPv4:Port
Example 192.0.2.147:57392
ObjectId
String Required

Target mailbox for which permissions were granted

Source: registry.get_random_user().email

Format Email/UPN
Example executive@contoso.com
ExternalAccess
Boolean Required

Indicates if the operation was performed from outside the corporate network

Source: random_choice(['false', 'false', 'true']) - weighted toward internal

Example false
OrganizationName
String Required

Microsoft 365 tenant name

Source: Derived from organization domain

Format *.onmicrosoft.com
Example contoso.onmicrosoft.com
OriginatingServer
String Required

Exchange server that processed the operation

Source: Random Exchange Online server identifier

Example BN8PR01MB5678 (15.20.7654.32)
Parameters
Array Required

PowerShell parameters used in the Add-MailboxPermission operation

Source: Array of parameter objects

Parameters[].Name
String Required

Parameter name (Identity, User, AccessRights, InheritanceType, Automapping)

Example AccessRights
Parameters[].Value
String Required

Parameter value - AccessRights (FullAccess, SendAs, SendOnBehalf), User (delegated account), Automapping (auto-add to Outlook)

Source: Context-specific values

Example FullAccess
Values
  • FullAccess Complete mailbox access including all folders - highest risk
  • SendAs Send emails as the mailbox owner
  • SendOnBehalf Send emails on behalf of the mailbox owner
  • ReadPermission Read-only access to mailbox
SessionId
String Required

Session identifier for the administrative connection

Source: random_guid()

Format GUID
Example b2c3d4e5-f6a7-8b9c-0d1e-2f3a4b5c6d7e
ClientInfoString
String Optional

Information about the client application used

Source: Random client type (PowerShell, WebServices, EAC)

Example Client=PowerShell;Version=15.20;
Item
Object Required

Object containing details about the target mailbox

Source: Object with mailbox identity

ModifiedProperties
Array Required

Properties that were changed, showing permission grant details

Source: Array showing AccessRights and User additions

ModifiedProperties[].Name
String Required

Property name (AccessRights, User)

Example AccessRights
ModifiedProperties[].NewValue
String Required

New permission value granted

Source: Permission type granted

Example FullAccess
ModifiedProperties[].OldValue
String Required

Previous value (typically empty for new permissions)

Source: Empty string for new permissions