daknetworks.com

Background

A mailbox is a typical account. You have John Doe. He has an account. His account is a mailbox account. The account is This e-mail address is being protected from spambots. You need JavaScript enabled to view it .

Options

John works with others doing proposals. What are the options?

1. pseudonym
2. group-account
3. separate account
4. shared mailbox
5. outside system

Option 1 - Pseudonym (What you start out doing)

1-We can setup a pseudonym/fake-account/vanity-account. No matter what you call it, the idea is the same. It is an email address that automatically goes a real account. For example: This e-mail address is being protected from spambots. You need JavaScript enabled to view it automatically goes to the inbox of John Doe. This is great if only one person is responsible. But as the team grows, this becomes cumbersome.

Option 2 - Group Account (What you graduate to)

2-We can setup a group-account. This is similar to above but the email goes to more than one person. For example: This e-mail address is being protected from spambots. You need JavaScript enabled to view it automatically goes to the INBOX of John Done and Jane Doe. This is great if it is a small team. The problem becomes, not everyone on the group know if a response was sent. Also folder organization is different for everyone on the group. You want everyone to have the same info, and see the same responses, then see further on.

Option 3 - Separate Account (What you shouldn't do)

3-We can setup a separate account. This is a typical account but instead of assigning it to one person, you give the username/password to a group of users. For example: This e-mail address is being protected from spambots. You need JavaScript enabled to view it has its own inbox and several users connect to it through way of username/password.

NOTE: While this seems like a good idea, years of experience says that this is a bad, bad, bad idea. Mainly because years on down the line, you can't find out who is responsible for the account. When you check the account it has a bunch of email in the inbox that no one has checked for years. I have witnessed this countless times in many clients. Kindly convince them to do it another way or just agree with them and set it up another way. The end result will be the same as below.

Option 4 - Shared Mailbox (What you'll be required to do)

4-We can setup a shared mailbox. A shared mailbox is very similar to a separate account. The difference is that rather than handing out a username/password and letting them connect to it, you assign the account to users and it automatically shows in their folder structure on OUTLOOK as a separate INBOX. This way when five years pass, you can tell who is using the account.

Here's how:

set-mailbox foo.user -Type Shared

Great! You are almost there. Now assign permissions of the people who need to use the shared-mailbox. The people will need both FULL-ACCESS and SEND-AS permissions to control the account and send messages. There is also a SEND-ON-BEHALF option available.

NOTE:
-the FULL-ACCESS permission is an EXCHANGE permission (add-mailboxpermission/set-mailboxpermission/get-mailboxpermission/remove-mailboxpermission).
-the SEND-ON-BEHALF permission is an EXCHANGE key property (set-mailbox foo.user -GrantSendOnBehalfTo/get-mailbox foo.user |select GrantSendOnBehalfTo).
-the SEND-AS permission is an AD permission (Add-ADPermission/get-adpermission foo.user -ExtendedRights Send-As -user user1).

Here's how to add the FULL-ACCESS and the SEND-AS permissions:

Add-MailboxPermission foo.user -User user1 -AccessRights FullAccess -InheritanceType All | Add-ADPermission -Identity "foo user" -User user1 -ExtendedRights "Send As"

You may have to fiddle around with the add-adpermission command as it want the AD name like this, "FirstName LastName" (not the DISPLAY-NAME or ALIAS).

ANOTHER NOTE:
-the command does not accept multiple values for the users. Your options are to create a group & run the command on the group (hint: do not do this), run the command separately for each user wanting access (hint: do this if there's a handful), run the command using a txt file (hint: do this if there's a bunch) or use the EAC/ECP.

You are doing great! That should just about do it.

Automapping Issues

But there's one more item to cover; AUTOMAPPING. AUTOMAPPING automatically shows the shared-mailbox to show in Outlook. This way, users do not have to manually add the account to their OUTLOOK... the shared-account automatically shows. This saves a bunch of hassle trying to get everyone to use a second account and it prevents dreaded OUTLOOK problems.

Adding the permissions above will automatically turn AUTOMAPPING on. There should be no further steps.

However, what happens if the shared-account doesn't show in OUTLOOK? What then?

Well, this seems to be an issue many run into for various reasons. So let's cover some of them.

First, there is a way to set the AUTOMAPPING off so that you can add the account manually:

Add-MailboxPermission foo.user -User user1 -AccessRights FullAccess -InheritanceType All -automapping $false

To check AUTOMAP, you have to use the Get-ADuser command (not an EXCHANGE command):

Get-ADUser foo.user -Properties msExchDelegateListLink | Select msExchDelegateListLink |fl

This command will show a list of accounts. If the account is in the list, then AUTOMAPPING is turned on for that account.

Second, AUTOMAPPING won't work for Organization-Managment-Administrators. This is because this group already has mailboxperissions set and it automatically includes a DENY (or DENY: True). DENY takes priority over ALLOW. There are ways to get around this but it is outside the scope of this article.

Third, AUTOMAPPING doesn't work if DNS is incorrect/not-working-the-way-that-makes-OUTLOOK-happy. For whatever reason, AUTOMAPPING works fine for locations where we have a flat domain structure (everyone is on the same domain). It doesn't work when we have separate domains (ie local computer domain is remotedomain.tld and email domain is emaildomain.tld). Again, troubleshooting this is outside the scope of this article.

Fourth, wait. For whatever reason sometimes it takes a few hours to show. Give it 24 hours before sounding the alarm.

Checking Your Work

So putting it all together.

See the FULL-ACCESS permissions:

get-mailboxpermission foo.user |select user,accessrights,deny,inheritancetype
get-mailboxpermission foo.user |where { ($_.IsInherited -eq $false) -and -not ($_.User -like “NT AUTHORITY\SELF”) } |select user,accessrights,deny,inheritancetype

See the SEND-AS permissions:

get-ADPermission "foo user" |ft user,extendedrights,accessrights
get-ADPermission "foo user" |where {($_.ExtendedRights -like “*Send-As*”) -and ($_.IsInherited -eq $false) -and -not ($_.User -like “NT AUTHORITY\SELF”)} |ft user,extendedrights,accessrights
get-ADPermission "foo user" |where {($_.IsInherited -eq $false) -and -not ($_.User -like “NT AUTHORITY\SELF”)} |ft user,extendedrights,accessrights

See the AUTOMAPPING value:

Get-ADUser foo.user -Properties msExchDelegateListLink | Select msExchDelegateListLink |fl

That's it! Go home. You're done for the day.

Outlook Web Access and Shared Mailboxes

Outlook Web Access (OWA) will not automatically map shared mailboxes the same way that the OUTLOOK app does.You will have to manually add the shared mailbox.

-login to https://login.microsoftonline.com
-right-click your name (on the left-hand side).
-click ADD-SHARED-FOLDER...
-type the name of the account you need access to.
-click on the name that shows.
-click ADD
-the account will show on the left-hand side.

Sent Items with Shared Mailboxes

Sent items automatically go in the SENT folder of the delegate (the person accessing the shared mailbox) and not the shared mailbox. Some people do not like this. So there is a registry edit you can do to put the sent message in the shared mailbox sent folder instead:

echo y | reg add "HKCU\Software\Microsoft\Office\[version]\Outlook\Preferences" /v DelegateSentItemsStyle /t REG_DWORD /d 00000001

NOTE: [version] is:
OUTLOOK-2010 = 14.0
OUTLOOK-2013 = 15.0
OUTLOOK-2016 = 16.0

NOTE-2: Here's a really good article:
http://windowsitpro.com/office-365/using-shared-mailboxes-office-365

Deleted Items with Shared Mailboxes

Same applies for the deleted items. Here's the registry edit you can use to put the deleted messages in the shared mailbox deleted folder:

echo y | reg add "HKCU\Software\Microsoft\Office\[version]\Outlook\Options\General" /v DelegateWastebasketStyle /t REG_DWORD /d 00000004

Option 5 - Outside System (What you should do. Hint: pick this one!)

5-The other option is to use an outside system. A customer relationship management tool or CRM. Something like Salesforce, HighRise, Zendesk-Inbox, etc (I'm sure there are others). The reason you do this is because the goal of this situation is to work together and consolidate items down to one spot. Teams try to solve this through email because that is what they are used to using as individuals. But teams need to work together.

Email is communication. Email is not issue-tracking, customer-tracking, proposal-tracking. Teams "feel" like there's a lot going on but when you look a the actual issues/customers/proposals on hand, there may not be that many. There's a lot of motion but very little movement down field.

These systems track the issues/proposals and consolidate all communication down to those issues. Suddenly, 100 emails boil down to 7 issues with a status (such as PENDING or 80%) and an assignment so you can see who (individual or team) is assigned to the issue/proposal.

Initially, you can assign issues/leads/proposals and track them, keeping the communication/email with the lead.

Eventually, you can capture metrics such as win/loss and view a pipeline of what may be coming in the near future.

Here are some tools to consider:

• Salesforce (dominates this area)
• SugarCRM
• TigerCRM
• MS Dynamics
• Sage
• everything listed here: https://en.wikipedia.org/wiki/Comparison_of_CRM_systems
• HighRise
• a FMP solution

Sometimes if you don't need a CRM just a simple solution, Zendesk-Inbox might be a good fit. As of this writing it is in beta.