"Can I have access to the sales mailbox?" and "Can you let me see Maria's calendar?" are daily tickets. They are quick to do and easy to do badly: access granted without approval, Send As given when Send on Behalf was meant, and a mailbox that never appears in the user's Outlook.
Here is the process we use for Exchange Online: confirm approval, grant exactly the permission asked for, know the calendar roles, and understand the automapping delay so you do not chase a problem that fixes itself.
Get approval before you grant anything
A shared mailbox is somebody's data. Before granting access, get a yes from the mailbox owner or the manager responsible for it, in writing, in the ticket. For calendars, the calendar belongs to the person, and their word is enough. For anything involving HR, finance or an executive, be strict. Nobody complains about being asked; people complain about finding out later that access was handed out on request.
Record what was granted and why. When the person changes role or leaves, that record is how you know what to remove.
Shared mailbox permissions
There are three separate permissions and they mean different things. Full Access lets the user open the mailbox and read everything, and it makes the mailbox appear automatically in Outlook through automapping. Send As lets the user send mail that appears to come from the shared address. Send on Behalf sends with the user's name and the shared address both shown. Ask which the requester needs; most want Full Access plus Send As.
In the Exchange admin center go to Recipients > Mailboxes, open the shared mailbox, and use the Delegation section. With PowerShell it is two commands. Automapping is on by default with Full Access; set it to false for users who have a dozen shared mailboxes, because every automapped mailbox is a full extra cache in Outlook.
Add-MailboxPermission -Identity sales@contoso.com -User jsmith@contoso.com -AccessRights FullAccess -AutoMapping $true
Add-RecipientPermission -Identity sales@contoso.com -Trustee jsmith@contoso.com -AccessRights SendAs -Confirm:$falseCalendar permissions and room mailboxes
Calendar sharing is folder-level permission with named roles. Reviewer reads everything, Editor can create and change items, and Author can create and edit their own. Availability Only and Limited Details are what most colleagues need and what the default for internal users should be. The user can grant these themselves from Outlook (right-click Calendar > Sharing Permissions), which is the better path because it keeps the decision with the owner. When the helpdesk does it, use Add-MailboxFolderPermission against the user's Calendar folder.
Room and equipment mailboxes are a separate case with their own settings. Set-CalendarProcessing controls whether the room accepts bookings automatically, how far ahead it can be booked, the maximum meeting length, and who is allowed to book it. A room that stops accepting meetings usually had its booking window or delegate list changed, or someone turned AutomateProcessing off.
Add-MailboxFolderPermission -Identity maria@contoso.com:\Calendar -User jsmith@contoso.com -AccessRights Editor
Set-CalendarProcessing -Identity boardroom@contoso.com -AutomateProcessing AutoAccept -BookingWindowInDays 180 -MaximumDurationInMinutes 480 -AllowConflicts $falseWhy it does not show up
The most common follow-up is "you gave me access but I cannot see it." Automapping can take up to an hour to reach Outlook, and Outlook needs a restart after that. Tell the user this when you close the ticket and most of those follow-ups disappear. If it still does not appear, the user can add it manually: File > Account Settings > Account Settings > Change > More Settings > Advanced > Open these additional mailboxes.
On mobile, shared mailboxes need to be added as a separate account in Outlook mobile, and the user needs Full Access. If Send As appears to fail, check whether the user is expecting the sent message to appear in the shared mailbox's Sent Items; by default it lands in the sender's own Sent Items unless MessageCopyForSentAsEnabled is set on the shared mailbox. And note that a shared mailbox under the size limit does not need a licence, but it cannot be signed into directly; people who want to log in as the mailbox need a different design.
Set-Mailbox -Identity sales@contoso.com -MessageCopyForSentAsEnabled $true -MessageCopyForSendOnBehalfEnabled $trueOffboarding: remove what you granted
Access accumulates. A person who moved from sales to finance two years ago often still has the sales mailbox. Make removal part of the role-change and leaver checklists, and use the ticket history to know what to remove. Get-MailboxPermission on the shared mailbox lists everyone with Full Access, and it is worth reviewing the busiest mailboxes twice a year.
When a person leaves, convert their mailbox to a shared mailbox if the team needs their mail, grant the manager Full Access, and remove the licence. That is a cleaner result than handing out the leaver's password, which should never happen. If you want the whole process written down and run consistently, that is part of what a managed helpdesk like RackLedge provides.
Frequently asked questions
What is the difference between Send As and Send on Behalf?
Send As makes the message look like it came from the shared address with no trace of the sender. Send on Behalf shows both names in the From line. Use Send on Behalf for assistants and Send As for team mailboxes.
Can a user see a shared mailbox without automapping?
Yes. Add it manually through Account Settings, or open it as a separate mailbox from File > Open & Export > Other User's Folder. This is useful for users who have many shared mailboxes and want to keep Outlook fast.
Do shared mailboxes need a licence?
Not while they are under the shared mailbox size limit and nobody signs into them directly. Archive, litigation hold and larger storage need a licence assigned.
Takeaway
Approval first, then the exact permission that was asked for: Full Access, Send As or Send on Behalf for mailboxes, and named roles for calendars. Tell the user about the automapping delay when you close the ticket, keep a record of what you granted, and remove it when roles change. That turns a sloppy daily ticket into a clean, auditable one.