This is just a quick one. Most Office 365 admins will hopefully have a separate admin account to perform higher level tasks, compared to their normal user account.
Because of this, the admin accounts shouldn’t need any licensing, because they’re not being used like a normal user. One person shouldn’t need to have two sets of licenses – but there are some problems that can come up because of this.
For example, if you want to use your admin account to access someone’s mailbox, that can be difficult when you don’t have a mailbox yourself to log onto, to then open another user’s mailbox. Outlook can be used to work around this, where you set up a profile for the email address of the user you want to access, but enter your admin credentials when prompted:
The above works OK, but is a little time consuming if you’re accessing a mailbox for a quick check.
If you try to go to Outlook Online, you’ll get a message saying your admin account doesn’t have a license or a mailbox. To get around this, you’ll need to use a URL like:
https://outlook.office.com/owa/[email protected]/?offline=disabled
or
https://outlook.office.com/mail/[email protected]/?offline=disabled
if you want the ‘new’ Outlook.
It will then jump straight to that user’s mailbox, assuming you have access rights to it, and have waited a few minutes for the rights to apply.
Using the URL method is really quick way of accessing another user’s mailbox without needing a license yourself.
Hi Adam,
This actually break Microsoft’s EULA : https://www.reddit.com/r/Office365/comments/7o2vsq/access_to_a_shared_mailbox_without_a_license/
And Also if the Admin account doesn’t have a mailbox then you can’t search for that account to grant full permissions
Hi Paris,
Thanks for sharing what you found. I’m not going to believe a single Redditor’s proofless claim :) But, admins would normally have a user account and an admin account – meaning they should have a user license applied to their normal login. If you can find this EULA somewhere I’d be keen to read it.
The second point is valid – without a mailbox, Exchange Admin Center won’t let you search for the account to grant permissions. I use this method to have a group that has access to all mailboxes, and add the account to that group: https://www.quadrotech-it.com/blog/grant-full-access-to-all-mailboxes-in-office-365/
You can grant access via PowerShell successfully to an account that doesn’t have a mailbox: https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-mailboxpermission?view=exchange-ps
So you are saying that you are adding users objects without a mailbox via add-mailboxpermission cmdlet? No go here…
User or group “[email protected]” wasn’t found. Please make sure you’ve typed it correctly.
Hi Greg,
I just tried again and it’s working for me on a functionalaccount that has no mailbox as the -user value. First thought it might be because the account used to have a mailbox, but also tried it on another account that’s never had one:
add-mailboxpermission -Identity “adam fowler” -user “[email protected] ” -AccessRights fullaccess
Can confirm that the add-mailboxpermission works on a non-licensed (no mailbox) admin account to a shared mailbox. Tested working for OWA connection aswell.
Thanks for that Adam
We use O365 so I can give access to our admin account from the admin portal (not from exchange admin portal) and access the required mailbox with the link https://outlook.office.com/mail/[email protected]/?offline=disabled
Hi Adam, I have been using this method perfectly over the last year or so… Until today, it seems a recent microsoft update may have blocked this? Let me know if you are having a similar issue, and whether or not there is a workaround.
Adam, any luck with this?
Has anyone been able to successfully use this method to access a mailbox with an unlicensed admin account since 2019 when the original article was posted?
I can’t assign the necessary delegate mailbox permissions to an unlicensed global admin account in Microsoft 365 via the Add-MailboxPermission cmdlet in PowerShell as it returns the following error:
“The operation
couldn’t be performed because object ‘account name’ couldn’t be found on
‘randomstring.PROD.OUTLOOK.COM”
Obviously, unlicensed accounts can’t be assigned delegate permissions via the EAC either as they won’t appear in the list of available users.
So it seems like this can’t be done anymore?
Still works for me. I think it’s always been the case that you can’t add delegate permissions via EAC if the user is unlicensed, but it still works for me via powershell.