Campus AD - Departmental Support Staff using Active Roles 8.x: Security Groups Used for A Shared Mailbox with a Shared Calendar

Mailbox-Related (Create 2 groups)

• OUName.SG.MailboxName.FullAccess type: mail enabled, universal security group: hide these from the directory when creating
• OUName.SG.MailboxName.SendAs (most common) type: mail enabled, universal security group: hide these from the directory when creating
• Less Common - INSTEAD of a "SendAs" group you could configure a "SendOnBehalf" group – don't configure with both because if someone is added to both groups it won't work
  • OUName.SG.MailboxName.SendOnBehalf (less common) type: mail enabled, universal security group: hide these from the directory when creating

Calendar-Related (create and use ones as needed)

Typical: (usually 1 or more editors, and a group(s) for what other groups would want to see in the calendar)

• OUName.SG.MailboxName.Calendar.Editor (Create, read, modify, and delete all items and files.) type: mail enabled, universal security group
• OUName.SG.MailboxName.Calendar.Reviewer (Shows Calendar Full Details: Read items and files only) type: mail enabled, universal security group
  Note 1: mail enabled universal security groups are required for any calendar permissions to work correctly in the Office 365 environment.
  Note 2: you will normally "hide" your security groups from the directory but you will need to "un-hide" them while you configure your calendar sharing for the shared mailbox and then re-hide them after the configuration is completed.

Less Common

• OUName.SG.MailboxName.Calendar.FreeBusy type: mail enabled, universal security group (normally the default for the calendar is set to this for anyone on CampusAD)
• OUName.SG.MailboxName.Calendar.FreeBusySubjectTimeLocation type: mail enabled, universal security group

Rarely Used

• OUName.SG.MailboxName.Calendar.PublishingEditor (Create and read items and files, create sub folders, and modify and delete items and files that you create. Note: Does not apply to delegates.) type: mail enabled, universal security group

Not Recommended

• OUName.SG.MailboxName.Calendar.Owner (Create, read, modify, and delete all items and files, and create subfolders. As the folder owner, you can change the permission levels that other people have for the folder. (Does not apply to delegates) type: mail enabled, universal security group
  This would normally not be used used because of permission change ability.

At MSU we are using security groups for permissions as listed above so if configured correctly, adding/removing people from the security groups handles permission changes.

Related Articles

• CampusAD - OU Admins - Naming Conventions and Configurations for Active Directory Objects