contentACCESS documentation-version 6.0

This section describes how to configure contentACCESS to prevent delegates from accessing private emails.
By default, contentACCESS grants access to private emails if permission is granted to a mailbox. This permission equals to the Exchange permission “full mailbox access”. The user will see all emails in the delegated mailbox in all contentACCESS client applications.
In order to prevent access to private emails, a new user role needs to be created.

Before we get into the details of how to prevent access to private emails, let’s summarize the different role types who have or do not have permission to access private emails in all archived mailboxes.

1. System administrators and Tenant administrators have irrevocable permission to access private emails in all archived mailboxes:



2. Configuration administrators and Tenant configuration administrators (also the Junior ones) have no access to the mailbox contents, also no access to private emails:



3. The standard user role allows access to private emails:

As it was mentioned before, in order to prevent access to private emails, a new user role needs to be created. Navigate to System => Roles and clone the Standard user role. For more information about the “Roles” read this section of this manual.

You have to select a suitable name for this role, in this example, we are using “No private access”. Leave all permissions on default value and modify only the Access private emails permission:

Save the role and it is ready to use in the Email archive.

When the role is ready, you need to configure the Email archive provisioning to manage access to the mailboxes and private emails.

There are three role selections on the Provisioning settings page:

1. Role for the mailbox owners – add a role which will be assigned to the user(s)
2. Role for delegated mailboxes – decide whether the user will has access to the private emails or not
3. Role for shared mailboxes – share the mailbox(es) with other user(s)

The email archive provisioning is synchronizing Exchange permissions to the archive. If the user is the owner of the mailbox, the mailbox owner role is assigned to it – in our case the Standard user role.
If the user has access to other mailboxes, the delegated mailboxes role is assigned to it – in our case the No private access role. This role will be applied also to delegate mailboxes where the user has only access to certain folders.
If the target mailbox is a shared mailbox, a different role is used – Standard user. This is important because you might decide that private emails should be visible in shared mailboxes.
Please note that access to public folders is also granted using the role for shared mailboxes!

The resulting roles for the user will look like this:

If the user has access to a whole mailbox other than their own mailbox, the provisioning adds the role as described above.
If the user has access only to a certain folder of a mailbox, the provisioning is not adding any role as the user has only partial access. When the user logs in, contentACCESS evaluates also the partially accessible mailboxes and offers them for selection. contentACCESS displays only the accessible folders.

For more information about the provisioning settings, read this section of this manual.