Exchange Online delegation lets one user act on another user's mailbox. This includes granting Full Access, Send As, and Send on Behalf permissions — among the most common requests MSPs handle.
These operations are not available through the standard Microsoft Graph API. Junto uses a separate Exchange Admin API to manage delegation, which requires additional setup in the customer's Azure AD tenant.
Prerequisites
Microsoft 365 tenant already connected via the company integrations page
Global Administrator or Privileged Role Administrator access in the customer's Azure AD tenant
Step 1: Grant Exchange Admin Permission
Go to the company's Integrations page in Junto.
Find the Microsoft 365 integration card.
If Exchange Admin shows a red "Not configured" badge, click the Authorize button.
A new tab opens to Microsoft's admin consent page.
Sign in as a Global Administrator of the customer's tenant.
Review and accept the permissions (includes
Exchange.ManageAsApp).Switch back to the Junto tab — it will automatically re-check and the badge should turn green.
Step 2: Assign Exchange Administrator Role
The admin consent grants the API permission, but the app also needs the Exchange Administrator role assigned in the customer's tenant.
Go to Azure AD Portal and sign in as the customer's tenant admin.
Navigate to Identity > Roles & admins > Roles & admins.
Search for and select Exchange Administrator.
Click Add assignments.
Search for the Junto app name (it appears as an Enterprise Application / Service Principal).
Select it and click Add.
Verification
After completing both steps:
Go back to the company's Integrations page in Junto.
Click Re-check next to the Exchange Admin badge.
The badge should show green "Exchange Admin".
What the AI Agent Can Do
Tool | Description | Risk Level | Approval |
View Mailbox Permissions | See who has Full Access to a mailbox | Low | None |
View Send As Permissions | See who can Send As another user | Low | None |
View Mailbox Details | See mailbox settings and Send on Behalf delegates | Low | None |
Grant Full Access | Give a user Full Access to another mailbox | High | Always |
Grant Send As | Allow a user to send email as another user | High | Always |
Grant Send on Behalf | Allow a user to send on behalf of another user | High | Always |
All write operations require explicit approval before execution.
Why a Separate Setup?
Microsoft Graph covers most M365 management (users, groups, mail, calendar, SharePoint, Teams, devices, security), but it does not provide endpoints for managing mailbox delegation. These operations are only available through the Exchange Admin API, which requires its own permission (Exchange.ManageAsApp) and the Exchange Administrator directory role.
Junto detects whether this is configured per tenant and shows a clear badge on the integrations page. No additional setup is required from the MSP beyond the two steps above — the tenant's admin handles both.
Troubleshooting
Badge stays red after authorizing — Ensure you signed in as a Global Administrator of the customer's tenant (not your own). The Exchange Administrator role may not be assigned yet (Step 2). Wait 1-2 minutes for permission propagation, then click Re-check.
Delegation tools return errors — The Exchange Administrator role is missing (Step 2), or the admin consent was granted in the wrong tenant.
"Tenant ID not found" error — Disconnect and reconnect the Microsoft 365 integration, then try again.