Shared mailbox inventory
Lists the mailboxes with Get-EXOMailbox -RecipientTypeDetails SharedMailbox, measures size with Get-EXOMailboxStatistics and separates full access, send as and send on behalf of. Read-only.
Octo for Outlook and Exchange Online
Octo prepares the draft. The one who hits send is you.
Mailboxes, rules, shared mailboxes, rooms and calendars in Exchange Online each have a call in Microsoft Graph and a cmdlet in PowerShell. Octo inventories who has access to each mailbox, finds rules that forward email outside, checks availability before scheduling batch meetings and restricts the app to a few mailboxes, with no permission to send. Consenting to permissions, sending email and deciding about personal data stay with people.
Graph, per app and mailbox10,000requests in 10 minutes, 4 at the same time
Sending in Exchange Online30messages per minute; 10,000 recipients per day
Unlicensed shared mailbox50 GBup to 25 users; account sign-in blocked
Sources24listed at the end of the page
01
What Octo does with Outlook and Exchange Online.
Six possible deliverables, drawn from the research. All of them read the minimum (rules, permissions, free/busy, not the content of messages), all of them log what they did, and none of them sends email.
Forwarding outside
Reads the Inbox rules through Graph and flags forwardTo, forwardAsAttachmentTo and redirectTo to an external domain, with the address masked in the report.
Checked batch meetings
A spreadsheet of classes becomes a getSchedule query for attendees and room; conflicts come back before any invite exists. Creation is a separate step, with a logged approval.
App only on the right mailboxes
RBAC for Applications scoped by attribute: the app reads and creates drafts in the customer service mailbox and is denied on the executive one. No Mail.Send, and with the broad permission removed from Entra ID.
Announcement as drafts
Graph JSON batches create one draft per recipient in the team mailbox, with the category "Awaiting review". The team reviews and sends within the sending limits.
Deliverable: drafts ready, none sentLegacy path inventory
Scripts and devices that use EWS, SMTP with username and password, Outlook REST v2.0 or a COM macro in classic Outlook, with the Graph equivalent for each one.
Deliverable: migration list, with the deadline decided by IT
02
Eight arms, no send button.
The same Octo cycle, applied to mail and calendar. Each arm has a narrow role; the ones who consent to permissions, send email and answer for personal data are people.
-
Discovery
Surveys what already exists
Mailboxes, types, sizes, rooms, registered apps and what still uses EWS, SMTP with a password or a classic Outlook macro.
-
Data
Maps what each mailbox holds
Who uses each shared mailbox, what kind of data goes through it and where there is personal or confidential data.
-
Security
Looks after access
Minimum permission, RBAC for Applications, a certificate instead of a password and a report with masked addresses (LGPD).
-
Architecture
Chooses the path
Graph or PowerShell, delegated or application permission, single call or batch, within the per-mailbox limits.
-
Development
Writes the script
Simulation by default, a log of each step,
Retry-Afterrespected and the source of each syntax noted in the file. -
Review
Checks by content
Authorization test inside and outside the scope, draft opened in the mailbox, event checked in the calendar. "It returned 202" is not a check.
-
Release
Delivers for approval
Prepares the change and the simulation. Applying it to the tenant is the administrator's decision; sending is the decision of the mailbox owner.
-
Documentation
Keeps a record
Inventory, decisions, who approved each access change, each batch of invites and each announcement.
Octo does not send email, does not create invites without approval, does not consent to permissions, does not remove access on its own and does not decide what to do with personal data.
03
Every task, its own path.
The criteria Octo uses to choose, with the minimum permission that Microsoft's reference indicates.
| Task | Path | Notes |
|---|---|---|
| List shared mailboxes | Get-EXOMailbox -RecipientTypeDetails SharedMailbox | -ResultSize default 1,000; Unlimited for all |
| Size of each mailbox | Get-EXOMailboxStatistics | Only in the Exchange Online module |
| Find forwarding outside | Graph, mailFolders/inbox/messageRules | Rules apply only to the Inbox |
| Check availability | getSchedule | Calendars.ReadBasic, also as application |
| Suggest a time | findMeetingTimes | Delegated permission only |
| Create a meeting | POST /users/{id}/events | The invite goes out on creation, with no option to turn it off |
| Prepare an announcement | Draft, POST .../messages, in a JSON batch | Up to 20 per batch; sending is done by a person |
| Restrict an app to mailboxes | RBAC for Applications | Adds to Entra ID; 30 min to 2 h to take effect |
| Share a calendar with the minimum | Add-MailboxFolderPermission -AccessRights AvailabilityOnly | Free/busy only |
| Room rules | Set-CalendarProcessing | AutoAccept; default window of 180 days |
| Trace a message | Get-MessageTraceV2 | 90 days, 10 per query, no pagination |
| Script with no person | Connect-ExchangeOnline with a certificate | Exchange.ManageAsApp; does not work for eDiscovery |
04
From the mailbox nobody audits to a logged routine.
Three steps. Each one only makes sense after the previous one has shown results on your team.
A proposal, not a promise
Inventory, without changing anything
Octo shows who accesses each mailbox, what goes outside and what still uses a legacy path.
- Shared mailbox spreadsheet
- Masked forwarding report
- List of EWS, SMTP with password and macros
Checked batches
Meetings and announcements come out of a spreadsheet, checked beforehand, with approval and human sending.
- Availability before the invite
- Drafts instead of sending
- Scoped app
Routine with a record
Periodic review of access and forwarding, compared with the previous round.
- Who approved each change
- Access reviewed with the mailbox owner
- Legacy path deadlines tracked
05
Confirmed by a source.
Every point below has a source published by Microsoft (Learn and Support), by the package's official repository (PyPI, NuGet, PowerShell Gallery) or in Brazilian federal law. The examples are scripts to follow, not runs. The sources are in the next section.
4
points with a published source, each with its reference shown alongside.
- ConfirmedPer-mailbox limits in Graph
- 10,000 requests in 10 minutes, 4 concurrent and 150 MB of upload in 5 minutes, per app and mailbox; JSON batch with up to 20 requests.Source: learn.microsoft.com, Graph throttling limits and JSON batching
- ConfirmedThe invite goes out on creation
- When an event is created with attendees, the invite is sent to all of them, and this cannot be configured.Source: learn.microsoft.com, Create event
- ConfirmedPermissions add up
- In RBAC for Applications, what the app has in Entra ID and in Exchange is combined; changes take 30 minutes to 2 hours.Source: learn.microsoft.com, Application RBAC (Aug 21, 2026)
- ConfirmedShared mailbox
- 50 GB without a license, at most 25 users and account sign-in blocked; full access also sees private items.Source: learn.microsoft.com, shared mailboxes and Add-MailboxPermission
06
What Octo does, and what stays with you.
Octo prepares everything, but it does not sign. The document of record stays with whoever is accountable for it.
Octo prepares
Surveys, organizes and produces the files: documents, spreadsheets, presentations, schedules, inventories and check reports, on file and through the APIs, without sending or publishing anything.
Deliverable: material ready to checkYour team checks
Whoever is accountable for the document, the spreadsheet or the schedule checks what Octo delivered before approving. If something doesn't add up, it goes back to Octo with the correction.
Step: checked by the person accountableWho signs and approves
Octo does not sign, approve or send. The document owner reviews and signs; the project manager approves the baseline; the Microsoft 365 administrator grants consent for permissions; the data protection officer approves anything that goes out with personal data.
Approval: document owner and 365 administrator
07
Sources.
Microsoft Graph reference, documentation for Exchange Online and its PowerShell module, lifecycle pages and the LGPD, consulted on Oct 31, 2026.
- Graph, user: sendMailMail.Send, 202, draft as an alternative
- Graph, limits by serviceOutlook: 10,000 in 10 min, 4 concurrent
- Graph, JSON batchingUp to 20 requests, dependsOn
- Graph, calendar: getScheduleCalendars.ReadBasic
- Graph, create eventInvite sent on creation
- Graph, list rulesMailboxSettings.Read
- Graph, scheduleInformationavailabilityView codes
- Graph, event resourcetransactionId
- Graph, messageRuleActionsforwardTo, redirectTo
- Exchange Online limits30 msg/min, 10,000 recipients/day
- RBAC for ApplicationsApp scope by mailbox
- Test-ServicePrincipalAuthorization-Identity, -Resource; ignores the cache
- Set-MailboxGrantSendOnBehalfTo, forwarding
- Get-EXOMailboxPermissionDeny and IsInherited columns
- Get-EXORecipientPermissionSendAs only
- Property setsDelivery, from Get-EXOMailbox
- Get-InboxRule-IncludeHidden
- Set-MailboxAutoReplyConfigurationAutomatic reply
- Set-OrganizationConfigEwsEnabled, EwsAllowedAppIDs
- App-only PowerShellExchange.ManageAsApp
- ExchangeOnlineManagement3.10.1, Jul 24, 2026
- Shared mailboxes50 GB, 25 users
- End of basic authenticationEWS and SMTP AUTH
- Law 13.709/2018 (LGPD)Arts. 6, 41 and 46
Your mailboxes, audited and under control.
The assessment starts with a read-only inventory of shared mailboxes, access and external forwarding. You get the list of what is exposed, what uses a legacy path and the questions only your team can answer, and you decide with that in hand.