Shared mailbox folder security assignment per user

Just to understand, you mean that you only have it works properly if you do delegation + command you mentioned but if you run commands without delegation users cannot open mailboxe , is that what you mean?

FYI, User can’t send email with just full access permission, send as or send on behalf permission is required for the user to be able to send emails using shared mailbox.

Powershell commands will not not do the trick and something could be inherited. You should do delegation.

Automapping in outlook by default enabled with delegation but not with those command you run.

Is that clear?

it doesn't work properly
if I do full access delegation all users have full access regardless folder permissions assigment per folder
if I do power shell only I am getting an error when try to open mailbox with either in outlook or OWA (additional mailbox or cached )
there is no need to send as
incoming emails have approval web links and only assigned user can delete the email in his folder

Just for clarification using GUI (delegation) this is Mailbox permission which by default work with auto mapping in user's granted permission on shared mailbox but, when you configure mailbox folder permissions, auto-mapping is not used at all. Users will always need to manually add mailboxes to their Outlook profile, if their access has been granted using mailbox folder permissions.

Ask me if this not enough clarification.

Regards

when I have only folder permission set via command shell to reviewer and no delegation I am getting an error when try to mount shared mailbox

:-(
Something went wrong
You don't have permission to open this mailbox.
X-ClientId: CAF819AB046E441192A6ED780D6158D6
request-id be38de1e-4c31-4d46-93b2-c3e2ed438383
X-OWA-Error Microsoft.Exchange.Clients.Owa2.Server.Core.OwaExplicitLogonException
X-OWA-Version 15.1.1531.8

Run

Get-MailboxFolderPermission orders@mydomain.com:\bob

And check if permission is assigned correctly

get_mailboxFolderPerminsion orders@mydomain.com:\inbox\bob  returns
FolderName           User                 AccessRights
----------           ----                 ------------
bob                 Default              {None}
bob                 Anonymous            {None}
bob                 Bill      {Reviewer}
yet Bill can't mount orders mailbox

any solution?

Leop1212,
This is fairly simple.  The first thing I want you to do is send us a screenshot of the exact paths on that shared mailbox.

Please run this command  
Get-MailboxFolderStatistics 'emailaddressofthesharedmailbox' | Select Name,FolderPath | format-table -autosize

[PS] C:\Windows\system32>Get-MailboxFolderStatistics 'poreq@mydomain.com' | Select Name, FolderPath | Format-table -autosize

Name                         FolderPath
----                         ----------
Top of Information Store     /Top of Information Store
Bob                         /Bob
Calendar                     /Calendar
Contacts                     /Contacts
GAL Contacts                 /Contacts/GAL Contacts
Recipient Cache              /Contacts/Recipient Cache
Conversation Action Settings /Conversation Action Settings
Deleted Items                /Deleted Items
Drafts                       /Drafts
ExternalContacts             /ExternalContacts
Files                        /Files
Inbox                        /Inbox
Journal                      /Journal
Junk Email                   /Junk Email
Notes                        /Notes
Outbox                       /Outbox
Rick                         /Rick
Sent Items                   /Sent Items
Tasks                        /Tasks
Yammer Root                  /Yammer Root
Feeds                        /Yammer Root/Feeds
Inbound                      /Yammer Root/Inbound
Outbound                     /Yammer Root/Outbound
Recoverable Items            /Recoverable Items
Calendar Logging             /Calendar Logging
Deletions                    /Deletions
Purges                       /Purges
Versions                     /Versions
exch2016-shared.txt

There are 4 users Bob, Bill, Steve ad Mike and 3 folders in shared mailbox Orders<<I only see the bob folder in this shared mailbox.  Where is the Bill, Steve, and mike folders in this shared mailbox

1. For the bob folder
Add-MailboxFolderPermission ''poreq@mydomain.com:\bob" -User Bobsemailaddress -AccessRights Owner

"Billsemailaddress","stevesemailaddress","Mikesemailaddress" | Add-MailboxfolderPermission ''poreq@mydomain.com:\bob" -AccessRights Reviewer

Leop12,
Remember this is not full access we are giving Bill,Steve, or Mike so you have to add the mailbox to outlook via File>Account Settings>Account Settings(double click the email account)>More Settings>Advanced Tab...add the shared mailbox in there.

It will only automap if you are giving the guys full access to the shared mailbox

Hi leop1212, As I mentioned in my previous comment earlier it shoud be add manually by users , please check https://support.office.com/en-us/article/access-another-person-s-mailbox-a909ad30-e413-40b5-a487-0ea70b763081

Ahmed,
I am not sure you reading my follow ups. I  do know how to access another mailbox. I do it for 20 years.
in my case I login user with view  permissions to the folder via OWA  and go to the option of Open another mailbox > point to orders@mydomain.com and getting an error

:-(
Something went wrong
You don't have permission to open this mailbox.
More details...
 Refresh the page

leop1212,
Being that the access is on the bob folder trying going here:
orders@mydomain.com\bob

even if I point to orders@mydomain.com\bob instead of just orders@mydomain.com I am still getting same error

Leop1212,
I did have this issue before.  I forgot what we have to do is give Mike this permission as well:

Add-MailboxFolderPermission ''poreq@mydomain.com:\inbox" -User "Mikesemailaddress" -AccessRights FolderVisible

As a matter of fact you didn't make the Bob folder under you inbox so your command would actually be

Add-MailboxFolderPermission ''poreq@mydomain.com:\Top of Information Store" -User "Mikesemailaddress" -AccessRights FolderVisible

for all 3:

"Billsemailaddress","stevesemailaddress","Mikesemailaddress" | Add-MailboxfolderPermission ''poreq@mydomain.com:\Top of Information Store" -AccessRights FolderVisible

You may have issues with the 'Top of information store' command.
I would
1. Move the Individual User folders under the inbox- example Move the Bob Folder so it is a subfolder of the inbox
2. Now the correct commands to run for the Bob folder would be

"Billsemailaddress","stevesemailaddress","Mikesemailaddress" | Add-MailboxfolderPermission ''poreq@mydomain.com:\inbox" -AccessRights FolderVisible

"Billsemailaddress","stevesemailaddress","Mikesemailaddress" | Add-MailboxfolderPermission ''poreq@mydomain.com:\inbox\bob" -AccessRights Reviewer

Let me try it.  I am not sure how long it typically takes for permissions to propagate.
 I will check it with two hours
thanks you

I am still can't expand any folders under shared mailbox (user Mike) even though rights assigned as suggested.
 
C:\Windows\system32>Get-MailboxFolderPermission orders@mydomain.com:\Inbox

FolderName           User                 AccessRights
----------           ----                 ------------
Inbox                Default              {None}
Inbox                Anonymous         {None}
Inbox                Mike      {FolderVisible}
Inbox               Rick              {Reviewer}
Inbox                Bob           {Reviewer}

[PS] C:\Windows\system32>Get-MailboxFolderPermission orders@mydomain.com:\Inbox\Bob

FolderName           User                 AccessRights
----------           ----                 ------------
Bob                 Default              {None}
Bob               Anonymous            {None}
Bob                 Mike                {Reviewer}
Bob               Rick             {FolderVisible}
Bob                Bob        {FolderVisible}

Leo, everyone should have folder visible for inbox...Then on the actual Bob folder set who you want to have reviewer rights

Did you move the Bob folder in to the Inbox so it is now a subfolder of inbox?

yes
I removed old folders and created new folder inside the inbox
and you can see it in my Get-Permission results.
i can make folder visible to everyone, but the problem is that my test user mike has both Visible for inbox and Reviewer for Bob folder while stile can't expand mounted mailbox in the outlook and same error as listed above for the OWA

Did you try what you do on two test mailbox users ?

yes.
i tried it on two mailboxes bob and mike

So you mean bob and mike are two new users? I said that because I am thinking it might be permission issue.

both users not new  (over 10 years)

I created two new users bob1 and bob2
both have folder visible rights to shared inbox and Reviewer to inbox\bob folder.
same problem can't expand the folder on a mounted mailbo

What is the user name for shared mailbox ?

there is no user for the shared mailbox.
I have it delegated to my account. I am creating folders in it.