Mailbox delegation
Mailbox delegation grants another identity permission to work with a mailbox, such as reading its contents or sending mail, according to the permissions assigned.
Reading and sending are different permissions
“Give someone access to the mailbox” is not a complete specification. In Exchange Online, Full Access permits opening and managing mailbox contents but does not itself allow sending. Send As makes the message appear to come from the mailbox. Send on Behalf identifies the delegate as sending for the mailbox owner. Neither permission alone grants access to read the mailbox.
Other services package delegation differently. Gmail describes delegates as able to read, send, and delete mail, while they cannot change the account’s password. Check the service and permission rather than assuming the label means the same thing everywhere.
A delegate is not a forwarding destination
Forwarding sends messages onward. Delegation grants authority to work with the mailbox. An OAuth application’s delegated permissions are another mechanism, involving an app acting on behalf of a signed-in user. These should be separate items in an access review.
For temporary coverage, name the person, mailbox, required actions, and owner of removal. “Until the manager returns” is useful context, but someone still needs to remove and verify the grants.
The mailbox delegate request guide translates common coverage requests into reading and sending decisions.