Delegated mailbox

Ivanti Email+ supports delegated access for Mailbox. Currently, we support delegation of up to four mailboxes. In case of multiple delegated mailboxes, each mailbox is independent and has its own Delegated Mailbox account settings.

When configuring the mailbox delegation, the owner delegates mailbox to another user (Delegate) to manage it as per delegation level set on Outlook. The delegated user can add up to four delegated mailboxes from multiple owners.

To configure Delegated Mailbox use the following key-value pairs:

  • Add delegated_shared_mailbox value to enabled_features key-value pair to enable the Add button in the Settings > Mail > Accounts section of the Email+ app.

When you select Add option and enter details Email ID field, Email+ searches email address in GAL and provides list of contacts to add mailbox. If the search result is successful, the 'Add' option on the Add Delegated Mailbox screen is enabled. Click on the Add option to add delegated mailbox.

The delegated mailbox permissions are similar to Microsoft Exchange server such as Reviewer, Author, and Editor level permissions. Starting Ivanti Email+ 4.9.0 all permissions levels are supported in Email+.

Delegated user can now save draft mail in the Delegated Mailbox. The Delegated Drafts folder is not synced with the server and only available locally. Delegate can store draft emails in "Drafts" folder. These folders are local and are not synced with the server.

If Delegated Calendar is added without Delegated Mail, then the draft emails (such as reply/forward for delegated events) are saved in "Delegated Drafts" folder for Primary account. This folder is also local and is not synced with the servers.

  • Search is not valid for "Drafts" in Delegated Mailbox and in the "Delegated Drafts".

  • Mails cannot be moved from or to Delegated Mailbox Drafts and "Delegated Drafts".

The mailbox owner can change permissions from any role (Reviewer/Author/Editor) to any role (Reviewer/Author/Editor), also for existing drafts.

  • When the Owner revokes access to Delegated Mailbox completely, or the user removes the Delegated Mailbox manually from the Email+ settings, related Drafts folder is removed with all its content.

  • When the Owner revokes access to Delegated Calendar, all related drafts from the "Delegated Drafts", Delegated Mailbox "Drafts", and Outbox (if any emails are stuck there) folders are removed.

  • When the Admin removes the delegated_shared_mailboxkey-value pair from the Email+app config, then all Delegated Mailbox drafts are deleted from the app along with the other information from the Delegated Mailbox.

The mailbox owner can update the following permission combinations:

Permission level Combinations
  • Reviewer > Author
  • Reviewer > Editor
  • Reviewer > None
  • Author > Reviewer
  • Author > Editor
  • Author > None
  • Editor > Author
  • Editor > Reviewer
  • Editor > None

The following table displays the different delegation permissions and the actions they can perform:





Reading emails Yes Yes Yes
Downloading and viewing email attachment Yes Yes Yes
Searching emails Yes Yes Yes
Marking emails as Read/Unread Yes Yes Yes
Flagging emails No No Yes
Moving an email to a different folder within the account No No Yes
Deleting emails No No Yes
Sending emails with attachments No Yes Yes
Options to Reply/Reply All/Forward emails No Yes Yes
Saving draft emails locally in the app.


*Reviewer cannot compose emails and create drafts. The only possible way to create draft is an edge case when doing Reply/Reply All/Forward a delegated calendar event.
Yes Yes Yes
Responding to meeting invites from emails (no delegated calendar added) No No No
Responding to meeting invites from emails (DC added).


* Becomes available if the Delegated Calendar of the same owner's account is added with Author or Editor permissions.
Yes Yes Yes
Reading signed and/or encrypted emails Yes Yes Yes
Sending signed and/or encrypted emails No Yes Yes
Reading emails with Classification Yes Yes Yes
Sending emails with Classification No Yes Yes

The delegated user can manually delete the delegated mailbox added from the Email+ app.

Drafts are stored locally and are never synced with the server. Even if eas_16 is enabled for the Primary account.

The root folders created by the user are not supported and not accessible. This is a limitation of the EWS protocol.

Adding delegated mailbox to the Email+ app

To add the delegated mailbox to the Email+ app on your iOS device, perform the following steps:

Before you begin 

  • Configure the enabled_features key-value pair and add the delegated_shared_mailbox value.

  • Set both EWS and Exchange host

  • Set EWS Authorization mode,

    • For Modern Auth, set value to modern_auth

    • For Certificate based Auth, set value to cert_base


  1. In the Email+ app, go to Settings > Mail > Accounts > Add.
  2. On the Add delegated Mailbox screen, type the Email ID of the mailbox owner. Delegated mailbox is added in Mail section - Mailboxes.​ The delegate gets access to Inbox, sub folders, and smart folders.

Support for SMIME (Early preview)

The signing and encryption functionality is extended to support Delegated Mailboxes, the functionality works similar to that of Primary Account. Delegated user can:

  • Read/Send signed/encrypted emails depending upon the user permission

  • Read emails with Classification

The keychain is common for all mailboxes and not only for the mailbox you are working on. The app searches certificates in the keychain and GAL (same as the primary account).

The process of adding certificates to the Keychain is:

  • Through email_signing_certificate and email_encryption_certificate KVPs.

  • From the email attachment


A Delegate can view, search, reply, and forward signed emails in the delegator's mailbox (depending on permissions).

In the received email, the sender's signing certificate can be verified if their public certificate is available in GAL, or if it is available in the delegate's keystore in Email+. Otherwise, the certificate will be marked red as not trusted.

A Delegate can sign emails with the actual sender's certificate (Primary account) and send signed emails from the Primary account on behalf of the delegator.

If the certificate of the signed email cannot be validated (there is no user certificate in the keychain and in GAL), the red check mark icon is be displayed according to the existing logic.


A Delegate can encrypt emails with the actual sender's certificate (Primary account) and send encrypted emails from the Primary account on behalf of the Delegator.

A Delegate can decrypt emails if the Delegator provides the Delegate with their private certificates, and these certificates are added to the app Keychain.

Suppressing Name Check on certificate mismatch

When the feature flag for suppressing name checks on certificate mismatch is enabled by admin, the feature is available for delegated mailboxes. Existing certificate associations are automatically accessible for delegated mailboxes.

The user can encrypt/decrypt emails using existing certificate associations and create new associations.


When classification is configured by Admin, it is available for delegated mailboxes. The user is able to parse emails in the delegated mailboxes having classification, reply/forward, and compose new emails.