Delegated mailbox

Ivanti Email+ supports delegated access for Mailbox. Currently, we support delegation of up to four mailboxes. In case of multiple delegated mailboxes, each mailbox is independent and has its own Delegated Mailbox account settings.

When configuring the mailbox delegation, the owner delegates mailbox to another user (Delegate) to manage it as per delegation level set on Outlook. The delegated user can add up to four delegated mailboxes from multiple owners.

To configure Delegated Mailbox use the following key-value pairs:

  • Add delegated_shared_mailbox value to enabled_features key-value pair to enable the Add button in the Settings > Mail > Accounts section of the Email+ app.

When you select Add option and enter details Email ID field, Email+ searches email address in GAL and provides list of contacts to add mailbox. If the search result is successful, the 'Add' option on the Add Delegated Mailbox screen is enabled. Click on the Add option to add delegated mailbox.

The delegated mailbox permissions are similar to Microsoft Exchange server such as Reviewer, Author, and Editor level permissions. Starting Ivanti Email+ 4.9.0 all permissions levels are supported in Email+.

Delegated user can now save draft mail in the Delegated Mailbox. The Delegated Drafts folder is not synced with the server and only available locally. Delegate can store draft emails in "Drafts" folder. These folders are local and are not synced with the server.

If Delegated Calendar is added without Delegated Mail, then the draft emails (such as reply/forward for delegated events) are saved in "Delegated Drafts" folder for Primary account. This folder is also local and is not synced with the servers.

  • Search is not valid for "Drafts" in Delegated Mailbox and in the "Delegated Drafts".

  • Mails cannot be moved from or to Delegated Mailbox Drafts and "Delegated Drafts".

The mailbox owner can change permissions from any role (Reviewer/Author/Editor) to any role (Reviewer/Author/Editor), also for existing drafts.

  • When the Owner revokes access to Delegated Mailbox completely, or the user removes the Delegated Mailbox manually from the Email+ settings, related Drafts folder is removed with all its content.

  • When the Owner revokes access to Delegated Calendar, all related drafts from the "Delegated Drafts", Delegated Mailbox "Drafts", and Outbox (if any emails are stuck there) folders are removed.

  • When the Admin removes the delegated_shared_mailboxkey-value pair from the Email+app config, then all Delegated Mailbox drafts are deleted from the app along with the other information from the Delegated Mailbox.

The mailbox owner can update the following permission combinations:

Permission level Combinations
Reviewer
  • Reviewer > Author
  • Reviewer > Editor
  • Reviewer > None
Author
  • Author > Reviewer
  • Author > Editor
  • Author > None
Editor
  • Editor > Author
  • Editor > Reviewer
  • Editor > None

The following table displays the different delegation permissions and the actions they can perform:

Action

Reviewer

Author

Editor

Reading emails

Yes

Yes

 Yes

Downloading and viewing email attachment

 Yes Yes Yes

Searching emails

 Yes Yes Yes

Marking emails as Read/Unread

 Yes Yes Yes

Flagging emails

 No No Yes

Moving an email to a different folder within the account

 No No Yes

Deleting emails

 No No Yes
Sending emails with attachments No Yes Yes
Options to Reply/Reply All/Forward emails No Yes Yes

Saving draft emails locally in the app.

*Reviewer cannot compose emails and create drafts. The only possible way to create draft is an edge case when doing Reply/Reply All/Forward a delegated calendar event.

 Yes Yes Yes

Responding to meeting invites from emails (no delegated calendar added)

 No No No

Responding to meeting invites from emails (DC added).

 

* Becomes available if the Delegated Calendar of the same owner's account is added with Author or Editor permissions.

 Yes Yes Yes

Reading signed and/or encrypted emails

 

 Yes Yes Yes

Sending signed and/or encrypted emails

 

 No Yes Yes

Reading emails with Classification

 

 Yes Yes Yes

Sending emails with Classification

 

 No Yes Yes

The delegated user can manually delete the delegated mailbox added from the Email+ app.

Drafts are stored locally and are never synced with the server. Even if eas_16 is enabled for the Primary account.

The root folders created by the user are not supported and not accessible. This is a limitation of the EWS protocol.

Adding delegated mailbox to the Email+ app

To add the delegated mailbox to the Email+ app on your iOS device, perform the following steps:

Before you begin 

  • Configure the enabled_features key-value pair and add the delegated_shared_mailbox value.

  • Set both EWS and Exchange host

  • Set EWS Authorization mode,

    • For Modern Auth, set value to modern_auth​

    • For Certificate based Auth, set value to cert_base

Procedure 

  1. In the Email+ app, go to Settings > Mail > Accounts > Add.
  2. On the Add delegated Mailbox screen, type the Email ID of the mailbox owner. Delegated mailbox is added in Mail section - Mailboxes.​ The delegate gets access to Inbox, sub folders, and smart folders.

Support for SMIME (Early preview)

The signing and encryption functionality is extended to support Delegated Mailboxes, the functionality works similar to that of Primary Account. Delegated user can:

  • Read/Send signed/encrypted emails depending upon the user permission

  • Read emails with Classification

The keychain is common for all mailboxes and not only for the mailbox you are working on. The app searches certificates in the keychain and GAL (same as the primary account).

The process of adding certificates to the Keychain is:

  • Through email_signing_certificate and email_encryption_certificate KVPs.

  • From the email attachment

Signing

A Delegate can view, search, reply, and forward signed emails in the delegator's mailbox (depending on permissions).

In the received email, the sender's signing certificate can be verified if their public certificate is available in GAL, or if it is available in the delegate's keystore in Email+. Otherwise, the certificate will be marked red as not trusted.

A Delegate can sign emails with the actual sender's certificate (Primary account) and send signed emails from the Primary account on behalf of the delegator.

If the certificate of the signed email cannot be validated (there is no user certificate in the keychain and in GAL), the red check mark icon is be displayed according to the existing logic.

Encryption

A Delegate can encrypt emails with the actual sender's certificate (Primary account) and send encrypted emails from the Primary account on behalf of the Delegator.

A Delegate can decrypt emails if the Delegator provides the Delegate with their private certificates, and these certificates are added to the app Keychain.

Suppressing Name Check on certificate mismatch

When the feature flag for suppressing name checks on certificate mismatch is enabled by admin, the feature is available for delegated mailboxes. Existing certificate associations are automatically accessible for delegated mailboxes.

The user can encrypt/decrypt emails using existing certificate associations and create new associations.

Classification

When classification is configured by Admin, it is available for delegated mailboxes. The user is able to parse emails in the delegated mailboxes having classification, reply/forward, and compose new emails.

Ivanti Email+ configurations supported for Delegated and Shared Mailbox

The following table lists the supported Email+ and EWS configurations.

If EWS server is not accessible publicly (located in private network), then VPN should be configured. Ensure that the user has access to the EWS host specified in the KVP from the device. If EWS host is not reachable, contact your admin to setup connection using the VPN to the internal network where the EWS host is accessible.

Update the host name in the email_ews_host key-value pair.

Email+ Configuations

Additional Configurations for EWS

Supported

Ivanti EPMM and Ivanti Neurons for MDM with sentry, Modern auth with or without email_password KVP, Microsoft Office 365

Add email_ews_host KVP with EWS server value

Add ews_min_allowed_auth_mode = modern_auth KVP

Yes

Ivanti EPMM or Ivanti Neurons for MDM, without sentry, Modern auth with or without email_password KVP, Microsoft Office 365

Add ews_min_allowed_auth_mode = modern_auth KVP

Yes

Ivanti EPMM or Ivanti Neurons for MDM, with sentry, Modern auth with or without email_password KVP, Microsoft Office 365

Exchange host for EWS should have value of the EWS server

EWS Authentication Mode should have Modern Authentication value

Yes

Ivanti EPMM or Ivanti Neurons for MDM, with sentry + Local certificate, Basic auth with or without email_password KVP, Microsoft Exchange versions 2016 and 2019, Microsoft Office 365

Add email_ews_host with EWS server value

Yes

Ivanti EPMM, with sentry + group certificate, Basic auth with or without email_password KVP, Microsoft Exchange versions 2016 and 2019, Microsoft Office 365

Add email_ews_host with EWS server value

Yes

Ivanti EPMM, with Sentry + MS scep certificate, Basic auth with or without email_password KVP, Microsoft Exchange versions 2016 and 2019, Microsoft Office 365

Add email_ews_host with EWS server value

Yes

Ivanti EPMM or Ivanti Neurons for MDM, with Sentry, Kerberos with prompt_email_password=true and enter password on Email+ login screen, Microsoft Exchange versions 2016 and 2019

Add email_ews_host with EWS server value

Yes

Ivanti EPMM or Ivanti Neurons for MDM, with Sentry, Kerberos with email_password KVP with hard coded value (which is not probably a use case), Microsoft Exchange versions 2016 and 2019

Add email_ews_host with EWS server value

Yes

Ivanti EPMM or Ivanti Neurons for MDM, without sentry, Basic auth (with or without 'email_password' KVP), Microsoft Exchange versions 2016 and 2019, Microsoft Office 365

Add email_ews_host with EWS server value

Yes

Ivanti EPMM or Ivanti Neurons for MDM, with or without sentry, Certificate based auth, Microsoft Exchange versions 2016 and 2019

Add email_ews_host with EWS server value

Add ews_min_allowed_auth_mode = cert_base KVP

Yes

Ivanti EPMM or Ivanti Neurons for MDM, with sentry, Kerberos (without 'email_password' KVP), Microsoft Exchange versions 2016 and 2019

 

No