If you grant mailbox access to non mailbox owners via an ad group, i.e. attach "xyz mailbox access" domain group to the acl of a mailbox, thus giving them "full mailbox access" permission, does this mean they have "send as" rights. Can someone grant someone else send as rights through delegate access in outlook, if so which option needs checking? Why do some people grant access via delegate rights, and others grant it via a domain group in the mailboxes ACL? I dont understand why there are 2 ways to do it so one must serve one purposes and another server another purpose?

No, those are separate permissions, you will have to grant "send as" permissions. No, this have to be administrated through Exchange. This is just two ways of adressing the problem...Martin Sundstrm | Microsoft Certified Trainer | MCITP: Enterprise Messaging Administrator 2007/2010 | http://msundis.wordpress.com

" you grant mailbox access to non mailbox owners via an ad group, i.e. attach "xyz mailbox access" domain group to the acl of a mailbox, thus giving them "full mailbox access" permission, does this mean they have "send as" rights." You havent mentioned what exchanger server you're using. 1. If you're using Exchange 2003 when you grant fullmailbox access to users/group, then they will have send as permission too. 2. If you're using Exchange 2007/2010 then Fullmailbox access doesn't include sendas rights. These permissions have been seperated. You have to grant sendas. Instead granting fullmailbox will give snedonbehalf. "Can someone grant someone else send as rights through delegate access in outlook, if so which option needs checking?" 1. No, but if "someone esle" has full mailbox permission to a mailbox, say user A, AND if then User A add "someone else" as a delegate then they will have sendas permission. "Why do some people grant access via delegate rights, and others grant it via a domain group in the mailboxes ACL? I dont understand why there are 2 ways to do it so one must serve one purposes and another server another purpose?" 1. Giving full mailbox access give you access to all folders etc... 2. By using delegates, you can grant access at more a granular level http://technet.microsoft.com/en-us/library/dd421860(EXCHG.80).aspxSukh

Full Mailbox Access does not give SEND AS permissions in any version of Exchange since Exchange 2003 SP1 ( Plus a hotfix) Or Exchange 2003 SP2 plus a hotfix. It used to be the case, but that changed some years ago during the time Exchange 2003 was out. You cant grant SEND AS perms via Outlook, that is an AD permission. You can however grant SEND ON BEHALF permissions through Outlook delegation. Delegate access is much granular. Full Mailbox permissions means just that and if you have that, you cant prevent someone from accessing every folder in that mailbox.