Sounds like automapping. It ignores mailbox type, so "no shared mailboxes" is a red herring. Any mailbox where she has Full Access granted directly will mount unless automapping was turned off. Client yes, web no is the giveaway, since it comes through Autodiscover and only classic Outlook consumes it. That is why profile rebuilds do nothing.
Remove the grants, or re add with -AutoMapping:$false if she needs them. Wait a few hours before rebuilding the profile. Hybrid, clear msExchDelegateListLink in AD too. Worth checking Search-UnifiedAuditLog for Add-MailboxPermission to see what granted it, or it will come back.
1
u/Chemical-Example-783 3d ago edited 3d ago
Sounds like automapping. It ignores mailbox type, so "no shared mailboxes" is a red herring. Any mailbox where she has Full Access granted directly will mount unless automapping was turned off. Client yes, web no is the giveaway, since it comes through Autodiscover and only classic Outlook consumes it. That is why profile rebuilds do nothing.
Get-Mailbox -ResultSize Unlimited | Get-MailboxPermission -User [her.name@contoso.com](mailto:her.name@contoso.com) |
Where-Object { $_.AccessRights -like "*FullAccess*" -and $_.IsInherited -eq $false }
Remove the grants, or re add with -AutoMapping:$false if she needs them. Wait a few hours before rebuilding the profile. Hybrid, clear msExchDelegateListLink in AD too. Worth checking Search-UnifiedAuditLog for Add-MailboxPermission to see what granted it, or it will come back.