In which scenarios user B can see user A's private emails and calendar items?

Question

Hello, I'm trying to get a definitive answer to question "In which scenarios user B can see user A's private items?". We are using Exchange 2016 onsite installation. Email test:

1. I created a test mailbox for a User A.
2. I gave myself (I'm going to call myself User B from this on) Full Access permission from exchange.
3. I send User A a message from 3th mailbox that is tagged as "private"
4. User B tries to view User A's mailbox from his Outlook and cannot see the private email there.

This works as documented. Calendar test:

1. I created a test meeting marked as "private" in the User A's calendar.
2. I try to view the calendar from User B's outlook.
3. Shows only as "private"

All of this seem to works as expected. However, Microsoft documentation states as follows:

"Important: You shouldn’t rely on the Private feature to prevent other people from accessing the details of your appointments, contacts, or tasks. To ensure that other people can’t read the items that you marked as private, don’t grant them Reviewer (can read items) permission to your Calendar, Contacts, or Tasks folder." -https://support.microsoft.com/en-us/office/allow-someone-else-to-manage-your-mail-and-calendar-41c40c04-3bd1-4d22-963a-28eafec25926#__toc305134744

This would indicate that there is a way for the User B to actually see (in some situations) the private items:

1. What are these situations?
2. Does this mean that "reviewer" permission > delegate can see my private items -check box?
3. Are there other settings user A might set that would let User B see his private items? (Other than the Delegate permissions)?

Answer 1

Hi @LomM,

This works as documented. Calendar test:

1. I created a test meeting marked as "private" in the User A's calendar.
2. I try to view the calendar from User B's outlook.
3. Shows only as "private"

If you use OWA (Outlook on the web) instead, would User B be able to see more detailed information rather than only the meeting title "private appointment" in Outlook?

If yes, based on my test, it is the same behavior as documented in the following link, which is by-design in Outlook:

Private items aren't displayed in a shared mailbox in Outlook

The workaround is to add User B as a delegate, which is the same as this link mentioned in your main post.

Are there other settings user A might set that would let User B see his private items? (Other than the Delegate permissions)?

Another workaround is to use OWA instead if you do not want to add delegate permissions.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.