Deeplink not working for shared mailboxes to edit the draft present in shared mailbox

Question

Hi, I got a requirement from my client that the customer support team shouldn't have access to the shared mailbox and the customer support team should reply on the queries of the shared mailbox for which my team proposed an architecture that we load a draft in the shared mailbox draft folder and then send that mail as a deeplink which should allow customer support team to edit that reply as per their requirement so I tried the following deeplink from microsoft in my web browser. {base}/mail/deeplink/compose/{URL_ENCODED_DRAFT_ID}?ItemID={URL_ENCODED_DRAFT_ID}&exvsurl=1

Now this link works very well if I try edit my personal mailbox mails but when I try for shared mailbox it doesn't work. Attaching screen shot for ur reference. Can you guide me whether I am going in right direction or not? It would be really helpful for me.

Answer 1

Hi @-, Harsimranjot

Based on the scenario you described, the current deep-link approach may not be the right design if the support team must not have access to the shared mailbox. A deep link only opens an Outlook item in a mailbox context that the signed-in user is allowed to access. It does not grant access to the shared mailbox or bypass Exchange permissions.

The link format you are using works for drafts in the user’s own mailbox because Outlook can resolve the item ID in the user’s primary mailbox context. For shared mailbox items, Outlook generally needs the shared mailbox context in the URL, and the user must still have the required permissions to that mailbox or item. If the support team does not have access to the shared mailbox Drafts folder, they should not be expected to open or edit drafts stored there.

A more suitable approach would be to create the editable draft in the support agent’s own mailbox, set the From address to the shared mailbox, and grant only Send As or Send on Behalf permission as required. Alternatively, you can build a custom review/edit experience in your application and send the final response through Microsoft Graph using a controlled backend service. This would better satisfy the requirement that the support team should not directly access the shared mailbox.

So, the issue is not only with the deep-link syntax. The bigger concern is the permission and mailbox-context model. I would recommend validating whether the client allows limited access to the shared mailbox Drafts folder. If not, avoid storing editable drafts in the shared mailbox and use one of the alternative designs above.

---

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click ""Comment"".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.