Veritas Alta™ Archiving : Cloudlink Administration Guide

Requirements for delegation permissions synchronization

Table: Requirements for delegate permissions synchronization lists the conditions under which a CloudLink task considers a delegate for delegate permissions synchronization.

Note that if the delegate type is a user, there is no requirement for the task to target the user, provided the user already has an archive account. Conversely, if the delegate type is a group, the task must target the group for the delegation permissions to be synchronized.

Table: Delegate access restrictions if a delegate has a deny permission and synchronization requirements are not met lists the restrictions on delegate access if the synchronization requirement is not met for a delegate with a Deny delegation permission.

Veritas Alta Archiving imposes these delegate access restrictions to ensure that users do not gain delegate access to archive accounts when a Deny delegation permission may have been set to prevent it.

Figure: Example: Mailbox with delegation permissions set for users and mail-enabled security groups shows a user mailbox or shared mailbox to which the Exchange administrator has assigned a number of mailbox delegation permissions.

Figure: Example: Mailbox with delegation permissions set for users and mail-enabled security groups

In this example, the Exchange administrator has granted User A and members of Group 1 Full Access permission to the mailbox. In contrast, User B and members of Group 2 have been given Deny Full Access permission. Assuming that CloudLink has synchronized all of these delegation permissions, then User A and members of Group 1 have access to the delegated mailbox archive, subject to the precedence of any deny delegation permissions.