Austin McCollum responded to our post about a possible security issue with Outlook 2011 Mac. He has seen the symptoms, but doesn't believe it's a real security issues and tells us why, describing the issue in detail. McCollum also describes how to verify that it is a security problem using Active Directory, and offers a precautionary change to make on Exchange Server. Here's his report:

I saw this forum entry because a recent customer brought up the same issue. I wanted to respond and let folks know that I think it is likely the Send on Behalf permission causing confusion. Turns out PFDAVadmin, Outlook on Mac and PC won't always have the publicDelegates permissions showing. However, if it turns out to really be sending as after verifying the AD properties, I'd like to know!

If someone thinks it's a genuine security issue, they should open a case with Microsoft to get it sorted out.

To ensure there are no additional permissions on the account that is able to send AS, run the following Exchange Management Shell command:

get-mailbox spoofedUserAlias | Get-ADPermission | where {($_.ExtendedRights -like "Send-As") -OR ($_.ExtendedRights -like "ms-Exch-EPI-may-impersonate") -or ($_.ExtendedRights -like "ms-Exch-EPI-Impersonation")}

Here's the behavior I found for Exchange 2007 SP3 and Outlook 2011 SP1.

E2k7native -- account sharing their calendar

E2k7calPF -- Mac Outlook 2011 user given reviewer permissions to E2k7native

When I gave only reviewer permissions to the calendar, I was able to craft an email as the shared calendar owner, but received the error here as expected.

When I gave the Mac Outlook user delegate permissions, I was able to craft and send a message as expected. However, in the Inbox message list, the From: shows e2k7native instead of the actual sender e2k7calPF. Only when viewing the headers or the message details can you tell it was sent by or sent on behalf of the real user [by design].

Here's what the message looks like from Outlook 2007:

And here are the Internet headers:

11:58:13 -0500
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: e2k7native <e2k7native@contoso.com>
To: E2k7calPF <E2k7PF@contoso.com>
Sender: E2k7calPF <E2k7PF@contoso.com>
Date: Thu, 9 Jun 2011 11:58:12 -0500
Subject: test as delegate
Thread-Topic: test as delegate
Thread-Index: AcwmxmqYllFYJ6QcQ9+LkMN9ARcjhg==
Message-ID: <CA161FB7.10%e2k7native@contoso.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <CA161FB7.10%e2k7native@contoso.com>
MIME-Version: 1.0

The real indicator will be to verify in Active Directory. To determine who has Send on Behalf permissions to a mailbox, view the mailbox owner's account object from ADSIedit and view the publicDelegates property. The distinguished name values there represent who can Send on behalf. If we verify this entry doesn't contain the Mac Outlook user, then please contact me so we can investigate further.

if you have verified this in Active Directory, or if you can add to this discussion.