How I audit shared mailbox access after employee offboarding

A routine offboarding review turned up a former employee who could still read a shared sales mailbox. The main account was disabled, so the normal checklist looked complete. The gap was delegated access through a nested group and an old mobile mail token that nobody checked. I now audit shared mailboxes in three passes. First I list direct delegates, send-as permissions, forwarding rules, and…