Permission & Access Issues

Cannot Remove Delegate Access from a Former Administrator Account in Microsoft 365

John Wilson Oct 21, 2026 868 views

Question details

The user is unable to remove delegate access permissions that are persistently assigned to a former domain and global administrator account.

Cannot Remove Delegate Access from a Former Administrator Account in Microsoft 365

Product: Microsoft 365 / Exchange Online
Device & OS: not provided
Scenario: Attempting to clean up admin privileges and remove delegate access after migrating to Microsoft 365 in a complex hybrid environment with on-premises Active Directory synchronization.
Observed behavior: Delegate permissions remain tied to the former administrator's account and cannot be removed locally or via the standard Microsoft 365 admin interface due to synchronization conflicts.

Before you start

Ensure you are signing in with an active global administrator account, as standard user accounts do not have the necessary privileges to open synchronization service requests.

Solution 1Recommended

Submit a Service Request to Microsoft Support

Because hybrid Exchange and directory synchronization can cause complex permission-caching behavior, contacting Microsoft Online technical support is the safest and recommended way to investigate and resolve these conflicting permissions.

In a hybrid environment, delegate permissions are often tied to on-premises Active Directory attributes (like publicDelegates or grantSendOnBehalfTo). When migrating to Microsoft 365, these attributes sync via Azure AD Connect, locking the ability to edit them directly in the cloud.

Attempting to force-remove these via standard Exchange Online PowerShell may result in the permissions reappearing after the next sync cycle. Microsoft Support has the tools to investigate the exact synchronization block.

Sign in to Microsoft 365 Admin Center

Navigate to admin.microsoft.com and sign in using your current global administrator credentials.

Access the Support menu

On the left-hand navigation pane, locate the 'Support' tab and click on 'Help & support' or 'New service request'.

Describe the issue

Type a brief description of the issue in the search box, such as 'Cannot remove delegate access for former admin in hybrid Exchange setup', and press Enter to view automated diagnostics.

Open a support ticket

If the automated solutions do not resolve the synchronization conflict, click the 'Contact support' button at the bottom. Fill out your contact details and submit the ticket so the support team can provide guidance on clearing the specific on-premises attributes.

Submit a Service Request to Microsoft Support

Information to Provide: Have your tenant ID, the exact email address of the former administrator, and details regarding your on-premises Active Directory sync tool (e.g., Azure AD Connect version) ready for the support agent.

Free Microsoft Office alternative

Switch to WPS Office for a Hassle-Free Productivity Experience

Managing complex hybrid environments, Active Directory syncs, and administrative permissions in Microsoft 365 can be exhausting. If you simply need a reliable, standalone office suite for your daily document creation without the headache of complex cloud permission management, WPS Office is an excellent choice. It offers a lightweight environment that lets you focus entirely on your work.

1. Download the installer: Visit the official WPS Office website and click the free download button for your operating system.
2. Install the software: Run the downloaded executable file and follow the simple on-screen instructions to complete the local installation.
3. Open your files: Launch WPS Office and open your existing Microsoft documents directly to continue working seamlessly without any complex account setup.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Stand-alone desktop application that avoids complex cloud directory and permission sync issues.Lightweight and incredibly fast to install on any operating system.Familiar user interface ensuring zero learning curve for former Microsoft Office users.All-in-one suite combining Word, Excel, PowerPoint, and PDF tools in a single tabbed window.

microsoft office alternative - wps office

Frequently Asked Questions

Why do delegate permissions persist after an Exchange migration?

In a hybrid setup, Azure AD Connect synchronizes attributes from your local Active Directory to Microsoft 365. If a delegate permission was originally set on-premises, Microsoft 365 treats the on-premises AD as the source of truth, preventing you from deleting the permission directly in the cloud.

Can I remove the delegate permissions using Exchange Online PowerShell?

You can try using the Remove-MailboxPermission cmdlet in Exchange Online, but if the environment is actively syncing with an on-premises Active Directory, the cloud changes will likely be overwritten and reverted during the next synchronization cycle.

What happens if I just delete the former administrator's account from Active Directory?

Deleting the account locally will eventually sync and remove the user from Microsoft 365. However, this is not recommended if they still have orphaned delegate permissions on active mailboxes, as it can cause 'orphaned SID' issues or broken permissions in Outlook for the remaining users. It is best to cleanly remove the access first.

Which on-premises attributes control delegate access?

Typically, attributes like 'publicDelegates' (for Send on Behalf permissions) and 'msExchDelegateListLink' dictate delegate behavior. Modifying these directly via ADSI Edit on-premises is sometimes required, but you should only do this under the strict guidance of Microsoft Support.

Document & File Issues