Exchange Mailbox Delegate Permissions

In an Exchange Online tenant reachable from the operator's Internet connection and permitting the administrator's sign-in, an authorized administrator can grant a named principal FullAccess to an approved mailbox without an internal network foothold. FullAccess lets the delegate open and view, add, and remove mailbox contents; it does not grant Send As or Send on behalf.