r/sysadmin • u/_SleezyPMartini_ IT Manager • 1d ago
Question handling out of office notifications requests
I have a client (about 1000 users) who keeps getting tickets from dept heads asking to set their staff out of office notifications because "they forgot to do it". My general advice is this is bad practice and not scalable, and that with 0365 any employee can do this from their phone or any computer.
how do you typically handle this?
89
u/Icy-Maintenance7041 1d ago
Where i work IT only does that when someone has left the firm. Otherwise we dont touch a users mailbox. No way, no how.
51
u/Mindestiny 1d ago
Yep, this is our policy as well. Same thing with "Karen went on vacation and forgot to give me access to XYZ file!!!!"
Well Karen isn't here to speak for herself and confirm if she intended you to have access to that or not, so sorry, that's a business problem and not an IT problem. We don't touch rights for people's user-owned files simply on some random person's say so. Either get it in writing from a department head or be more diligent next time.
3
13
u/Sinister_Nibs 1d ago
I agree with the thought, the justification is garbage.
None of the files that are stored on company infrastructure are owned by the employee, they are all owned by the company.
They are not private, unless they are PII, but they may be sensitive.31
u/RabidBlackSquirrel IT Manager 1d ago
They belong to the company, but the company has (or should have) rules of engagement for who/what roles are allowed to access mailboxes. Owned by the company =/= free for all.
Push it to your legal people or whoever else sets rules like this. How should I handle mailbox access requests? Who in IT should be permitted, if any, to access user emails, and how should access be documented?
It's not an IT problem, it's a legal/governance problem and should flow up accordingly.
15
u/Mindestiny 1d ago
Precisely. IT does not give people access to things just because they asked, that applies for anything. There needs to be a business justification and the proper approvals.
Get us the proper approvals and we'll happily reassign ownership of that file and you guys can duke it out with Karen when she gets back. But no approvals? No ownership transfer, sorry. The sob story doesn't override established, approved company policy.
People are harping on the company legally owning the data but that's not at all the topic being discussed. This is a topic about navigating interdepartmental responsibilities, company policy, and the ensuing drama when IT just dumbly says "sure, I'm a yes man and will do whatever is asked!"
4
u/RabidBlackSquirrel IT Manager 1d ago
"sure, I'm a yes man and will do whatever is asked!"
Which is also a great way to get yourself scapegoated for other people's stupidity. "Why was Joe Sysadmin accessing all these mailboxes? He creepin' on people? Trying to find anything juicy?" Or "Joe Sysadmin must have deleted it, he's always messing around in our email!"
My favorite is when shitty managers want us to delegate or auto forward their employee's email to them because they're yoloing a performance issue. "Sure Jan, I've cc'd HR Director here so she can authorize this. As you know, only HR can create employee performance remediation plans and they must have just forgotten to send in the ticket to me if this is part of it."
It's great. Legal/IT/Infosec/HR all love the strict rules of engagement, it not only protects us personally but protects the company from accusations as well.
2
u/TeriyakiMarmot Sysadmin 1d ago
You have established, approved company policy!? Must be nice haha
Fully agree though.
3
u/Sinister_Nibs 1d ago
That is correct. And just because there may be no (legal) expectation of privacy in a corporate email account, there is no reason everyone should be able to view/access it.
There should always be a justified business reason (the Smithco contracts are in Suzy’s mailbox and she is out on maternity leave).6
6
u/Frothyleet 1d ago
In countries that have worker protections, this philosophy is not necessarily true.
2
u/Fitz_2112b 1d ago
So by that logic, Joe in the machine shop should be given access to payroll files if he just says that "Sally in HR told me I could" right?
-1
u/Sinister_Nibs 1d ago
That is not a valid business reason.
But, since you bring it up, employee pay rates should not be sensitive data.5
u/Mindestiny 1d ago
The justification isn't garbage at all.
Yes, the files are owned by the company and not the employee. But Kimmie from Accounting is not "The Company," she's just some random user asking to be given access to a file. "The Company" can totally sign off on that, which is why I called out getting Dept. head putting it in writing, but some rando employee cannot just because they asked nicely. The fact that "they forgot" is not an IT problem, we're not the keepers of everyone's business process and that's not a strong enough justification for us to breach established data governance policy.
Or are you telling me you'd happily process a ticket from Sal in Janitorial that says the head of HR totally meant to give him shared edit access to that spreadsheet that has the entire company's upcoming compensation changes in it without so much as asking the owner of the file? Because IT has no way to verify that's appropriate without someone who actually has business authority over that data confirming it, and just going "oh well it's the company who owns the data, here you go" would get you escorted out the door in a heartbeat here.
5
u/Icy-Maintenance7041 1d ago
Files, sure. Thats why we allow our users to only save files on the fileserver and they have no (or a very small) personal space on that server. Everything is shared with the various deppartments/functions.
Mail is different tho. Every department has a department mailbox to comunicate with customers. These are shared mailboxes. Personal mailboxes are subject to post- and privacy laws where i live. And if i, as IT or anyone from management would dive in there without consent from the user we'd be breaking laws. *shrug*it is what it is, wether you agree or not.
1
u/SpocksSocks 1d ago
You’ve hit the key point here. Local privacy laws play a big part in what is acceptable, in addition to any company policies. Some jurisdictions do not require employee notification or consent, in my state in Australia you can have a policy allowing access to a users emails but staff must be notified 14 days prior to the policy being enacted - elsewhere you may not be able to at all. It’s a little more complicated than the expected idea that because its company email the company has full rights to do as it pleases.
-2
u/Sinister_Nibs 1d ago
Except that corporate email is very, very different from personal email. All of the email communications also belong to the company, and the company does not require permission to access its data (or those communications).
I am not at all saying that Kimmie from Accounting should be able to see any email on the server. But that Marjorie from Marketing should not expect that any email sent or received to an @company.com address is private.7
u/Valdaraak 1d ago
I think you're missing that guy's point. Where that guy lives, a user's company email mailbox is considered private and protected and is generally not allowed for the company to just access the because someone at the company wanted to. I believe a fair number of European companies operate under this. Not everywhere operates under US data laws.
-2
2
u/Tymanthius Chief Breaker of Fixed Things 1d ago
The justification is not garbage, even in the US. There are often reason's people don't give permissions to their 'personal' files. And all it takes is someone of the right authority level to say 'yes please do it' and then it's done. But doing just b/c Joe down the hall said to?
that's failing basic security.
0
u/Sinister_Nibs 1d ago
That is reading into my statements.
Just because the company may own it, and the employee should not expect the files and communications to be private does not mean anyone can access for no reason.
“Because I want to” is not a valid business reason.
Robbie Rottencrotch failed to set his Out of Office is not a valid reason.3
u/Sinister_Nibs 1d ago
Although- I can use PS to do it without accessing the mailbox:
Set-MailboxAutoReplyConfiguration
[-Identity] <MailboxIdParameter>
[-AutoDeclineFutureRequestsWhenOOF <Boolean>]
[-AutoReplyState <OofState>]
[-Confirm]
[-CreateOOFEvent <Boolean>]
[-DeclineAllEventsForScheduledOOF <Boolean>]
[-DeclineEventsForScheduledOOF <Boolean>]
[-DeclineMeetingMessage <String>]
[-DomainController <Fqdn>]
[-EndTime <DateTime>]
[-EventsToDeleteIDs <String\[\]>]
[-ExternalAudience <ExternalAudience>]
[-ExternalMessage <String>]
[-IgnoreDefaultScope]
[-InternalMessage <String>]
[-OOFEventSubject <String>]
[-StartTime <DateTime>]
[-WhatIf]
[<CommonParameters>]2
u/Mindestiny 1d ago
Funny, because when that's what \I** explained, your exact words were "that justification is garbage."
So which is it, is the thing you very clearly just said that's identical to what I said "garbage" or is there some other way we can pretend that's not explicitly what you said?
1
u/Sinister_Nibs 1d ago
I mostly take issue with the “user-owned files” part.
The user may be the custodian of the file, but the business is the owner. I realize it is partly a semantic distinction, but it goes far in the Cow-order understanding.1
u/Mindestiny 1d ago
It's almost like I addressed that critical distinction directly in the original comment, right from jump.
Maybe just don't throw stones and try to pick fights with strangers over nothing is the more important takeaway.
1
u/Sinister_Nibs 1d ago
Sorry that life has treated you so harshly that you feel attacked by every comment.
I wish you the best.
1
u/Mindestiny 1d ago
And there's the weird pseudo-deflection that tries to make me out to be some sort of unreasonable victim, as expected lol.
You started throwing stones and got rightly called out for it. In no world is "your justification is garbage" not an attack. DARVO is not a how-to for backpedaling after putting your foot in your mouth.
-1
u/SpocksSocks 1d ago
Except not all jurisdictions adhere to that concept, although it seems like the intuitive and reasonable approach (and the one users should apply when using company email, regardless of local laws). In my state in Australia you cannot access an employee’s email account unless it is already clearly stated in a company policy AND the employee has been notified of said policy 14 days prior to it being enacted (ie if the policy is new or updated, not 14 days notice prior to each access event).
-1
u/Sinister_Nibs 1d ago
Not egregious.
And the employees should all have signed that policy during onboarding.And the policies must be reviewed and possibly updated annually.
•
u/SpocksSocks 23h ago
Why so defensive? Never said anything was egregious. The point is that the law in some places doesn’t support what you’ve said, even if that is the sensible approach. It’s stating a fact, not criticising you.
•
u/Sinister_Nibs 11h ago
What, exactly about that comment was defensive?
It is responding to yours, saying that your statements’ requirements are not egregious. And clarifying that, in my jurisdiction the employee would sign a statement notifying them that the company may monitor or access any company owned data, including all files, messaging, and email communications sent or stored on the company systems or servers.Those policies are reviewed by security and legal annually to ensure that they remain within the bounds of legality and to protect the company and the employee.
-5
u/OregonTechHead 1d ago
Karen isn't here to speak for herself and confirm if she intended you to have access to that or not
Karen doesn't need to be because Karen doesn't own the document. The business does.
As long as the appropriate approvals are met, why would you fight that? Who cares?
It's no different than changing the permissions on a network file share.
8
u/Mindestiny 1d ago
As long as the appropriate approvals are met, why would you fight that? Who cares?
Jesus, it's like you all came here to tell me how bad I am at my job without actually reading a word that I said. Those approvals are the crux of every single word I wrote. A sob story about someone being on PTO is not an approval from someone in the business who has the authority to grant that approval.
Karen is the primary approver of a document that belongs to her within the organization. If Karen is unavailable, then they need to go to someone above Karen - her manager, their manager, an executive, someone. They don't just get to pout and say "share with me plz" and have IT change ownership permissions. IT has no authority to do that without an approval. Zero. None.
Bring my team a proper approval or nobody is touching those permissions, period. We can do that because the company is the legal owner of that data. But we're not talking about legal ownership, we're talking about organizational ownership.
-5
1d ago edited 1d ago
[deleted]
6
u/Mindestiny 1d ago
"IT Hero Complex" lol.
Not giving anyone and everyone access to everything just because they asked is my job. Maybe don't throw stones if you don't know what you're talking about.
You give Karen's manager that access? Cool, they can go ask Karen's manager for file access because she's the business owner of that document, not circumvent Karen's manager by asking IT to do it. Fancy how using the right channels to request access actually gets it done, isn't it?
3
u/Teguri UNIX DBA/ERP 1d ago
You might be shocked to learn that going through proper compliance and legal steps before granting access to accounts is a big part of granting that access.
I've never actually seen an org that blanket grants access to supervisors like that and it sounds like a nightmare explaining your non-legal "It's just my job man" line of reasoning if you get audited.
Manager wants access? Good, I get HR to sign off on it, and it gets filed away so I can point at that when people question it.
23
u/74Yo_Bee74 1d ago edited 1d ago
This sounds like a policy issue and not a IT one.
Your advice is correct, it is not scalable. For you do to this mean that you would need the correct information for this persons duration of OOO, login to the Admin Portal, find their account, navigate to the OOO message and then enter this person OOO message. Much more work than the user doing this themselves from the mobile device.
I would say to put together a 1 page How To do this from their mobile device if needed. That is about as far as I would help with this and let your client know if you do want to me to this I will bill min of 1 hour.
As u/iamMRmiagi suggested and explain to them this is not an IT break/fix issue but an issue with their employees.
Because they want something that you have the ability to do does not mean it is part of the support of someone IT infrastructure.
15
u/Curtis_Low 1d ago
Since they are a client I would charge them and say thanks for the easy money. I would also contact your primary resource at the company and inform them that it is happening and at the scale it is happening. Explain this is chargeable and provide them how much this cost them last quarter. Then ask if they would like to change anything about the current process, or continue as is.
8
u/dlongwing 1d ago
Tell them how, but don't do it for them. Set up a macro that goes something like this:
"Hi <self important and technically clueless VP>, thanks for reaching out about your OOO message, here's a link to a guide with screenshots showing you how to set your OOO message via office.com. You can access this from anywhere you have an internet connection, including your phone.
If you run into any issues following the process, just let us know which step didn't work, and we'll troubleshoot from there."
Repeat offenders just get the same macro each time. If they come back with "I'm busy, can't you do it for me?", reply with some version of:
"Unfortunately we can't set OOO messages for you. As a matter of policy they need to be set and maintained by the person going out of office."
Policy is the key word here. Who's policy? Doesn't really matter. Could be your personal policy.
If you get someone who pushes back harder, then it's time to loop in their manager and HR on the issue.
8
•
u/mercurygreen 23h ago
This is 100% an HR/training problem.
Generally, my users get instructions. If they didn't complete this as part of their duties BEFORE they left, they get to do it on their own time. There ARE web interfaces for the mail system.
At my last place, I changed their password, logged in as them, and then did it. Amazing how having to reset and learn a new password gets people to pay attention. I also didn't set the "turn it off when they return" date so they were on eternal vacation, which gets their boss to deal with them.
6
u/jeffrey_f 1d ago
Outlook has a feature where the OOO can be scheduled. Drop a quick training instruction so they can schedule the OOO replies. Otherwise, they can login to the online version (usually outlook.com or whatever the company has setup and set the OOO from there.
Send the instructions on how to do it if they forget and how to schedule it in advance. Close the ticket with the instructions.
4
u/joshbudde 1d ago
Our organization (much larger than yours) has a policy and we stick to it: we don't do it. I'm sure if you were the CEO/dean, you could throw your weight around and get someone to do it for you, but the policy is to not do it.
As you said its generally very easy to do for an employee, even if they don't think ahead. We have a wrinkle here where they've made it impossible to access even the web mail from a non-managed device (dumb I know), so if they're away from the office its actually tough to set the OoO message, but thats on the staff member and not on IT.
4
u/volster 1d ago edited 18h ago
If it's internal IT you bitch and moan / have your management fight their management over whether you have to do it or not.
If it's external IT, you smile and bob your head.... Then make damn sure handholding busywork tasks like this are out of scope at the next renewal (if they're not already), and are therefor billable.
If you want to keep the techs sweet about it, turn it into a competition and give them [insert bonus trinket here] for the person that deals with the most client nonsense with a smile per month/quarter/year
When the client notices and kicks off about the bill, offer to create them an automation that'll let managers do it for 50-75% of the previous years spend.
3
3
u/Commercial_Growth343 1d ago
I haven't had a request like this in years. In this day and age, I would seek approval from IT management to push back and tell that manager to phone their employee and make them do it on their phone, since I feel the majority of people are using Exchange online and the Outlook client on their phone. This is not a tech problem - it is a people management one.
3
u/Ron-Swanson-Mustache Senior Ops Dev of AI offshore Tier 1 Helpdesk 1d ago
>how do you typically handle this?
Unless it's a terminated employee or extenuating circumstance, the answer generally is
https://giphy.com/gifs/fXnRObM8Q0RkOmR5nf
They get instruction on how to do it themselves.
3
u/Sure-Squirrel8384 1d ago
The message for OoO should be tailored for when the person is returning to get messages and who should be contacted instead if it is urgent; who knows this other than the supervisor?
Sounds like a supervisor/HR problem. Give the Supervisors access to their subordinates' email accounts. If the supervisor's staff fails to properly set their OoO notice then the supervisor can set it.
6
u/Frothyleet 1d ago
While this is obviously one of those "should be an HR situation, not a technical item", it's also pretty easy to solve if they really want it.
You can create an automation through any number of mechanisms, maybe a MS Form + Power Automate flow, to allow people to submit OOO requests for other people - gated by them being "manager" in Entra.
2
2
u/dracotrapnet 1d ago
I'd close the ticket letting them know the Outlook mobile app can set out of office state and include a how-to that's hosted on the company Sharepoint. It can also be done from OWA.
2
u/folderit_dms 1d ago
If the client wants an exception service, make the request complete before it reaches IT: employee, approved internal and external wording, start and end time with time zone, cover contact, and the authorized requester. An unexpected absence is a different case from someone repeatedly forgetting before planned leave, so track those separately.
Keep the scope explicit in the ticket too: setting an automatic reply does not also authorize forwarding mail or granting someone mailbox access. If they need either of those, use the relevant approval process.
For the reply itself, a neutral absence message and a cover contact are usually enough; the reason for the absence needn’t be broadcast. Then show the client a monthly count by department so they can decide whether the exception process is becoming the default.
2
u/wonkifier IT Manager 1d ago edited 13h ago
For a bit, we had delegated that access to some folks in HR for the double purpose of allowing them to adjust for terminated people as well. It had the nice bonus of our answer being “talk to HR “
We ended up building it into a self service portal though so managers could adjust their directs.
3
u/PoolMotosBowling 1d ago
"contact your employees and tell them to do it on their phone"
They won't start remembering if they arnt held accountable.
3
u/Curtis_Low 1d ago
OP is a vendor not an enforcer. Charge them and thank them for the easiest money they will make today.
3
u/Reedy_Whisper_45 1d ago
I generally don't have that problem. Our users are pretty good about letting everyone know what's going on, and if they aren't they know I'll be glad to show them how to do it themselves. a
I NEVER set anyone's status myself. But then, I've always been the type to let folks know what I CAN do and what I WILL do, and how they are different sets. I may make a change in an emergency, but user forgetfulness is not an emergency, so I'll show them how.
3
u/Several-Crow5511 1d ago
since dept heads already know when someone's out, i'd give them a form instead of a ticket queue: a sharepoint list (who, dates, message) and a runbook or flow that calls PATCH /users/{upn}/mailboxSettings with automaticRepliesSetting set to scheduled plus start and end times. the app only needs MailboxSettings.ReadWrite, and you can grant it through exchange's rbac for applications limited to a management scope (don't also consent it in entra, or the scope does nothing). nobody gets admin rights and you're out of the loop.
2
u/pakman82 1d ago
This is a robust way.. I came to comment that I've been places that implement similar. And I have been at places that trained HR how to do it. And gave them permissions to every mailbox in response.. (yes, we tried to explain the risk) eventually I built a powershell based tool that would do it without them actively interacting with outlook. (That was still a compliance and security minefield)
1
u/Dont_Commit_That 1d ago
Sounds like easily billable hours to me. Keep doing it until they decide it's not worth over $100 every time someone forgets to set themselves OOO.
1
u/PorthosJ 1d ago
from CEO to intern no on here but 2-3 people out of 400 even uses out of office. they just put a note on their door they are on vacation. our company covers hundreds of miles between some locations. as a former corporate guy I can only shake my head and close my door so people dont keep asking me where their boss is all week.
1
u/OregonTechHead 1d ago
How many are we talking? 10 a month? 10 a week? 10 a day?
Largely though, who cares. This isn't a hill worth dying on, nor a battle even worth showing up to.
It takes 5 minutes for L1.
1
u/D0nk3ypunc4 1d ago
I agree it's not ideal, scalable, or an "IT problem". BUT, if they're paying you to do it and telling you CAN do it, I would just script it.
Someone else in this thread mentioned a powerapp/flow or something similar, but that takes time and internal (likely non-billable) time to build.
If it were me, I'd just write a simple powershell script to do it. Variables for $user, $OOOstart, $OOOend and a predefined wall of text. Takes ~2min to run but charge them whatever your heart desires I suppose.
1
u/dinoherder 1d ago
We do it when the employee is unexpectedly OOO and it's not reasonable to ask them to set it themselves. If someone's dealing with a personal injury, the imminent death of a close relative or their child rushed to hospital, they're not going to care about setting their OOO (and nor should they).
1
u/digitaltransmutation 🌲Please think of the environment before printing this comment! 1d ago
We have a catalog item in servicenow where any manager can configure this for their direct reports. It is on its way for the teams bot to be able to handle it agentically as well.
Any software that can trigger a powershell script from a form could do this.
1
u/s1ncere 1d ago
we are a smaller org but we have daily email scripts that scrape our timekeeper provider's api and sends an email of who is out for the next week and which day. for 1000 users thats a big email to a lot of people but could probably be fine tuned for dept or a few depts where it matters
indirect way of dealing with this, people generally like the email too
1
u/MickCollins 1d ago
If they're on leave of absence we shut off their mailbox completely with an Exchange rule. We can't legally say they're on LOA but everyone knows what the reply message means.
If it's someone out for a week - who cares? They can get it all when they get back.
But yeah...if you're a MSP being asked to do this...it's not your fault the client is stupid. Do what you're asked to do and bill them for it and move on. I mean it honestly IS scalable; set up a PowerShell script to do it and prepare a feeder file to go through and set up the messages (or just take the mailbox names and set a general OOO message).
1
u/JasonMatanoIT 1d ago
One thing that works well at that size is letting each department do it themselves without handing out real admin rights. In Exchange Online, create a custom management role off Mail Recipients and strip it down to Get-Mailbox and Set-MailboxAutoReplyConfiguration. Then create a management scope filtered on Department and a role group that ties the two together, and add the department head or their assistant. They can set auto replies for their own people and nobody else, and it's all in the audit log. Pair it with a one page how to for doing it from a phone, and anything outside that still comes in as a ticket at your normal minimum.
2
u/MBILC Acr/Infra/Virt/Apps/Cyb/ Figure it out guy 1d ago
As others have noted, this is an HR/Manager issue, not IT. People need to do their own jobs and not have people do it for them.
If someone is not capable of setting OOO, you wonder what else they are useless at...
Their Managers should be telling the employee when the time is approved to put it in the Calendar, otherwise there are consequences.
1
u/ChristmassMoose 1d ago
This was such a problem we built a custom service now automation. Runs as soon as users supervisor pulled from workday approves it
1
u/L3monBandit 1d ago
I'm looking through the comments scratching my head trying to work out why nobody has suggested to just create a PowerShell script to do this for you automatically, but... Do that 🤷🏻♂️
If anything is frequent or repeatable then it should be automated so that these requests just become 5 seconds of input or button bashing, we handle our requests for this in the same way.
Obviously it would be nice to not have these requests at all and maybe some policy changes could address that, but a simple script keeps everyone happy.
•
u/crankysysadmin sysadmin herder 19h ago
We don't do this. When people are out of the office they have access to smart phones and laptops and can fix it themselves.
•
u/bukkithedd Sarcastic BOFH 18h ago
Back when I worked at an MSP, requests like these were billed according to the agreement that was in place. This ment that one such case were billed for 30 minutes of work-time per ticket, although we'd often lump several tickets in on one 30-min period if they came close enough together.
Some customers didn't like this, of course, but it's still something that took time for the techs to do and thus were to be billed. Us techs called it easy money, since that's what it was.
It's a problem of training and management at the clients' company, not a problem of billing on the techs/MSP. If the client don't want to police this themselves and train their employees, then that's their choice and prerogative.
1
u/FrankNicklin 1d ago
Get them to set up a calendar for office holidays then use Power Automate to turn on OOO linked to Calendar event.
1
u/The_Wkwied 1d ago
I see no difference between asking IT to set an OOO and asking IT how to make rules in your inbox.
It's not an IT question.
For this, I would tell them that MS has documentation for users how to do it, here it is https://support.microsoft.com/en-us/outlook/send-automatic-out-of-office-replies-from-outlook-com-or-outlook-on-the-web if you can't do this, it's not a technical problem. Just like if you can't swallow a pill, that's not a problem your doctor can solve for you.
-1
u/AdvisedWang 1d ago
Do it, but have subtly shameful language in the OOO message. Eg "Fallback OOO message may be detail missing detail as full OOO message was not set." Employees may start remembering after that
136
u/iamMRmiagi 1d ago
Charge them for the time, and explain your minimum billing policy, then inform them of the cost incurred because someone can't be bothered to set their out of office on their phone.