Exchange Online - Default and Anonymous permissions access?

Question

Hi Folks,

I am trying to research what exactly Default and Anonymous means when giving permission in Outlook and Exchange Online.
Specifically:
If I give Default owner rights to my inbox (as a user from outlook), does that mean that anyone in my organization (or beyond) has access to do whatever they want?
If I give Anonymous account owner rights to my inbox (as a user from outlook), does that mean that anyone in my organization (or beyond) has access to do whatever they want?

Also, trying to understand the difference between Default and Anonymous.

Does anyone have a good explanation or link about it?

Answer 1

Default = Default Permission set on that folder for authenticated users
Anonymous = Permission set for external, non-authenticated users

You don't want to change those defaults typically for a user mailbox.

If you were to set Default to Owner, any user in your org could, in theory, open your inbox and have full access to it.
Same with anonymous.

Its not common to delegate any folder but your calendar. Often, users set their calendar to Default Reviewer so anyone in the org can view it.
Delegates who need higher permissions are then added explicitly.

Answer 2

Agree with what Andy said:

Default is for users that authenticated with the domain but don't have specific permission.

Anonymous is for users that not authenticated with the domain.

Answer 3

These setting are awful security policy's, Microsoft does not allow you to remove the Default or Anonymous permission on an Exchange Online mailbox? Wow just WOW If Joe user wants to open his Inbox to the world I guess organizations can't stop them. No DLP no nothing. Corporate data exposed because Joe user opens it up to the world. I can't believe you can't control this as an admin or an organization. This is atrocious security.