Is it possible to remove default permissions for group members to mailboxes within that group? For example, so that members of the “allusers” group can view the contents of the group’s Inbox but not access all other mailboxes?
on
It depends on what you mean by “mailboxes.” For calendars, address books and file storage, group membership grants access to a shared resource, and the fine-grained permissions (read-only through full control) are set per resource from the client over JMAP sharing or WebDAV ACL, not as a single global default toggle.
If you mean shared email mailboxes/folders (a group Inbox that all members get default rights to), that is not a built-in feature in the way you describe, so I want to make sure I am answering the right question. Which do you mean, what client are you using, and concretely what should the “allusers” members be able to see versus not?
I was referring to shared mailboxes/file folders that “are automatically available to all members of a group” and “behave just like individual resources but are accessible to all group members”. They are accessible via IMAP, and external WebDAV ACL management has nothing to do with them. (By the way, could you recommend at least one free email client that actually supports WebDAV ACLs?) We haven’t found a way to disable their creation or revoke group users’ rights to them. We can’t create a simple equivalent of a GAL, and only that. If we want to grant rights to an individual user’s address book, we need a group. But when a group is created, shared mailboxes/file folders INBOX, Trash e.t.c. are automatically created for it, with full rights to them for all users in the group. Attempts to remove or replace rights using IMAP-based email clients, such as Roundcube, fail—full rights are restored.