Email Delegation Explained: How to Share Mailbox Access Without Sharing Passwords

At some point, almost every growing business runs into the same situation: one person's inbox has become a shared business resource. A senior executive's email, a sales address, a support account — these don't belong to a single person, but someone needs to manage them. Email delegation is the mechanism that lets you grant another user access to a mailbox without handing over the password, and without creating a new shared account that nobody truly owns.

Done correctly, email delegation keeps workflows efficient, reduces credential sharing, and preserves a clear audit trail. Done carelessly, it creates security gaps and confusion about who is actually responsible for what. Here's how delegation works and how to set it up in a way that serves your team without creating new problems.

What Email Delegation Is and Isn't

Email delegation gives one user the ability to read, send, and in some cases manage another user's mailbox — using their own login credentials. The delegate signs into their own account and accesses the delegated mailbox from there. They don't need the primary account's password at any point.

This is distinct from shared mailboxes, which are standalone accounts designed from the start for team access. Delegation is person-to-person: User A grants User B access to User A's mailbox. Everything the delegate does is attributable to their own account in the system's audit log, not to the primary account holder.

It's also fundamentally different from password sharing, which is what people default to when a proper delegation mechanism isn't in place. Password sharing breaks audit trails, makes credential rotation difficult, and creates a security incident whenever a team member changes roles or leaves the organization.

Common Use Cases for Delegation

• Executive assistants: An assistant manages scheduling, correspondence, and inbox triage on behalf of a senior leader. Delegation lets them reply on the leader's behalf without access to personal messages unrelated to their role.
• On-call coverage: When a team member is out, a colleague can monitor and respond to their inbox without anyone sharing login credentials.
• Compliance and audit access: A compliance officer needs read access to specific accounts for audit purposes without the ability to send as those accounts.
• Sales team oversight: A sales manager monitors their team's outbound correspondence for coaching and review without needing separate accounts per representative.

How Delegation Works Technically

Implementation varies by platform. In Google Workspace, delegation is configured per account in the admin console or by the individual account holder under Settings. The delegate accesses the mailbox through Gmail's account switcher or by navigating directly to the delegated account's inbox URL.

In Microsoft 365 / Exchange, delegation is managed through Exchange permissions. There are three distinct permission levels:

• Full Access: The delegate can read, manage, and organize the mailbox — the most permissive option
• Send As: The delegate sends messages that appear to come directly from the primary account — the primary account's name only shows in the From field
• Send on Behalf: The delegate sends messages and the From field displays both names — "Assistant Name on behalf of Executive Name" — making the delegation visible to recipients

The choice between Send As and Send on Behalf is often a question of organizational preference around transparency. For executive assistants managing high-volume correspondence, Send As keeps the experience seamless for recipients. For compliance-sensitive situations where visibility into who actually sent the message matters, Send on Behalf creates a clear record.

Applying the Principle of Least Privilege

One of the most important aspects of setting up delegation is granting only the access the delegate's role actually requires. The temptation is to grant Full Access because it's the simplest configuration — but Full Access to a mailbox includes the ability to delete messages permanently, which a read-only auditor shouldn't have.

Map the permission level to the role:

• A compliance auditor reviewing correspondence needs read-only access
• An assistant covering outbound replies needs Send As or Send on Behalf, but not necessarily Full Access
• An on-call team member covering an inbox temporarily may need Full Access to manage incoming work appropriately

Give each delegate the minimum permissions that let them do their job. If the role expands later, access can be added. Starting with overly broad access and trying to reduce it later is harder to manage cleanly.

Setting Up Delegation Step by Step

Google Workspace (Gmail)

1. Open Gmail and go to Settings (gear icon) > See all settings > Accounts tab
2. Under "Grant access to your account," click "Add another account"
3. Enter the delegate's email address and confirm
4. The delegate receives an acceptance email and the delegated account appears in their account switcher

Admins can also configure delegation in the Google Admin console without requiring action from the primary account holder.

Microsoft 365 / Exchange

1. Open the Exchange Admin Center and navigate to Recipients > Mailboxes
2. Select the mailbox and click Manage mailbox delegation
3. Add the delegate to the appropriate permission level (Full Access, Send As, or Send on Behalf)
4. Changes typically take 15–60 minutes to propagate across the environment

Reviewing and Revoking Delegation

Delegation should be reviewed periodically and revoked promptly when it's no longer needed. When someone changes roles, moves to a different team, or leaves the organization, all delegation access they hold should be removed the same day.

Maintaining a simple record of active delegations — who has access to what and why — makes periodic reviews straightforward and avoids the common situation of finding delegations that were granted years ago and never removed. These orphaned access grants are security risks hiding in plain sight in most organizations' email systems.

For help setting up email access management for your team, including multi-user inbox configurations and access controls, visit MailDog's mail service or the documentation. The MailDog support team can help you work through the right configuration for your organization's specific needs.