Delegated Access in Google Workspace

 

Guide to grant delegate access for a user into another’s Google Workspace inbox

Organizations find themselves in situations where some employees may need to access emails and act on behalf of others employees. For example, a senior executive with a Personal Assistant (PA) may choose to grant the PA the ability to access their emails as well as reply/action on their behalf. This is delegated access and when such scenarios arise, naturally, executives find themselves easily giving their passwords and credentials to the PA. 

 

 

But this is wrong; because giving the password grants the PA full scope access to the executive’s applications over and beyond email. This could result in the PA accessing information/data that is not within their access levels. More so, this introduces a secondary level of weakness to compromising the executive’s account.

 

Enter Google Workspace mail delegation: a mechanism that simply grants access to the email data scope and nothing else to the PA in this scenario. And there is a clear audit trail such that the executive, can revoke such delegated access to the delegate- such as the PA at any time! So let’s take a look at how you can set delegation and how it’s accessed by both delegator and delegatee in Gmail.

 

1. Delegating access in Google Workspace Gmail

Google Workspace gives users who have a very busy schedule the ability to delegate access to their email inbox, to other people/ users. For example, a CEO assigning his P.A delegated access to his emails. Google Workspace gives you the ability to delegate access to your inbox for up to 25 users. The delegates will be able to:

  1. Send or reply to emails that were sent to you.

  2. Read messages sent to you

  3. Delete messages sent to you

Delegates however can’t be able to do things like:

  1. Chat with anyone for you.

  2. Change your Gmail password.

 

Setting up Email Delegation for your Google Workspace Domain.

Mail delegation must be enabled in the Admin Console for your Google Workspace domain.

If it’s not enabled, have your Google Workspace admin enable mail delegation from the Admin console by:

  • Sign in as a Google Workspace Administrator by login in at admin.google.com

  • Click on App then under Google Workspace select Gmail.

  • Click on User Settings and navigate to Mail delegation. By default the Mail delegation is off within your Google Workspace Domain. Select an organizational unit on the left, or select the top-level organizational unit to turn on mail delegation for your entire organization.
  • Select the checkbox again Let users delegate access to their mailbox to other users in the domain to enable Mail delegation.

Select Allow users to customize this setting. To allow users to set the delegates for their mailbox from there end.Google Workspace gives users who have a very busy schedule the ability to delegate access to their email inbox, to other people/ users. For example, a CEO assigning his P.A delegated access to his emails. Google Workspace gives you the ability to delegate access to your inbox for up to 25 users. The delegates will be able to:

  1. Send or reply to emails that were sent to you.

  2. Read messages sent to you

  3. Delete messages sent to you

Delegates however can’t be able to do things like:

  1. Chat with anyone for you.

  2. Change your Gmail password.

    Mail delegation must be enabled in the Admin Console for your Google Workspace domain. If it’s not enabled, have your Google Workspace admin enable mail delegation from the Admin console by:

    • Sign in as a Google Workspace Administrator by login in at admin.google.com

    • Click on App then under Google Workspace select Gmail.

    • Click on User Settings and navigate to Mail delegation. By default, the Mail delegation is off within your Google Workspace Domain. Select an organizational unit on the left, or select the top-level organizational unit to turn on mail delegation for your entire organization.

    • Select the checkbox again Let users delegate access to their mailbox to other users in the domain to enable Mail delegation.

    Select Allow users to customize this setting. To allow users to set the delegates for their mailbox from their end.

  • You can specify what sender information is included in the email header of messages sent by the delegate by either selecting against  
  1. Show the account owner and the delegate who sent the email: The header includes the email addresses of the Gmail account owner and the delegate.
  2. Show the account owner only: The header includes the email address of the Gmail account owner only. The delegate’s email address is not included.
  • Click Save once done. Now all users within your Google Workspace domain can delegate access to their mailbox to other users in the domain.
    Note: The changes may take up to 24 hours to propagate to all users
 

2. Delegating Email access to other users

Each user who wants to delegate mail access to another user within the domain must do so from the comfort of their own inbox personally. 

  • Click on the cog icon in the top right-hand corner of your inbox and go to See all settings.
  • Select the Accounts tab and scroll down to the Grant access to your account section.
  • Click on the Add another account link.
  • A pop-out tab will appear for you to add the Google email address of the person you would like to access your Gmail mailbox.
  • Specify the user you would like to grant access to your mailbox by adding his/her email address and click Next Step.
  • You will be asked to confirm if this is the user’s email address by sending a confirmation message to that email address. Click on Send email to grant access.
  • Your appointed delegate will receive a confirmation email and will also need to confirm. It may take up to 30 minutes for the verification to complete. It may take up to 24 hours for you to see them as a delegate after they confirm.

Note: The invitation expires after a week.

  • Once confirmed the delegated email address will appear under Grant access to your account.
    •  

The delegate can now access your account by clicking on their email address. Any emails they do send will still be under your name but with also the delegate’s (i.e. Your Name (Sent by Delegate) like in the example below.

Email sent by the delegate on behalf of the owner’s mailbox

Act as a delegate in Gmail via Web for a Google Workspace

As a user who has been assigned as a delegate to another user’s mailbox you can access their inbox after login into your Gmail account. In the top right of their navigation bar – the assigned email address will appear under your profile. As a user who has been assigned as a delegate to another user’s mailbox, you can access their inbox after login into your Gmail account. In the top right of their navigation bar – the assigned email address will appear under your profile.

By clicking on the delegated email address the inbox will open in another Chrome window. 

  • From there you can read, send, reply and delete emails sent on behalf of the account owner as a delegate.

Let’s take a look at what a “delegate” can and can’t do.

A delegate can:

  • View your inbox;
  • Reply to emails on your behalf; All emails that a delegate sends/replies on your behalf appear on the” mailbox owner” sent items.
  • Manage your contacts
  • Delete your emails. 

A delegate can’t:

  • Change your password
  • Change your Gmail settings
  • Send and reply to chat messages. 

To remove delegate access account

  • Click on the cog icon in the top right-hand corner of your inbox and go to See all settings
  • Select the Accounts tab and scroll down to the ‘Grant access to your account section.
  • Click delete on the account you would like to remove.
  •  

 

Remove delegated access to a mailbox in Gmail

3. Delegate access to your calendar

Google Workspace gives users who have a very busy schedule the ability to delegate access to their calendar so as to schedule meetings, view when one is busy, etc.

 

Delegate Access to Your Calendar to Google Calendar

You can give others full permission to administer your calendar. We don’t recommend that you give full permission to many people or groups.

  • On your computer, open Google Calendar.
  • On the left, find the My calendars section. You might need to click it to expand it.
  • Point to the calendar you want to share.
  • Click MoreMore Settings and sharing.
Delegating Access to Calendar
  • Under Share with specific people, click Add people.
  • Enter your new delegate’s email address. This is mostly someone within your organization such as your P.A.
  • Under Permissions, click Make changes and manage sharing. Since we want the delegate to always schedule meetings for you.

When you share your calendar with someone, you can decide how they find your events and whether they can also make changes like adding or editing events. Here’s what people can do with each sharing option:

  1. Make changes & manage sharing
  • Change sharing settings
  • Add and edit events
  • Find details for all events, including private ones
  • Find the time zone setting for the calendar
  • Permanently delete the calendar 
  • Restore or permanently delete events from the calendar’s Trash
  • Subscribe to email alerts when events are created, changed, cancelled, RSVPed to, or are coming up

 Make changes to events

  • Add and edit events
  • Find details for all events, including private ones
  • Find the time zone setting for the calendar
  • Restore or permanently delete events from the calendar’s Trash
  • Subscribe to email alerts when events are created, changed, cancelled, RSVPed to, or coming up
  • Find all event details

  • Find details for all events except those marked as private
  • Find the time zone setting for the calendar
  • Subscribe to email alerts when events are created, changed, canceled, RSVPed to, or coming up
  • Find only free/busy (hide details)
  • Check when your calendar is booked and when it has free time, but not the names or other details of your events.

All these permissions by default are only available to people within your organization, this is due to security and privacy reasons as some of the settings can lick out sensitive meeting and calendar information.

But if you intend to share your Calendar with people outside your organization (that have a different domain name), the Google Workspace admin must enable what rights can be granted to people outside your organization. By following these steps:

  • Sign in as a Google Workspace Administrator by login in at admin.google.com
  • Click on App then under Google Workspace select Calendar.
  • Under Settings for Calendar select the dropdown under Sharing Settings to access External Sharing options for the primary calendar
  • Select either of the following options, but be very cautious as to what you want your team to share outside the organization as this may lead to privacy issues.
  • Once done click Save.

  • Once you are satisfied with the control or permissions you want to assign to the delegate Click Send. Your appointed delegate will receive a confirmation email and will need to add the delegated calendar as part of the calendars they manage. Once done the calendar of the delegate appears within Google Calendar under My Calendars or Other Calendars depending on the permissions granted to them.

 

Note: Events from Gmail that have the “Only me” visibility setting aren’t visible to anyone you’ve shared your calendar with, even people with “Make changes” access unless you change the sharing settings for the event or the default setting for events from Gmail.

 

After adding this calendar to your other calendars as a delegate, you can hide or completely remove it whenever you want. By hovering over the desired calendar you want to remove and clicking Unsubscribe.

All managed calendars appear in Google Calendar

Unshare your calendar

  1. On your computer, open Google Calendar.
  2. On the left, find the My calendars section. You might need to click it to expand it. 
  3. Point to the calendar you want to unshare, click More Settings, and sharing.
  4. Under Access permissions, turn off Make available to the public.
  • To stop sharing with specific people: Under Share with specific people, next to the person you want to remove, click Remove.