Compare Gmail delegation and Microsoft 365 shared mailbox access, separate reading from sending permissions, and build a practical joiner and leaver checklist.
When several people answer outreach email, the team needs a clear way to open the right inbox, send under the intended identity, and remove access when responsibilities change. Passing around one mailbox password makes those decisions harder to keep separate.
Named-user access provides a more deliberate operating model. The details differ between Gmail delegation and Microsoft 365 shared mailboxes, so start with the provider and the organization that owns the address. This guide covers those provider workflows, not a native AllProfiles inbox-sharing feature.
1. Establish the mailbox owner and organization boundary
Record who owns the mailbox, who administers it, and which organization contains the team members who need access. A familiar-looking address is not enough to establish that two accounts belong to the same organization.
Illustrative example: a client asks two agency employees to handle outreach@client.example. Before discussing passwords, the client administrator checks whether those people have eligible accounts inside the client's organization and which access model is available. The address and scenario are examples, not customer records.
Agree on the work too. Does a person need to inspect conversations, send messages, manage content, or supervise handovers? Write down the requirement before selecting a permission with a reassuring name such as Full Access.
2. Understand what Gmail delegation actually grants
Google describes delegates as people who can read, send, and delete email for the account owner. They cannot change the owner's password. A delegate signs into their own account and opens the delegated inbox; delegation is not attached to an alias because an alias is not a Google Account. Invitation acceptance and activation can take time. Gmail delegation guidance
That is broad email-management access. Do not describe this workflow as a read-only invitation or promise separate Gmail switches for each of those actions.
For Google Workspace, administrators control delegation availability. Delegates must be within the same organization, which can include different domains or organizational units. Group delegation has additional settings. Administrators can also control whether sent messages show the owner and delegate addresses or only the owner. Google Workspace delegation controls
An agency employee's existing account in a separate organization is therefore not automatically eligible. Have the mailbox administrator confirm the supported arrangement rather than treating a successful invitation in another product as proof of Gmail access.
3. Keep Microsoft shared-mailbox sign-in separate
Microsoft 365 shared mailboxes support team addresses, with access through users' own licensed Exchange Online mailboxes. The organization needs an appropriate business subscription that includes Exchange Online. Only internal users can use the shared mailbox; an external Gmail user cannot simply be added to it.
Microsoft says shared mailboxes are not intended for direct sign-in and instructs administrators to keep that sign-in blocked. Do not distribute the shared mailbox account's password as the team access method. Storage and advanced features can introduce additional licensing requirements, so confirm the actual setup rather than calling every shared mailbox free. Microsoft 365 shared mailbox overview
For the operating checklist, name the individual users who should open the mailbox and the administrator responsible for reviewing them. Keep account provisioning, license checks, and mailbox permission assignment as explicit setup tasks.
4. Separate reading from sending permissions
Exchange Online distinguishes mailbox access from permission to send. Its documented options have different effects:
| Permission | What it provides |
|---|---|
| Full Access / Read and manage | Open the mailbox and view, add, or remove contents; no sending permission by itself |
| Send As | Send as the mailbox; no reading access by itself |
| Send on Behalf | Send with the delegate identified on behalf of the mailbox; no reading access by itself |
If both sending permissions are assigned, Microsoft says Send As takes precedence. Full Access is broader than read-only access. Exchange Online recipient permissions
Choose the combination that matches the approved work. A team member being able to open an inbox does not, by itself, establish that they can send from it. Likewise, sending permission alone does not establish access to its contents.
5. Test the experience using named accounts
Use an authorized test recipient and a harmless example conversation before putting the workflow into regular use. These are illustrative acceptance checks, not measured customer results:
- The approved team member opens the intended mailbox through their own account.
- The draft uses the expected sender identity and recipients.
- The test recipient sees the intended sender presentation.
- The team can locate the test conversation and continue the agreed handover.
- A user who has not been granted access cannot use the same mailbox workflow.
Record what was tested and who approved it. Do not use a successful test by an administrator as a substitute for testing the employee's actual account. Also check how the team will assign responsibility for an open conversation; shared mailbox access alone is not a complete work-allocation process.
6. Remove access and hand over outstanding work
When someone leaves the team or changes role, review direct grants, relevant group membership, and separate sending permissions. Removing one permission does not mean you have reviewed every access route.
Google's Workspace documentation says disabling delegation does not delete existing relationships; enabling it again can reactivate them. Workspace delegation settings Remove the intended relationships or group access as part of the departure workflow, rather than relying only on a broad off switch. Google's user guidance also explains that an expired owner password may not stop a delegate's access. Gmail delegate access guidance
Before closing the task, move outstanding conversations to an approved owner, review drafts and promised follow-ups, and record the permission changes. Test the resulting access where practical. The useful outcome is a mailbox with named users, an intentional sending identity, and a clear record of who should continue the work.
