How to Configure Google Workspace Email Delegation via GAM

The Delegation Challenge

In a corporate environment, executive assistants frequently need access to their manager’s email inbox to schedule meetings and reply to high-priority messages. In Google Workspace, this is handled via Email Delegation. The executive can grant their assistant delegate access, allowing the assistant to read and send emails on their behalf without sharing their actual password.

While an individual user can configure this directly within the Gmail web interface, they often forget, or they do it incorrectly. For a system administrator managing hundreds of executives, logging into each individual account to manually set up delegation is impossible. Furthermore, Google does not provide a native way to bulk-assign delegates via the Admin Console GUI.

To overcome this limitation and automate the process, administrators use GAM (Google Apps Manager), a powerful open-source command-line tool that interfaces directly with the Google Workspace APIs.

Step 1: Installing and Authenticating GAM

If you have not already installed GAM, you must download it from its GitHub repository (jay0lee/GAM) and authorize it. The authorization process requires you to create a project in the Google Cloud Console and grant it domain-wide delegation for the Gmail API.

Once GAM is installed and authenticated, you execute commands from your local command prompt or terminal.

Step 2: Granting Delegate Access

Suppose the CEO ([email protected]) needs to grant email access to their new assistant ([email protected]).

Open your terminal and run the following GAM command:

gam user [email protected] delegate to [email protected]

GAM will execute the API call instantly. The next time the assistant logs into their own Gmail account, they will see a small arrow next to their profile picture in the top right corner. Clicking that arrow will reveal the CEO’s inbox, which they can open in a new tab.

Step 3: Removing Delegate Access

If the assistant moves to a different department, their delegate access must be immediately revoked to ensure the CEO’s privacy.

Run the deletion command:

gam user [email protected] delete delegate [email protected]

The access is revoked instantly. If the assistant currently has the CEO’s inbox open in a browser tab, they will receive a “You no longer have access to this account” error upon their next click.

Step 4: Auditing Current Delegates

During a security audit, you may need to generate a report showing exactly who has access to the CEO’s inbox. Since this is invisible in the standard Admin Console, GAM is essential.

gam user [email protected] show delegates

The terminal will output a clean list of every email address that currently holds delegate rights. To audit the entire company at once and output the results to a spreadsheet, you can leverage GAM’s bulk reporting features:

gam all users print delegates > C:\Audit\AllDelegates.csv

This single command will iterate through all 10,000 employees in your directory, query the Gmail API for their delegate configurations, and compile the massive dataset into a clean CSV file, turning a week-long manual audit into a 5-minute task.