How to Configure Email Delegations, Shared Mailbox Access, and Send As Permissions in Gmail

Executive assistants, departmental customer support desks, and legal administrative teams frequently require continuous visibility into corporate mailboxes without sharing master account passwords or breaching Multi-Factor Authentication (MFA) protocols. Sharing raw account credentials exposes personal authentication tokens, compromises account accountability in audit logs, and violates enterprise compliance mandates. Google Workspace addresses this collaborative operational demand through native Email Delegation and Shared Mailbox architectures.

Email Delegation grants designated colleagues access to read, send, and manage messages on behalf of a primary account holder while preserving strict identity boundaries. When a delegate sends an email, Gmail transparently appends metadata certifying that the message was transmitted by the delegate on behalf of the principal user. Alternatively, organizations can construct Collaborative Inboxes via Google Groups to provide departmental ticketing and triage. This guide provides an operational handbook for configuring Gmail email delegation, accepting and verifying delegate access, structuring “Send As” custom aliases, and governing delegation policies via the Google Workspace Admin Console.

Architectural Overview: Email Delegation vs Collaborative Inboxes

Choosing the correct collaborative model depends on whether access is tied to an executive individual or a generalized departmental queue:

Operational Metric	Gmail Email Delegation	Google Groups Collaborative Inbox
Underlying Identity	Bound to an individual licensed Google Workspace user account	Bound to a Google Group address (No dedicated license required)
Maximum Concurrent Users	Up to 1,000 delegates (typical limit 40–100 concurrent active sessions)	Unlimited group members across the entire domain
Sender Attribution	Displays: [email protected] (sent by [email protected])	Displays group alias or individual member identity depending on group rules
Access to Other Google Apps	Strictly isolated to Gmail and Contacts; zero access to Drive, Keep, or Calendar	Group interface only; manages tickets, assignments, and resolution tags
Licensing Cost	Requires a paid Workspace license for the primary delegator	Free; consumes zero additional Google Workspace user seat licenses

Prerequisites and Environment Verification

• Google Workspace Edition: Business Starter, Standard, Plus, or Enterprise editions. (Personal consumer @gmail.com accounts support up to 10 delegates; Workspace accounts support up to 1,000).
• Administrative Policy: Email delegation must be explicitly enabled at the domain or Organizational Unit (OU) level within the Google Workspace Admin Console.
• Account State: Both the delegator and delegate accounts must be active and reside within the same Google Workspace tenant (unless cross-domain delegation is permitted).

Step 1: Enabling Email Delegation in the Admin Console

Before individual users can delegate their mailboxes, domain administrators must authorize the capability:

1. Sign in to the Google Workspace Admin Console (admin.google.com) using Super Admin credentials.
2. Navigate to Apps → Google Workspace → Gmail.
3. Scroll down and click User settings.
4. Select the target Organizational Unit on the left panel (e.g., Executive Management).
5. Locate the Mail delegation setting.
6. Check the box for Let users delegate access to their mailbox to others in the domain.
7. Under Sender information shown to recipients, select your enterprise policy preference:
   • Show the account owner and delegate who sent the email: Maximum transparency (e.g., CEO <[email protected]> sent by Assistant <[email protected]>).
   • Show the account owner only: Clean corporate appearance; strips delegate attribution from standard email headers.
8. Click Save. Allow up to 24 hours for domain policy propagation.

Step 2: Assigning a Delegate from the Primary Gmail Account

Once administrative permissions are granted, the delegator authorizes delegates directly within their Gmail interface:

1. Open Gmail (mail.google.com) on desktop.
2. Click the Settings gear in the upper-right corner and select See all settings.
3. Select the Accounts and Import (or Accounts) tab.
4. Locate the Grant access to your account section.
5. Click Add another account.
6. In the modal window, enter the corporate email address of the delegate (e.g., [email protected]) and click Next Step.
7. Click Send email to grant access.
8. Configure the read status behaviour:
   • Mark conversation as read when opened by others: Marks the message unread for no one once the delegate views it.
   • Leave conversation unread when opened by others: Preserves unread status so the executive knows which emails require personal review.

Step 3: Accepting and Accessing the Delegated Mailbox

The invited delegate must verify the authorization request before access activates:

1. The delegate opens their own personal Gmail inbox and locates the confirmation email from Google.
2. Click the verification link contained within the email to accept the delegation request.
3. Google processes the association. (Activation typically completes within 30 minutes, though Google notes a theoretical window of up to 24 hours).
4. Opening the Delegated Account:
   • The delegate refreshes their Gmail web client.
   • Click your Profile avatar in the top-right corner.
   • The delegated mailbox appears listed under Delegated accounts.
   • Click the account name. A dedicated browser tab launches, loading the delegator’s inbox.

Step 4: Configuring “Send As” Custom Aliases and Shared Addresses

For departmental addresses (e.g., [email protected] or [email protected]), users can configure “Send As” permissions to dispatch emails using the shared identity:

1. In Gmail, go to Settings → See all settings → Accounts.
2. Under Send mail as:, click Add another email address.
3. Enter the shared departmental display name and email address.
4. Ensure Treat as an alias is checked if you want inbound replies routed to your primary inbox.
5. Click Next Step → Send Verification.
6. Access the shared mailbox, open the confirmation message, and enter the verification code.
7. When composing a new message, click the From dropdown selector to toggle between your personal address and the shared department alias.

Capabilities Matrix: What Delegates Can and Cannot Do

Operational Capability	Permitted for Delegate	Technical Security Boundary
Read and search emails	Yes	Full access to Inbox, Sent, Archive, and Labels.
Send new emails & replies	Yes	Sent messages populate the delegator’s Sent folder.
Delete emails (Move to Trash)	Yes	Can delete emails; items remain in Trash for 30 days.
Manage contacts	Yes	Can edit the delegator’s Google Contacts entries.
Change account password	No	Zero access to account security or recovery credentials.
Manage 2-Step Verification	No	Zero access to MFA tokens, security keys, or app passwords.
Chat via Google Chat	No	Delegates cannot send instant messages or enter Chat rooms.
Access Google Drive or Docs	No	Strictly isolated to Gmail; zero Google Drive entitlements.

Troubleshooting Gmail Email Delegation Issues

Issue 1: “You cannot delegate access to this account” Error

Root Cause: The Google Workspace administrator has disabled delegation for the delegator’s or delegate’s Organizational Unit, or the accounts belong to distinct external Workspace tenants.

Remediation: Check Admin Console settings under Apps → Google Workspace → Gmail → User settings → Mail delegation. Ensure both user accounts reside in an OU where delegation is permitted. Cross-domain delegation is blocked by default unless external tenant sharing is explicitly whitelisted.

Issue 2: Delegate Mailbox Fails to Appear Under Profile Avatar

Root Cause: The delegate did not click the confirmation link in the verification email, or the background provisioning queue is still pending.

Remediation: Verify that the confirmation link was clicked. In the delegator’s settings (Accounts → Grant access to your account), check the status next to the delegate’s email. If it reports “Pending”, resend the invite. If it reports “Accepted”, perform a hard browser refresh (Ctrl + F5) or clear the browser cache.

Issue 3: Inbound Messages to Delegated Account Trigger Notification Flood

Root Cause: Mail filters or forwarding rules were unintentionally set up to duplicate incoming messages to the delegate’s personal address.

Remediation: Open the delegator’s Settings → Forwarding and POP/IMAP. Ensure forwarding is disabled. Delegates should access emails by opening the delegated tab rather than establishing automated forwarding pipelines.