Mailbox delegation permissions define who may work in a mailbox that is not their own (an executive's inbox, a colleague's inbox during leave, a team address), with which rights, for how long and on whose approval. Done properly, nobody shares a password: reading, sending and deleting are granted separately, each delegation has an end date, and every action is logged.
This article is about delegated access to individual mailboxes and the lifecycle of that access, not the day-to-day running of team addresses. We cover role design for info@ and accounts@ separately in our shared mailbox management guide.
Where the need for delegation comes from
The situations are familiar: an assistant tracks the managing director's correspondence, a buyer's supplier quotes cannot wait out two weeks of annual leave, a manager picks up customer threads during a colleague's long sick leave, or an internal investigation needs a specific period of email.
Most of these needs are legitimate; the problem is how they are met. The most common method is still "just give me your password". From that moment the delegate can do anything the owner can: read, send, delete, set up forwarding rules. Nobody can tell who did what, and the password rarely changes when the leave ends.
The second classic failure is temporary access that becomes permanent. The assistant changes but the previous one still sees the director's inbox; someone moves department and keeps reading their old team's mail. Over the years, nobody fully understands who can see what.
What uncontrolled access costs
Messy delegation is not a breach in itself, but it creates the conditions that make a breach bigger. Attackers often skip breaking in and simply use an identity that already exists:
According to Verizon's 2026 breach research, use of stolen credentials held steady as an action in 36% of breaches. (Verizon 2026 Data Breach Investigations Report)
When a delegate's identity is compromised, the attacker reaches not just their inbox but every mailbox they have been delegated. In Sophos' The State of Identity Security 2026 survey, 71% of organisations reported at least one identity-related breach in the past year, while only 24% continually monitor for unusual login attempts. In other words, misuse of excess access may well go unnoticed in many organisations.
The picture is not abstract in Türkiye either. According to TurkStat's ICT Usage Survey in Enterprises, 9.4% of Turkish enterprises experienced at least one ICT security incident in 2025, and 5.6% reported data loss or corruption caused by malware or unauthorised access.
Personal data adds another layer. Mailboxes are full of customer, supplier and employee data, and Türkiye's data protection law (KVKK, broadly comparable to the GDPR) applies to all of it. The Turkish Data Protection Authority's 2025 Annual Report shows that of 12,512 complaints and notices it received, 6,506 concerned unlawful processing. Open-ended mailbox access with no recorded reason is hard to defend in that kind of complaint.
A 7-step framework for mailbox delegation permissions
The sequence below turns delegation from a personal favour into a recorded business process:
- List mailboxes and existing delegations. Find out who can open which mailbox and whether that access came from a shared password or a defined permission. Mailboxes whose password is known to several people come first.
- Take passwords out of the picture. Delegates sign in with their own identity; the owner's password is never shared. Multi-factor authentication and single sign-on are the baseline for the identity side.
- Split the permissions. "Access to the mailbox" should not be a single right. Reading, writing and sending, deleting and labelling are granted separately; deleting and changing rules stay with as few people as possible.
- Give every delegation a reason and an end date. For example: "annual leave, 12–23 August, read and reply only". A delegation without an end date quietly becomes permanent access.
- Name the approver. Access to a personal mailbox is approved by the owner or, if they cannot be reached, their line manager, and for sensitive mailboxes also by IT or the data protection lead.
- Treat sending on behalf separately. Letting a delegate send as or on behalf of the owner is the riskiest right. For quotes, payment confirmations and formal letters, add an approval step before the message leaves; our email approval workflow article explains how.
- Review quarterly and close what has ended. Go through every delegation with the mailbox owner and remove anything whose reason has lapsed. For departures, use our offboarding email access checklist.
These steps are the email equivalent of least privilege on file shares, which we cover in our guide to file sharing permissions. At architecture level the same logic sits behind the zero trust security model: no access by default, only by explicit grant.
Which permissions for which delegation scenario?
| Scenario | Read | Write/send | Delete | Duration | Approver |
|---|---|---|---|---|---|
| Executive assistant | Yes | Yes, sensitive items approved | No | Role tenure, reviewed quarterly | Mailbox owner |
| Annual leave cover | Yes | Yes | No | Leave dates only | Line manager |
| Long-term or sick leave | Yes | Yes | No | Until return, checked monthly | Line manager + HR |
| Handover after a role change | Yes | No | No | Until handover is complete | Former line manager |
| Internal investigation / legal matter | Defined period | No | No | For the investigation | Legal + data protection lead |
| IT or security response | As needed | No | No | For the incident | Security lead |
Treat the table as a starting point: deleting is never a default, and every row has an end condition.
Two overlooked rights: forwarding rules and open sessions
A delegation can look right in the permissions table while two side doors stay open. The first is automatic forwarding to external addresses: a "forward everything to my personal address" rule left in place after leave moves company correspondence out of your control. The second is sessions still open on the delegate's devices.
When you close a delegation, check both and end the sessions. We collected the rest of the password policy in business password security.
Accessing an employee's mailbox under data protection law
Article 4 of KVKK (Law No. 6698) requires personal data to be processed lawfully and fairly, for specified, explicit and legitimate purposes, and in a way that is relevant, limited and proportionate to those purposes. A manager's access to an employee's mailbox should be designed around those principles: a written reason, a scope limited to business correspondence and a defined period, and employees informed in advance.
In practice this calls for at least three documents: a policy on the use of corporate email, an employee privacy notice, and a log recording the reason for every delegation. We cover the wider framework in employee personal data under KVKK. Having joiner, mover and leaver events in your HR system drive email permissions completes the picture, so raise integration early when you go through HR software selection.
How we handle this at Digital Bridge
Delegation is an organisational decision before it is a product setting, so we start with your current state, not software.
- Discovery and inventory: We map mailboxes, delegations, shared passwords and external forwarding rules, then prioritise the risks. Findings are reported as part of our cyber security consultancy.
- Policy and privacy notice: We draft rules for access to employee mailboxes, the approval chain and the privacy notice together with our data protection compliance team.
- Pilot: We trial the new permission model in one area, such as management and purchasing mailboxes, and simplify the matrix after the first review cycle.
- Integration: So that role changes and departures flow straight into mailbox permissions, we plan the link with your HR and personnel management system as part of our system integration work.
- Written proposal: Scope, phases and fees are set out in writing; we do not push off-the-shelf packages.
How mailbox delegation works in SmartMail
SmartMail business email, the email product in the Smart360 family, manages shared and personal mailboxes in a single web panel. Here is how it maps to the framework above:
- No passwords handed out. The system generates mailbox passwords, stores them encrypted with AES-256-GCM and never distributes them to staff. Delegates sign in with their own single identity (SmartID).
- Nine permissions per mailbox. View, write and send, delete, label, quarantine, AI re-assessment, AI chat, notes and flag-for-attention are granted individually. Delete and quarantine management are off by default on every new assignment.
- Access tied to the organisation. Leaving a department automatically removes that department's mailbox access, and a department change updates access across all Smart360 products. A leaver's access is closed in a single action.
- Audit trail and session control. Every message carries an action history and each mailbox has an audit log. Sessions are listed with device details and can be ended remotely; changing a password closes all sessions.
- Approved sending. A message going out in the company's name can be submitted for approval by one or more people first. For scheduled messages, permission is checked again at the moment of sending, so a delegate whose rights were removed in the meantime cannot send.
A concrete scenario: the purchasing manager goes on two weeks' leave. Their manager gives a specialist view, write and send, and notes permissions on the purchasing manager's mailbox; delete stays off. The specialist answers quotes, submits order confirmations for approval and leaves notes. On the manager's return, the action history shows who did what, and the permissions are removed in the panel.
For groups running several companies, see how this is separated per company in multi-company email management.
Your next step
Run one check this week: list who can access your executives' mailboxes and when that access was granted. If you find a delegation whose reason nobody remembers, it is time to rebuild your permission model. For wider selection criteria, read how to choose business email, and browse related articles in our business email and documents hub. To plan a pilot with your own mailboxes, get in touch with us.