Email management for multiple companies means running the domains, mailboxes and users of every company in a group from a single administration panel, while keeping each company's data strictly separate. Set up properly, a new starter is created in one step, a leaver's access is closed in one step, and no company can read another's correspondence.
Why email fragments across a group of companies
Most groups set up email one company at a time, as each company is founded or acquired. The parent company sits with one provider, the trading arm with another, and the manufacturer acquired later is still on its old server. Each has its own admin account, its own invoice and its own password rules, usually held together by one IT person or an outside support firm trying to remember them all.
The problem shows up when people start working across companies. The finance director keeps an eye on three companies' accounts mailboxes, purchasing requests quotes on behalf of two entities, and staff transfer from one company to another. With every move it becomes a little less clear who can reach which mailbox on whose behalf. The mess usually starts because nobody asked the "several companies" question when choosing a business email platform.
Physical security has exactly the same pattern: firms with several sites struggle to manage door permissions site by site. The need for central control with local separation is what we describe in multi-site access control, and email needs the same design.
What fragmented email administration costs
The first cost is security. According to the Microsoft Digital Defense Report 2025, more than 97% of identity attacks are password attacks. When every company has its own password policy and admin account, the weakest company sets the security level for the whole group.
According to Verizon's 2026 Data Breach Investigations Report, use of stolen credentials held steady as an action in 36% of breaches.
The second cost is forgotten access. Sophos' State of Identity Security 2026 survey of 5,000 IT and security leaders in 17 countries found that 71% of organisations suffered at least one identity-related breach in the past year. When someone moves to a sister company or leaves the group and their old mailbox is never closed, an attacker has one of the easiest ways in; we cover it in detail in offboarding email access.
The third cost is domain security. EasyDMARC's 2026 DMARC Adoption Report found that 52.1% of the 1.8 million domains it scanned have a DMARC record, but only about 23% of all scanned domains enforce a quarantine or reject policy. In a group, if every company's domain, brand domain and legacy domain is not monitored individually, a forgotten domain can end up sending spoofed mail.
One panel, separate data: the core principle
A group needs two things at once: administration done in one place, and data kept apart company by company. Miss the first and administration fragments; miss the second and companies risk seeing each other's mail. The table compares the two approaches.
| Area | Separate system per company | One panel, tenant-based separation |
|---|---|---|
| Admin account | One per company, often a shared password | One identity, permissions per company |
| New starter | Created separately in each system | One step for user and access |
| Leaver | Easy to forget somewhere | All access closed in one step |
| Domains and DNS | Different panels, different people | Every domain in one list |
| Data separation | Separate by accident, unaudited | Each company's data kept apart by design |
| Billing and usage | Piecemeal | Visible per company |
Under Türkiye's data protection law (KVKK), this separation is not just a technical preference. Each group company is a separate legal entity and, as a rule, a separate data controller for the data it processes, so sharing one company's staff or customer data with another, even inside the group, needs its own legal assessment. Our guide to KVKK compliance steps walks through how to make that assessment.
Email management for multiple companies in seven steps
- Build an inventory. List every company's domains, mailboxes and shared addresses (accounts@, sales@) in one table, together with who administers each.
- Define company and department structure. Place people under a company and department, and flag anyone who works for more than one entity.
- Move to a single identity. Each employee gets one identity, and access across companies and products hangs off it. The logic is explained in our single sign-on (SSO) guide.
- Stop sharing passwords on shared mailboxes. Give access to the accounts and sales mailboxes through personal permissions. Our shared mailbox management guide sets out a per-person permission model.
- Complete SPF, DKIM and DMARC on every domain. Include legacy domains that send no mail; they should carry records that reject any mail sent in their name. SPF, DKIM and DMARC explained covers what each record does.
- Write one procedure for transfers and leavers. Access should change the moment HR notifies it, without anyone logging in to several systems.
- Watch for domains that imitate your group. Attackers like to mimic correspondence between sister companies, which makes lookalike domain attacks more dangerous in a group structure.
The first two steps are independent of any software and can be done as a short desk exercise. The remaining steps directly shape which platform you choose; when comparing proposals, factor in the business email pricing factors as well.
Three common mistakes in group structures
Moving everyone onto one domain. Putting every employee on the parent company's domain looks tidy. But customers can no longer tell which legal entity they are dealing with, and that ambiguity causes trouble on invoices, contracts and formal correspondence. Define company-specific email signature templates so each entity appears with its own name and contact details.
Giving the group administrator access to everything. Opening every mailbox of every company to one person "because they run the holding" is hard to defend under KVKK or in an internal audit. Keep the right to administer separate from the right to read content.
Leaving the acquired company for later. The newcomer's old system runs in parallel for months, and leavers are never closed there. Adding its domains and admin accounts to the inventory in the first week of the merger greatly reduces that risk.
How we do this at Digital Bridge
We start multi-company email projects with the group's structure, not with a product:
- Discovery and needs analysis. We map every company's domains, DNS records, mailboxes and admin accounts, and who writes on behalf of which company. Where useful, we combine this with an audit of authentication records under our cyber security consultancy.
- Clarifying data separation. With our data protection compliance team we decide which data stays inside each company and which is reported at group level.
- Piloting with one company. We move one company first, usually the heaviest user of shared mailboxes, and test permission and approval rules on real correspondence. The other companies then follow the same template.
- Connecting to your other systems. If staff and department data in your HR, ERP or accounting software should drive email permissions, we build that link through our integrated systems approach.
Managing a group's email with Smart360
Our own Smart360 family is designed for multi-company use from the start. Several companies (tenants) are managed from one account, and none of them can see another's data; each organisation's data is held in a separate database for each product. Users, departments, product access, domains and DNS, plans, billing and usage statistics all sit in the same panel. With one identity (SmartID), staff move between the email, file management, website agent and access control products (SmartMail, SmartFiles, SmartOperator, SmartPass) without being asked for a password again.
Picture a group with a parent company, a trading company and a manufacturer. The three companies are managed as separate tenants from the same account. The finance director signs in with SmartID and sees the accounts mailbox in SmartMail with the permissions assigned to them; delete and quarantine management are switched off for new assignments. When an employee at the manufacturer moves from sales to purchasing, their department is changed and their access follows across every product; access to the old department's mailbox is removed automatically. When someone leaves, all their access is closed in one step.
SmartMail splits each mailbox into nine separate permissions and keeps an action history on every message. A sensitive message going out in the company's name can be routed to one or more approvers before it is sent. The mobile apps hold several company accounts in one app, so a manager working for two entities does not juggle separate apps. If you want the group's files on the same identity in SmartFiles file management, see our guide to replacing an on-premise file server.
Next step
Start by listing every domain in your group and who holds the admin account for each; forgotten domains and admin accounts with no clear owner often surface in this list. Then get in touch or call +90 552 380 25 25: we will review the inventory with you, arrange a Smart360 demo and prepare a written proposal setting out the scope, phases and cost of the move.
Groups with a trading arm may want to continue with our import export document management guide, and all our email and document guides are collected on the Business Email & Documents page.