Gsuite Delegate Mailbox Access

[timbo343]

Whilst testing Gsuite before moving all mailboxes over from Office365, i thought i would look at mailbox delegate access for our shared mailboxes that we currently have in Office365 (Office365 make this process really easy!) rather than users sharing passwords for shared mailboxes such as the admin@ mailbox.

 

I have created a test GSuite email account (test1) and Granted access to another account (test2) access to Test1 account. The invitation email has landed in test2 mailbox and can see in test1 settings that this has been accepted however within test2's account i cannot see the additional account when clicking on test2's initial from the top right of the window which should display the delegated accounts test2 has access to.

 

Looking at all the articles online, it looks simple to do yet it doesn't work when following the instructions.

 

Am i missing something?

[PrimaryNetMan]

Gona be a silly question but are you in GMail when clicking the initial from the top right of the window? Also make sure it's the browser initial and not the Chrome User sync icon.

 

If you use GAM you can just delegate accounts without the need for sending invitations.

[RLR]

Should work pretty instantly. Maybe try signing out and back in?

 

If you're moving to G Suite, I'd second what PrimaryNetMan has said and look into using GAM.

[timbo343]

Gona be a silly question but are you in GMail when clicking the initial from the top right of the window? Also make sure it's the browser initial and not the Chrome User sync icon.

 

If you use GAM you can just delegate accounts without the need for sending invitations.

 

Will have a look into GAM later on - thanks.

 

In reply to your question, test2 account is in GMail and we are clicking on the initial that is in the browser, next to the 9 dots which show the GSuite apps. It's only showing Add another account which is where, i presume, the delegated account should be?

[mowgli82]

are the accounts in different OU's? I was told by google that you had to allow "allow users to delegate mailboxes" on the OU of the account you want to delegate the and OU of the account that will be viewing the mailbox.

[Arthur]

Will have a look into GAM later on

I'm not sure if the following also applies when you are not using GAM?

 

https://github.com/jay0lee/GAM/wiki/ExamplesEmailSettings#creating-a-delegate

 

Gives email and contact access for the given users (the delegators) to the specified delegate account. Unlike when users request delegate access via Gmail settings, no email will be sent to the delegators for approval, the approval occurs immediately. The delegate and the delegator must be in the same domain, granting delegate access across multiple domains is currently not possible.

 

Both the Gmail delegator and the delegate:

 

• Must be active. A 500 error is returned if either user is suspended and disabled.
  
• Must not require a change of password on the next sign in. A 500 error is returned if either user has this flag enabled in the control panel, or, using the Provisioning API, the changePasswordAtNextLogin attribute is true.
  

You can confirm these settings using the gam info user command. Both "Account suspended" and "Must change password" should show false for both the delegate and the delegator.

 

Example

This example gives jbezos access to the contacts and email of the sales account.

 

gam user sales delegate to [email protected]

[bald_pig]

Can't say I've seen any issues, we also use the outlook tool for some users, and delegated mailboxes show up there fine as well.

[timbo343]

are the accounts in different OU's? I was told by google that you had to allow "allow users to delegate mailboxes" on the OU of the account you want to delegate the and OU of the account that will be viewing the mailbox.

 

That was my next thought and quite rightly, i've created another user (test3) which is in the same OU as test2 and now works as expected.

 

So am i right in thinking that the permission under APPS > GSuite > *Relevant OU* > User Settings > Mail Delegation needs to be enabled first for all the users that would like to see other mailboxes and on the OUs where the "shared Mailboxes" are stored? If this is the case, can this not be done on a per user basis rather than an OU basis otherwise this will have to be enabled for pretty much everyone and then the users will be able to delegate their own mailboxes to others. This is not what i am wanting to happen.