KoltrixWho saw what: auditing access to a shared mailbox
A shared mailbox gathers access over time. How to list who can open it, review that quarterly, decide what to log and respond when something looks wrong.
On this page(9 sections)
- Why shared mailboxes drift
- Step one: write down who has access, and how
- Step two: ask three questions about each person
- Step three: check the people who are no longer here
- Step four: decide what to record
- Step five: handle sensitive threads on purpose
- A review calendar that is small enough to keep
- When something looks wrong
- Key takeaways
When a shared mailbox is new, everyone who can open it is obvious: the three people who set it up. A year later, nobody can say for certain who has access. A contractor who left in spring still has a login. Someone moved to another team and kept their permissions. A former colleague's old forwarding rule still copies mail to a personal address.
None of this is dramatic on its own. But shared mailboxes hold some of the most sensitive material a company has: customer problems, invoices, contracts, password reset messages and the occasional card number someone should not have sent. An access review is the routine that keeps the list of people matching the list of people who ought to be there.
This guide is a practical method for small teams. It does not need special tools, only a regular habit, a few clear questions and a decision about what to record.
Why shared mailboxes drift
Access grows quietly, for ordinary reasons:
- Temporary help becomes permanent. Someone is added for a busy week and never removed.
- Role changes do not trigger cleanup. A support lead becomes a product manager and keeps full access to support mail.
- People leave and some access survives. Not the main login, which IT disables, but forwarding rules, delegated access, saved sessions, app passwords and connected apps.
- Group and alias membership changes are invisible. Adding someone to a group alias can give them mail without touching the mailbox itself. See shared inbox vs distribution list vs group alias.
- Integrations hold their own access. A helpdesk tool, a CRM or an AI assistant connected to the mailbox can read mail, and it does not show up in a list of people.
Step one: write down who has access, and how
Start with a plain inventory. For each shared mailbox, record every route to its contents:
| Route | Question to answer |
|---|---|
| People with direct access | Who, and at what level (read, reply, manage)? |
| Group or alias memberships | Which groups deliver to it, and who is in each? |
| Forwarding rules | Does any rule copy mail elsewhere, and to whom? |
| Connected apps and integrations | Which tools can read or send, and who authorized them? |
| Shared credentials | Is there a single login that several people know? If so, who? |
| Admins | Who can change access or settings for the mailbox? |
The last-but-one row matters most. A shared password makes it impossible to say who did anything, and it should be replaced with named access wherever you can. Per-mailbox permissions: a design guide explains why access per person and per mailbox is the safer design.
Step two: ask three questions about each person
For every entry, answer:
- Do they still work here, or still work on this? If not, remove them.
- Do they need this level? A person who only reads should not be able to send or manage. Move people down to the least access that lets them do their job. See least-privilege AI email agents for the same idea applied to software.
- Is there a record of why they have it? If nobody can explain it, treat it as an error until someone can.
Write the outcome next to each name: keep, reduce or remove. Make the changes the same day, because a review that produces a list nobody acts on is worse than none.
Step three: check the people who are no longer here
Offboarding is where most surprises sit. For anyone who has left or changed role in the last year, confirm:
- Their access to every shared mailbox is gone.
- Group and alias memberships are removed.
- Forwarding rules from their mailbox, and rules pointing to them, are removed.
- Connected apps they authorized are revoked or re-authorized under a current owner.
- App passwords and sessions on devices are revoked.
- Anything that used their address as a login for a service is updated.
Offboarding a teammate from shared email is a full checklist, and contractor access to team email covers people who are outside the company and should have an end date from the start.
Step four: decide what to record
An audit is only as good as the records behind it. You do not need to log everything, but you should know what you can answer when someone asks.
Useful questions a log should answer:
- Who was given or lost access, when, and who changed it?
- Who sent a message from the shared address?
- Who changed a rule, a forwarding setting or a connected app?
- Who exported mail or downloaded large amounts?
- Which sign-ins came from unusual places or devices?
Questions that are harder, and worth being honest about:
- Who read a particular message? Many mail systems do not record every read. If you rely on being able to answer "did anyone open this?", check what your system really keeps before you promise it.
- What did an integration read? An assistant or tool may log its actions or may not. Auditing AI assistant mailbox actions covers what to ask of them.
Decide how long to keep logs, who may read them and how they are protected. A log of who read sensitive mail is itself sensitive, and reading someone's activity record should be limited to the people who need to do that job.
Step five: handle sensitive threads on purpose
Some conversations should not be visible to everyone with access to the mailbox: a payroll question, a harassment complaint, a legal letter. Options, in order of preference:
- Keep them out of the shared mailbox. Give people a separate address for sensitive topics that reaches only those who need it.
- Move them to a restricted mailbox or folder as soon as you recognize them.
- Mark and agree a rule: who may open conversations with a particular label, and who is told.
A rule only works if people know it. Put it in the team's one-page guide, as suggested in shared inbox ownership rules.
A review calendar that is small enough to keep
Every quarter, for each shared mailbox, set aside thirty minutes:
- Export or list everyone with access, by every route in the table above
- Compare it with the current list of staff and contractors
- Remove, reduce or confirm each entry, and write down the decision
- Check forwarding rules and connected apps
- Confirm two-factor sign-in is on for every person (rolling out 2FA across the team)
- Review the last quarter's access and settings changes for anything unexpected
- Record the date, the reviewer and what changed
Add the same check to your offboarding list and to the start of any large project, so surprises are caught between reviews.
When something looks wrong
If you find access that nobody can explain, or evidence that mail was read or copied by someone who should not have had it:
- Remove the access first. Revoke sessions and app passwords too.
- Preserve the evidence. Keep the relevant logs before anything rotates out.
- Establish the scope. Which mailboxes, which period, what kind of mail?
- Tell the right people. Depending on what was in the mail, that may include customers, your privacy lead or a regulator. Do this with advice if personal data may have been exposed.
- Fix the cause. A missing offboarding step is a process problem, not only a one-off.
- Record what happened in plain terms, so the next review starts from it.
Stay factual. The point of an audit is to find gaps, not to blame people for access they were once given on purpose.
Key takeaways
- Shared mailbox access accumulates through temporary help, role changes, leavers, groups, forwarding and connected apps.
- Inventory every route to the mailbox, not only the list of named users, and replace shared passwords with named access.
- For each person ask whether they still need it, at what level and why, and act on the answers the same day.
- Decide what you log and be honest about what you cannot answer, such as exactly who read a message.
- Review quarterly in thirty minutes, check leavers and integrations first and keep sensitive conversations out of broad mailboxes.
Start with Koltrix
Your domain, one inbox, and an API that sends.
A team inbox where AI sorts and drafts (nothing is sent without your click), plus the transactional API and SMTP relay your product sends with. 7 days free, no card.
