Kasia’s last day on the support desk is a Friday at the end of September, after three summers answering support@ for a small firm that hires out marquees for weddings, and on the Sunday night at 23:10 a reply goes out from that address to a bride asking whether the big frame tent copes with wind. Nobody at the firm sent it. The answer was right, mind you, down to the wind rating.
How a thing like that can happen, and how you would ever find out who did it, comes down to the way the mailbox is shared. Gmail delegation lets named people into one account to read, send and delete its mail, each of them signed in under their own Google account, so nobody needs the password at all. Handing the password round works more crudely, since everybody simply becomes the account. And some desks take the mail out of Gmail altogether, into a shared inbox inside a help desk, where every person has a login of their own.
Who sent the reply at ten past eleven on a Sunday
Ben runs the firm with you, and he spotted it on the Monday morning scrolling the Sent folder over his first coffee, then posted it in Slack with nothing but a question mark. Four people know the support@ password, five counting Kasia, since the firm pays for the one Google Workspace account and the whole desk signs into it, and the reply was signed off with nothing but the firm’s name, the way every reply from that address is. Nobody owned up to it.
So Ben went and opened the Your devices page on the account, which most people never look at in their lives. Eleven devices were signed in. Some he could name straight off, the office PC and his own phone and the tablet that lives in the van. One was a phone last used on Sunday night and signed in since the spring of 2024, and he only worked out whose it was by ringing round. It was Kasia’s.
She was mortified, to be honest with you. Kasia her own self was the one who suggested Ben change the password. She had seen the mail land on her phone out of pure habit, knew the answer, and went and sent it before she had properly thought about whether she still should. None of it was meant badly, mind you, and nobody minds the reply its self. What Ben minded, once he had sat with it a good long while, was everything else on that phone. The bookings were all on it. So were the deposit receipts Stripe had sent through and the invoices out of Xero, and the floor plans for each venue saved in the account’s Google Drive, plus the date and address of every wedding the firm had on in October, which tells anybody holding them which houses stand empty on which Saturdays. GDPR has strong views on that sort of thing once the person holding it no longer works for you, and the firm has never had a CRM, so the mailbox was the customer list.
Kasia is the most careful person who ever worked that desk, plainly said. Nobody had changed the password on the Friday, on account of a change meaning four people signing back in on everything they own, and nobody fancied starting that at five o’clock on somebody’s leaving drinks.
Why changing the password is harder than it sounds
Monday, half eight, and Ben changes it. Google signs an account out nearly everywhere the moment its password changes, which is the whole point of doing it, and Kasia’s phone drops off the list.
Then the account asks for its 2-Step Verification code, and the code goes to the phone number set up when 2-Step Verification was switched on. That was Kasia’s, three summers ago, on account of her having set the account up in the first place. So Ben has to ring her a second time inside the hour. Kasia answered on the second ring. The other way out was to go and find out that a Google Workspace admin can generate backup verification codes for a user from the admin console, which he did not know either and which would have taken him most of the morning to find.
After that comes the signing back in. Four people had ten devices between them, near enough, and each of the lot wants the new password typed in and a code from somewhere. Sam, who helps out on Saturdays, did not get the new password till the Thursday, and spent his Saturday answering customers from his personal Gmail instead, which is a whole other mess and one that took a week to tidy.
There is a quieter cost as well. Google’s own help pages say that when several people sign in to the one Gmail account from different places, Gmail might lock the account down for a while, so a desk sharing a password can find its self locked out for a spell on exactly the morning everybody logs on at once. It does not happen often, funnily enough, though often enough to be a nuisance here and there on a Monday.
What would delegation have changed
Rewind to the Friday and give the firm delegation instead. Kasia, Ben, Sam and you each have an address of your own on the firm’s Workspace, and the support@ account has the four of you added as delegates, so each of you opens it from your own inbox with the account switcher and nobody knows its password. At five o’clock on Kasia’s last day somebody takes her off the delegate list, or her own account gets suspended, and the other three carry on without signing back in to anything. The Sunday reply never goes out, since the phone it would have come from has no way in. The other three never notice.
That is most of the case for it, and it is a good case. Delegation is built into Gmail, it costs nothing extra to switch on, and the limits are generous for a small desk. A work account can take up to 1,000 delegates, with around 40 of them in the account at the same time on typical use, while a personal Gmail account stops at 10. That covers most small firms easily. Bigger firms with a developer to spare manage the delegate lists through the Gmail API instead, which a marquee firm will never need.
Sam is the awkward part of it. He helps on Saturdays from his personal Gmail, and a work account can only take delegates from inside your own organisation, so before Sam can be a delegate he needs an address on the firm’s Workspace, which is a paid user like anybody else. Delegation takes the password away and hands you back a seat per person, which, truth be told, is the very same thing that sent so many small firms to a shared password in the first place.
Set Sam up on a Wednesday and he gets an invitation that runs out after a week, and Google says it can take up to 24 hours before a new delegate can use the account, which is no bother midweek and rather more of one if the Saturday rush is the next morning. It has to be done from a computer too, since the Gmail app on a phone has no way of adding a delegate.
Delegation also leaves the sending ceiling exactly where it was. Every reply a delegate sends counts against the one account’s daily limit, 2,000 a day on a paid Workspace account, which a marquee firm will never get near and a busy online shop now and then does. We went through that ceiling and the rest of it properly over at our page on Gmail sending limits.
Does delegation actually tell you who sent a thing
Out of the box, delegation does tell you, and fairly plainly. When a delegate sends from support@, the delegate’s address turns up in the message next to the account’s, so the bride would have seen Kasia’s name next to the firm’s and the Monday mystery would have taken about a minute to solve.
Here is the part most guides go and skip. A Workspace admin can change what the customer sees, and one of the two choices Google offers is to show the account owner only, with the delegate’s address left out of the message altogether. It is a single setting in the admin console. Plenty of firms pick it, since a customer who gets mail sent by kasia@ on behalf of support@ tends to start writing to Kasia directly the next time, which is the very thing a shared address was supposed to stop. Pick that option and the message no longer says who sent it, and you are near enough back where the shared password left you, with only the delegate list to show for the bother.
Either way, what delegation settles is who can get in, and who has a given mail is a separate question it leaves alone. Two delegates can open the same bride’s question within a minute of each other and both reply. A label with Ben’s name on it means nothing to whoever opens the mail without looking at the labels, and that is the bit of it that sends some desks on past delegation to something else.
Password, delegation and a shared inbox, side by side
| A shared password | Gmail delegation | A shared inbox in a help desk | |
|---|---|---|---|
| How people get in | Everybody signs in as the account | Each person signs in as themselves, then switches to the account | Each person has their own login to the desk |
| What the customer sees on a reply | The account’s address only | By default the account and the delegate; an admin can set it to the account only | Your support address |
| Who sent a given reply | Nobody can tell from the message | The delegate’s address, unless the admin hides it | The name of the person who sent it, on the conversation |
| Taking one person out | Change the password; everybody signs back in | Remove the delegate; nobody else is affected | Remove their login; nobody else is affected |
| Who can be added | Anybody told the password | On a work account, only people in your organisation | Whoever you invite to the desk |
| Cost of an extra person | Nothing, until something goes wrong | A Workspace user each, on a work account | Depends on the desk: per seat or per workspace |
| Limits | One account; Gmail may lock it when many people sign in from different places | Up to 1,000 delegates on a work account, 10 on a personal one; about 40 at once | Set by the help desk |
| Sending ceiling | The account’s 2,000 a day on paid Workspace | The same 2,000 a day; delegates do not add to it | Depends on how the desk sends |
| Who has a given mail | Nobody, formally | Nobody, formally; labels at best | An owner and a status on every conversation |
| Setting it up | Minutes | An invitation per person that expires in a week; up to 24 hours to work | Forward support@ to the desk |
Ben worked through the same questions for the marquee firm on the back of a delivery docket, and by October the only one he still cared about was how you take one person out on the day they leave.
What changes when the mail moves out of Gmail
Moving the mail out takes support@ out of anybody’s inbox altogether. Mail to the address gets forwarded on to a help desk, where it turns into conversations that each get a named owner and a state, and every person who answers has a login to the desk rather than to the Gmail account. The Gmail account stops being somewhere people go at all, more or less.
On a desk set up that way, Kasia’s leaving looks different again. Somebody takes her login off the desk at five on the Friday, and her phone holds nothing that reaches the mail, since she never had the Gmail password to begin with. The replies she sent over three summers stay on their conversations with her name on them, which counts for a great deal the following June, when a customer rings to say Kasia promised them the side panels for free. Her name is right there.
It changes who needs a seat as well. On Google Workspace the support@ address can usually be an address in Google Groups that passes the mail on, rather than a paid user of its own, and Sam on his Saturdays needs a login to the desk and nothing at all from Google.
We went into the moment owners and statuses start mattering in our piece on how a shared inbox turns into a ticketing system. A group with Collaborative Inbox switched on sits somewhere between delegation and a desk, and we gave it a write-up to its self. Firms on Microsoft 365 and Exchange face much the same choice, with an Outlook shared mailbox standing where delegation stands here.
Running the marquee desk on Maxdesk
On Maxdesk the marquee firm forwards support@ to its workspace and each of the five gets a login of their own, Sam included. Adding him costs the firm nothing, our price being set per workspace with no count of people in it, and pricing it that way is something we argued in our piece on help desk pricing models.
When Kasia goes, Ben takes her login away on the Friday, and as far as the mail is concerned the whole of it is done by ten past five. The replies she sent stay under her name, the trail behind each ticket keeps her assignments and her notes, and nobody else so much as signs back in. Customers keep writing to support@ and keep getting their answers from it. You and Ben sit as admins and Sam as an agent, so adding or taking away a login stays with the two people most likely to remember it.
In the shared inbox each conversation also carries one owner, which is the question delegation never set out to answer. Two people opening the same bride’s mail can see straight away that it is already Ben’s.
When is delegation all you need
Delegation is all a good many small desks will ever need, and we would sooner say so our own selves than have you find out after moving. Two people answering a dozen mails a week, both on the firm’s Workspace already and neither going anywhere, get nearly everything they need out of delegation for nothing, and a help desk would mostly hand them a second place to look.
The sums start to turn once somebody outside your Workspace needs to answer, a Saturday helper like Sam, say. They turn again the first time somebody leaves. On a seasonal business both tend to arrive inside the one summer, which is how the marquee firm met them.
Moving to us is not free of fuss either, to be fair. Mail already sitting in the support@ account stays in Gmail unless you write in and ask us to bring it across, and for the first fortnight people will still go and look there out of habit. On our free plan the desk keeps the last three months to hand, and older conversations wait behind Pro or Elite rather than being thrown out. Free also signs your replies off with a small line naming us at the bottom. Your team sees a few ads while it works, which some people mind a good deal more than others. And email is all we handle, so the phone calls about wind ratings stay with whoever picks up.
Whichever way you go, the old password wants changing once more, on the day the mail moves, since every phone that ever knew it stays signed in until somebody does.
How do you check your own support@ today
Sign in to the support@ account on a computer and open the Your devices page under Security in its Google Account. It takes ten minutes. Count what is signed in, then try to put a person’s name against each one your own self, without asking anybody. On the marquee account it was eleven devices, and by the end of it Ben could name nine.
Then, in Gmail’s settings under Accounts, look at who has been granted access to the account. That is the delegate list, which on a lot of support@ accounts is empty and on some has a name on it from two years back.
Both lists matching the people who answer your mail this month means you are fine, whichever way the mailbox is shared. Where they do not match, change the password on a quiet afternoon this week rather than the morning after somebody’s last day, and decide between delegation and a desk at your own pace after that.
Common questions about Gmail delegation
What is Gmail delegation?
Gmail delegation lets the owner of a Gmail account give other people access to read, send and delete its email without sharing the password. Each delegate signs in to their own Google account and switches to the delegated one. Delegates cannot change the password or chat as the account.
How many delegates can a Gmail account have?
Up to 10 on a personal @gmail.com account and up to 1,000 on a Google Workspace work or school account. Google says about 40 delegates can use an account at the same time with typical use, fewer with heavy use or automated access.
When a delegate sends an email, what does the recipient see?
By default the recipient sees both the account’s address and the delegate’s address. A Google Workspace admin can change the default to show the account owner only, in which case the delegate’s address is not included in the message.
Can I add someone outside my company as a Gmail delegate?
Not on a work or school account: delegates must be people or groups in the same organisation, so a helper using a personal Gmail address needs an account on your Workspace first. A personal Gmail account can add other Google accounts as delegates.
Does delegation increase Gmail’s sending limit?
No. Messages sent by delegates count toward the delegated account’s own limit, which is 2,000 messages a day on a paid Google Workspace account.
Is it safe for a team to share one Gmail password?
It works until something goes wrong. Nobody can tell from a message which person sent it, removing one person means changing the password for everyone, 2-Step Verification codes go to one person’s phone, and Gmail may temporarily lock an account that many people sign in to from different places.
Google limits and settings reviewed on 6 October 2026 against Gmail Help and Google Workspace Admin Help; Maxdesk product details reviewed the same day against the live site. The marquee firm, its people and the times are made up for the example.