How to Set Up Gmail Delegation as a Workspace Admin

Gmail delegation lets one person read, reply to, and manage another person's mailbox without sharing the account password. For a Google Workspace admin, the setup happens in two phases: enabling the feature for the right org unit in the Admin console, then granting access to a specific delegate — either by the account owner or, for bulk setups, via the Gmail API. This post covers both phases, what a delegate can and cannot do, and how to diagnose the most common reason delegation options go missing.

The admin-side setting controls whether the feature exists at all for a given set of users. Without it enabled, users will not see the Grant access option in their Gmail settings, and any attempt to add a delegate will silently fail. That gap is the most common cause of the delegation not available report an IT desk receives, and it is fixed in one place.

The short answer#

Google Workspace admins control Gmail delegation from Apps > Google Workspace > Gmail > User settings in the Admin console. Enable it per org unit, then let users grant access from their Gmail settings, or use the Gmail API to add delegates in bulk. The whole flow takes under ten minutes for a single user.

• Delegates can read, compose, send, and delete mail, and manage labels — all appearing as sent on behalf of the account owner.
• Delegates cannot change the account password, adjust 2-step verification, or view confidential-mode messages.
• The feature is off by default in new Workspace accounts. An admin must explicitly turn it on per org unit before any user can grant access.
• Admins can enable cross-domain delegation if the delegate is outside the primary domain — this requires a separate checkbox in the same setting.
• Delegation activity appears in the Admin console audit and investigation log. Every message sent by a delegate is tagged with the delegate's identity in the raw message headers.

Before you start#

Check these four things before opening the Admin console. Missing any of them produces errors that look like the delegation feature is broken when the real issue is a prerequisite.

• Admin role. You need super admin access, or a delegated admin role that includes Services > Gmail administration. A Help Desk admin role cannot change Gmail service settings.
• License. Both the account owner and the intended delegate must have active Google Workspace licenses. Free personal Gmail accounts cannot participate in a Workspace delegation setup.
• Org unit scope. Know which org unit the account owner belongs to before you begin. The Mail delegation setting is per OU, not domain-wide by default, unless you apply it at the top level.
• Cross-domain check. If the delegate is on a different domain — for example, a contractor on a partner Workspace — note that now. A second checkbox in the setting must be enabled before their invitation will activate.

How to enable Gmail delegation in Google Workspace#

The steps below enable delegation for the org unit and then show two paths for granting access to a specific delegate. Complete phase one before phase two — skipping the admin setting means the user-side grant silently does nothing.

1. 1

   Open the Gmail service settings

   In the Admin console (admin.google.com), go to Apps > Google Workspace > Gmail. Scroll to User settings and click it.

2. 2

   Select the org unit

   In the left-hand panel, select the org unit that contains the account owner. If you want delegation available to all users, leave the top-level domain selected. The setting inherits down to child OUs unless a child has been explicitly overridden.

3. 3

   Expand Mail delegation

   Scroll to find the Mail delegation section — it is not near the top of the User settings page. Expand it if it is collapsed.

4. 4

   Enable the feature

   Check 'Allow users to delegate access to their mailbox to other users in the domain.' If the delegate is on an external domain, also check 'Allow delegation to users outside the domain.'

5. 5

   Set the sent-mail attribution header

   Choose how outbound mail is attributed. The default adds 'Sent on behalf of [owner]' to the message header. Most executive assistant arrangements leave this on so recipients can see who drafted the message.

6. 6

   Save

   Click Save at the bottom of the page. Propagation typically takes a few minutes but can take up to 24 hours across a large directory.

7. 7

   Grant access — user path

   Once the feature is live, the account owner opens Gmail > Settings (gear icon) > See all settings > Accounts > Grant access to your account, enters the delegate's email address, and clicks Next. Google sends the delegate a confirmation email; the delegate must accept before access is active.

8. 8

   Grant access — API path for bulk or admin-driven setup

   For programmatic setup — when the account owner is unavailable or when you are configuring many accounts at once — use the Gmail API: POST /gmail/v1/users/{userId}/delegates with the delegate's email address in the request body. This requires a service account with domain-wide delegation enabled in the Admin console and the gmail.settings.sharing OAuth scope.

What a Gmail delegate can and cannot do#

Understanding the permission boundary matters before you set up delegation for an executive assistant arrangement. A delegate has broad access to the mailbox but is explicitly excluded from account security settings — this prevents a delegate from locking the account owner out. Gmail confidential-mode messages add a further restriction that applies regardless of how the delegation was granted.

The 'on behalf of' header in outbound messages is required by Gmail when delegation is active. Recipients see both the delegate's address and the account owner's address in their mail client. There is no way to suppress this header within the standard delegation feature — it is intentional, so recipients know the message was drafted by an assistant rather than the account owner directly.

Platform and setup differences#

Gmail delegation works differently depending on account type and how the delegate is added. The table below covers the four scenarios an admin most often encounters.

What to do when delegation is missing or not working#

If a user reports they cannot see the Grant access to your account option in Gmail settings, or if an accepted delegate cannot see the delegated inbox, work through the list below in order. It covers the cause in the large majority of support tickets on this topic.

• Feature not enabled for the correct OU. Verify the admin setting is on for the org unit that contains the account owner, not just a parent OU. Child OUs do not inherit automatically if they have been individually customised — check the child OU directly.
• User is on a free Gmail account. Free accounts do not participate in Workspace admin policies. If the user's address matches your domain but has no Admin console entry, confirm that a Workspace license is actually assigned to that account.
• Cross-domain delegation not enabled. If the delegate is outside the domain and the admin has not checked the cross-domain box, the invitation appears to send successfully but the delegate receives a 'You cannot access this account' error when they try to activate it.
• Delegate did not accept the invitation. The account owner's Gmail shows the invitation as pending — it does not activate until the delegate clicks the confirmation link in the email Google sends them. Check whether that email went to spam in the delegate's inbox.
• Delegate's account is suspended or unlicensed. A suspended or unlicensed Google account cannot accept delegation. Verify the delegate's account status in the Admin console before re-sending the invitation.
• Confidential messages appear missing from the delegated view. This is expected behaviour. Gmail confidential-mode messages are not visible to delegates by design. The account owner must open those messages directly.
• Delegation events not appearing in the audit log. Delegation events appear under Reporting > Audit and investigation > Gmail log events — filter on the Delegate event type. If you see none, confirm the feature was enabled before the events you are searching for occurred. Retroactive logging is not available.

A faster way to manage delegated mailboxes#

Gmail delegation gives a delegate the keys to the inbox but does not add a control layer. Every reply the delegate sends goes out immediately, with no approval step and no audit trail inside the mail client itself. For a busy executive inbox where an assistant handles initial replies, any mistake is already in the recipient's inbox before anyone notices.

AI Emaily runs on top of any Gmail account, as well as Outlook, IMAP, and other providers. Assistants handling a delegated inbox can use Copilot mode, which holds every draft for the account owner to approve before anything goes out. Every send is logged in an immutable audit trail, and the account owner can undo a sent message and see exactly what was written in their name. We build AI Emaily, and this is the problem it was designed to solve — not replacing Gmail delegation, but adding the approval layer that delegation itself does not provide. Try it on a 7-day free trial (card required, nothing charged if you cancel before day seven) at aiemaily.com, or check the pricing page for current plan details.