ojava
Start free trial

All guides

Someone was given access to a mailbox

What happened

A person (or an outside address) can now open another person's mailbox or send as them. Assistants need this; attackers use it to read and send mail unseen.

How serious

Serious; critical when the access goes to an address outside the company.

Steps: Microsoft 365

  1. Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.

  2. Check who can open the mailbox: Exchange admin center → Mailboxes → the mailbox → Delegation. Remove Read and manage, Send as or Send on behalf for anyone who shouldn't have it.

    Open the page: admin.exchange.microsoft.com/#/mailboxes
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  3. Reset their password: Microsoft 365 admin center → Users → Active users → the person → Reset password. Give the new one by phone or in person.

    Open the page: admin.microsoft.com/#/users
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  4. Sign them out everywhere: Microsoft Entra admin center → Users → the person → Revoke sessions. This also logs out an attacker who copied their session.

    Open the page: entra.microsoft.com
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

Steps: Google Workspace

  1. Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.

  2. Check Gmail delegates: in their Gmail → Settings → See all settings → Accounts → Grant access to your account. Remove anyone who shouldn't read their mail.

    Open the page: mail.google.com/mail/u/0/#settings/accounts
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  3. Reset their password: Google Admin console → Directory → Users → the person → Reset password. Give the new one by phone or in person.

    Open the page: admin.google.com/ac/users
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  4. Sign them out everywhere: user page → Security → Sign-in cookies → Reset. This also ends a session an attacker copied.

    Open the page: admin.google.com/ac/users
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

How to check it’s fixed

Fixed when only the people who should have access keep it, and the mailbox owner confirms it.

When to call your IT provider

Call your IT provider now if the person didn't do this, or if you are unsure.