Back to Checks
googleworkspace

Mail delegation is disabled for users

gmail_mail_delegation_disabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Mail delegation allows a delegate to read, send, and delete messages on behalf of another user. When enabled at the user level, this creates a risk that unauthorized individuals could gain access to sensitive email content. Only administrators should be able to manage mailbox delegation.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

If users can delegate access to their mailbox, an attacker who compromises one account could silently delegate access to maintain persistent email surveillance. This also increases the risk of insider threats and data exfiltration through shared mailbox access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_mail_delegation_disabled

Recommendation

Disable mail delegation so that only administrators can manage mailbox access. This prevents users from granting unauthorized access to their email.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **User Settings** > **Mail delegation**
4Uncheck **Let users delegate access to their mailbox to other users in the domain**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_mail_delegation_disabled(Check):
    """Check that users cannot delegate access to their mailbox.

    This check verifies that the domain-level Gmail policy prevents users
    from delegating mailbox access to other users, ensuring only
    administrators can manage mailbox delegation.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            delegation_enabled = gmail_client.policies.enable_mail_delegation

            if delegation_enabled is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Mail delegation is disabled "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            elif delegation_enabled is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Mail delegation uses Google's secure default configuration "
                    f"(disabled) in domain {gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Mail delegation is enabled "
                    f"in domain {gmail_client.provider.identity.domain}. "
                    f"Users should not be able to delegate access to their mailbox."
                )

            findings.append(report)

        return findings

References