Twelve people. One shared password taped inside a desk drawer. Three former employees who still appear in the autoresponder CC list. That is not a permissions model. That is an accident waiting for a slow Tuesday.
Email roles and permissions are the rules that say which accounts each person can open, whether they can send as a shared address, and who may add or remove users. Good permissions replace shared passwords with individual logins tied to job function. Here is how teams structure that access.
How do roles and permissions work for business email?
Every team member gets an individual login. Permissions attach to that login, not to a shared credential. A permission set typically includes read access, send access, send-as rights for aliases, and admin rights to manage accounts.
Role-based access maps job function to mailbox rights. Support staff read and reply from support@. Sales staff send from their name@ address and claim leads from a shared queue. Only admins create or delete accounts. This model extends the security basics from what is email security for business.
Common permission levels for teams
1. Individual mailbox owner
Full access to one named inbox. Can send, receive, and manage personal folders. Cannot change organization-wide DNS or billing settings.
2. Shared inbox member
Can read and reply within a shared queue. May add internal notes and change assignment status. Cannot delete the shared address or grant access to outsiders.
3. Send-as rights for aliases
Lets a user compose mail that appears from billing@ or hello@ without owning the entire queue. Useful for specialists who answer niche topics under a role address from choose email prefix for your brand.
4. Administrator
Creates accounts, resets passwords, and reviews access logs. Limit admin count to trusted operators. Pair admin duty with offboarding steps from the next chapter on onboard team members to business email.
Review permissions when roles change
Permissions should change the same day a role changes. Promotions, department moves, and departures all trigger a review. Remove send-as rights, shared inbox access, and forwarding rules when someone leaves.
Quarterly audits catch drift: ex-contractors with lingering access, interns with admin rights, and shared passwords that crept back in through urgency. Document the review cadence inside your team policies covered in team email policies.
Frequently asked questions
Should teams ever share one login for a mailbox?
Shared logins remove accountability and make offboarding messy. Give each person an individual account with permissions matched to their role. WEMASY keeps your public contact paths documented on the site through the website builder while access stays per user behind the scenes.
What is the difference between read access and send-as rights?
Read access lets someone view threads in a shared queue. Send-as rights let them compose outbound mail from a role address. A billing specialist may need send-as for billing@ without full admin control.
How do permissions relate to email security records?
DNS authentication records protect your domain reputation regardless of who sends. Permissions control which people may send on your behalf. Both layers matter. See SPF DKIM DMARC records for the technical side.
Can managers read employee inboxes?
Policy should define whether managers may access individual mailboxes for oversight or only shared queues. Clear written rules prevent surprise and protect trust. Formal guidance fits inside team email policies.
What permissions do contractors typically need?
Contractors usually need narrow send-as or shared inbox access for their contract term only. Set an end date on access the day the contract starts. Offboarding steps mirror onboard team members to business email in reverse.
How often should teams audit email permissions?
Quarterly audits work for most growing teams. Audit immediately after any departure or security incident. Logs from how to spot phishing email training reduce risky clicks that permissions alone cannot stop.