Solved: Delegation

lasie102 · 01-12-2022 10:33 PM

Hello,

I have tried to delegate access to another account in our organization. The delegation only works when "Allow Less Secure App Access" is turned to "ON."

This is contrary to the recommendations.

When I turned it "OFF" the delegation ceased to work, and a pop-up warning appeared in the delegating account warning of a "Critical Alert."

This is odd, because all of the settings were performed from within the Gmail console, so why was it identified as an unsafe application?

Does the person receiving the delegation need to set anything up on his/her account in order to receive/send emails?

I had set up delegation on one account, and the other person accepted it.

Now what?

I ask this, because when acct1 (for example) delegated access to acct2 (also for example), acct2 did not receive any mails that were sent to acct1. Only acct1 received.

Only after I added in acct2's settings "Check mail from another account," then acct2 received.

There seems to be some steps I am missing.

Also, if in acct2 there should be another folder for acct1, this appeared only after I allowed unsafe applications (Gmail?) on the Security setting.

View question

StephenHind

@lasie102

However, I was expecting something else:

1- When Test1 received a mail, Test2 will have a folder show up marked "Test1"

That's not how mail delegation works, so why were you expecting that? Have you seen some documentation that suggests that's how mail delegation works?

2 - That Test2 will have the option to send mail with a drop-down menu allowing the choice between the two accounts.

When Test2 is accessing the Test1 mail they can send directly from that account as Test1.

If you want what you describe then you can actually have it but it doesn't use mail delegation at all but automatic forwarding, filtering to a label, and the send as option; the big issue with that approach is if Test2 wants to send as Test1 and Test1 needs to see the sent mail that Test2 sent as Test1 then Test2 needs to remember to CC/BCC Test1 (as there's no connection between the accounts) and the recipient may be able to see that it was sent by Test2 (whereas with delegated access you have the option to ensure Test1 is seen as the sender).

Delegated access is designed for real people who will be accessing the accounts and need to allow someone else to see their mail to check it and respond on their behalf (e.g. manager and the manager's assistant). If you're trying to do something else then there may be better approaches but trying to keep Test2 in only that account means you need to put something in place to ensure that Test1 can see the mail sent by Test2 on the behalf of Test1.

View solution in original post

AlanM

are you trying to use IMAP or an external client?

when you set up delegation, you will get a activation request on the account to be delegated to. once accepted the deleage account is available in the list of accounts in the top right corner. (with the note "delegated" on it)

lasie102

Hello,

Neither, we are using pop.gmail as the POP server. My question is, why when we try to set it up to check, it fails because we have the "accept less secure apps" set to "off" as directed by Google. When switching to "on," we get a warning that it is not a safe app, even though it is from within the GSuite!

Original question, in whole:

Hello,

I have tried to delegate access to another account in our organization. The delegation only works when "Allow Less Secure App Access" is turned to "ON."

This is contrary to the recommendations.

When I turned it "OFF" the delegation ceased to work, and a pop-up warning appeared in the delegating account warning of a "Critical Alert."

This is odd, because all of the settings were performed from within the Gmail console, so why was it identified as an unsafe application?

Does the person receiving the delegation need to set anything up on his/her account in order to receive/send emails?

I had set up delegation on one account, and the other person accepted it.

Now what?

I ask this, because when acct1 (for example) delegated access to acct2 (also for example), acct2 did not receive any mails that were sent to acct1. Only acct1 received.

Only after I added in acct2's settings "Check mail from another account," then acct2 received.

There seems to be some steps I am missing.

Also, if in acct2 there should be another folder for acct1, this appeared only after I allowed unsafe applications (Gmail?) on the Security setting.

StephenHind

@lasie102 can you provide screenshots of where you're seeing this because I have just checked this on a client's Google Workspace as I have just enabled Delegated access for them and they have Less Secure Apps turned off so, as @AlanM mentioned, there's no requirement to have Less Secure Apps turned on to get Delegated Access working - see this screenshot:

lasie102

HI Stephen,

thank you for your reply as well.

I'll describe my steps (please bear with me, apologies for going thru step-by-step) to check

1- acct1 goes to his acct page, and adds a delegate with the message going to acct2 to accept.

2- acct2 receives the mail and confirms/accepts.

- is that it, or does acct2 also have to add in his acct page "check mail from another acct?"

I ask, because without that, there is no sub-folder for acct1 in acct2's mail box

StephenHind

@lasie102

2- acct2 receives the mail and confirms/accepts.

- is that it, or does acct2 also have to add in his acct page "check mail from another acct?"

Yes that's it: acct2 does not need to check mail from another account: acct2 will get the extra delegated account listed on the accounts chooser as you see in the previous screenshot - I've outlined in red below where you need to click and the fact it's Delegated:

Once you click on that delegated account from the account chooser a whole new Gmail tab will open showing the delegated user's emails.

lasie102

Hi,

I signed out of all my accts, and signed back in.

The acct2, which has been granted access to acct1 shows this pic:

Is this correct or reversed?

StephenHind

Your screenshot shows that Test2 is has delegated access to the Test1 is email, so if Test2 is clicks on the Test1 is Delegated option a new tab will open allowing Test2 is to see the email of Test1 is.

In this scenario Test1 is has allowed delegated access to Test2 is.

If you need it the other way around then the Test2 is account needs to add Test1 is as a delegate in Settings > All Settings > Accounts.

AlanM

no, that is it. but what i expect, is that you are not using the gmail client, but a third party client (I deduce this from you answer about POP) - POP is a "less secure app"

It is not possible to get email through POP as a delegate. if you migrate to the Gmail client (Web based) you will have the same option as shown in the screenshot by Stephan.

lasie102

I am using a web client, yes.

I had a hunch something was not right with using POP (test case in the org set up by the admin.)

I know that we are not using either IMAP or POP for our corporate accts (both are disabled.)

lasie102

I think I'll have to ask the admin to not set up a test case using POP.

I do not see the "Delegated" flag as you posted.

StephenHind

@lasie102 it can take 30 minutes to appear, after the delegate has clicked the link to accept, on the account chooser but can appear much quicker if you sign out and back in. POP is not required in anyway, this is all done by Google Workspace via the browser.

lasie102

@ StephenHind

I see what you are saying in Test2's page (the Test1's tab of delegation.

However, I was expecting something else:

1- When Test1 received a mail, Test2 will have a folder show up marked "Test1"

2 - That Test2 will have the option to send mail with a drop-down menu allowing the choice between the two accounts.

Neither of those expectations are showing up on Test2's page.

Thus, it brings be back to my question if Test2 has to change his settings to:

Because, something is not right here.

Test2 does not see any mail also sent to Test1 and cannot send on behalf of Test1.

StephenHind

@lasie102

However, I was expecting something else:

1- When Test1 received a mail, Test2 will have a folder show up marked "Test1"

That's not how mail delegation works, so why were you expecting that? Have you seen some documentation that suggests that's how mail delegation works?

2 - That Test2 will have the option to send mail with a drop-down menu allowing the choice between the two accounts.

When Test2 is accessing the Test1 mail they can send directly from that account as Test1.

If you want what you describe then you can actually have it but it doesn't use mail delegation at all but automatic forwarding, filtering to a label, and the send as option; the big issue with that approach is if Test2 wants to send as Test1 and Test1 needs to see the sent mail that Test2 sent as Test1 then Test2 needs to remember to CC/BCC Test1 (as there's no connection between the accounts) and the recipient may be able to see that it was sent by Test2 (whereas with delegated access you have the option to ensure Test1 is seen as the sender).

Delegated access is designed for real people who will be accessing the accounts and need to allow someone else to see their mail to check it and respond on their behalf (e.g. manager and the manager's assistant). If you're trying to do something else then there may be better approaches but trying to keep Test2 in only that account means you need to put something in place to ensure that Test1 can see the mail sent by Test2 on the behalf of Test1.

lasie102

@StephenHind

Thank you for time and patience with this matter.

StephenHind

@lasie102 glad I could help.