Roles, permissions and access boundaries

Main roles

• System Admin — global settings, users, modules, licence, mail flow, security, workers, migrations and integrations.
• Owner Admin — resources assigned to a specific organisation.
• Domain Admin — users, mailboxes, identities, DKIM and settings only within assigned domains.
• User — own mail, contacts, calendar, tasks, rules and explicitly shared mailboxes.

Administration versus mail access

An administrator can create or disable a mailbox without having permission to read its messages. Access to another mailbox requires a separate permission: basic sharing, delegation, Send As or Send On Behalf.

Least privilege

Grant only the permission required and only for as long as needed. For a team mailbox, prefer mailbox-scoped permissions instead of a system role. When a user's job changes, review sharing and delegation entries, not only the account role.

Every permission change should leave a traceable actor, target object and outcome in the audit log.