What to Do If Someone Added a Delegate to Your Mailbox

If someone added a delegate to your mailbox and you did not approve it, treat it as a serious account security issue. Open your email provider's official settings, remove the delegate if possible, change your password, enable multifactor authentication, and review recent activity.

Delegation lets another account act on your mailbox in some way. Depending on the provider, a delegate may be able to read messages, send messages, manage calendar items, or respond as you. That makes unknown delegation more sensitive than an ordinary marketing email or spam message.

Do not assume who did it without evidence. In workplaces, administrators may configure mailbox access for legitimate reasons. In a personal account, however, unexplained delegation is unusual enough to investigate immediately.

Email contains password reset links, financial alerts, private conversations, travel plans, receipts, medical messages, and security notices. If another account can read or send from your mailbox, it may also affect services that rely on that email for recovery.

Delegates are especially important because access may persist even when you focus only on changing the password. Microsoft's guidance for compromised mailboxes specifically points administrators and users toward suspicious rules, forwarding, and access settings during review.

A delegate is not always malicious. Assistants, family members, shared business roles, and administrators may have legitimate access. The key question is whether you recognize it and whether it still needs access.

Do not use a link from a suspicious alert to review delegation. Open your email provider directly. Look for delegation, account access, shared mailbox access, connected apps, forwarding, filters, rules, send-as addresses, and recent activity.

If this is a work or school mailbox, contact IT or security before removing access. They may need to preserve logs or explain a legitimate configuration.

If this is a personal mailbox and you cannot explain the delegate, remove it and continue with full account hardening.

Remove unknown delegate access first, then change your password and turn on MFA. Use a unique password that is not used on any other account. CISA recommends MFA because it adds protection beyond the password.

If the provider offers a sign-out-everywhere option, use it after changing the password. Then review recent activity for unfamiliar devices or locations.

Delegation is one access path. Also review forwarding, filters, inbox rules, app passwords, POP or IMAP access, automatic replies, and send-as settings. A suspicious mailbox often has more than one persistence method.

Search for rules that target words like password, reset, code, bank, invoice, payroll, or security.

If someone may have read your email, review important accounts that send reset links there. Start with banking, payment apps, cloud storage, social media, phone carrier, and work tools.

Change reused passwords and check recovery settings on those accounts.

If your email appears in known exposure data, it may explain why the account was targeted. It does not prove delegation was malicious or that the mailbox was accessed.

Only check identifiers you own or are authorized to manage. A clean result means no known match was found in the searched sources.

Keep a short record of the delegate address, date found, settings changed, and suspicious events. This helps if you need provider support, employer security review, or official reporting later.

If fraud or financial loss occurred, use official reporting resources such as the FTC or FBI IC3.