Cis Gworkspace 3.1.3.1.1

3.1.3.1.1 Ensure users cannot delegate access to their mailbox

Overview

Description

Mail delegation allows the delegate to read, send, and delete messages on their behalf. For example, a manager can delegate Gmail access to another person in their organization, such as an administrative assistant.

Rationale

Only administrators should be able to delegate access to a user's mailboxes.

Impact

Existing delegations will be hidden, when this feature is disabled.

Default Value

Let users delegate access to their mailbox to other users in the domain is unchecked

Audit

To verify this setting via the Google Workspace Admin Console:

1. Log in to https://admin.google.com as an administrator
2. Select Apps
3. Select Google Workspace
4. Select Gmail
5. Under User Settings - Mail delegation, ensure Let users delegate access to their mailbox to other users in the domain is unchecked

Remediation

To configure this setting via the Google Workspace Admin Console:

1. Log in to https://admin.google.com as an administrator
2. Select Apps
3. Select Google Workspace
4. Select Gmail
5. Under User Settings - Mail delegation, set Let users delegate access to their mailbox to other users in the domain to unchecked
6. Select Save

CIS Controls