the keyring has no window

A long-serving employee’s mailbox is a keyring. It holds years of shared credentials, invitations and password reset links. The hostile departure guide goes looking for a departing person’s forwarding rules and finds there is nowhere in the admin console to look.

Mail is the only major surface in your stack these guides have not taken on directly, and the documentation explains why it gets skipped.

Every other surface has a view. Drive has a sharing report. Groups have a directory. Applications have an accessed-apps list with a download button. Tokens have an OAuth log.

Mail has two org-wide switches, a thirty-day delivery log that cannot show you content, and an API.

the three grants you cannot list

Delegation. A delegate can read, send and receive on behalf of somebody else. In the admin console there is one control, in the Gmail user settings, deciding whether users are allowed to delegate at all.

There is no list. To find out who has delegated their mailbox to whom across your domain, Google’s own page points you to the Gmail API, and the relevant method is available only to service accounts that have been granted domain-wide delegation.

Notice what that means, because it is the most uncomfortable sentence in this guide: the supported way to audit mailbox delegation is to create the most powerful grant in your tenant, which is exactly the kind of identity the service accounts guide tells you to look at with suspicion.

One more detail. Whether a delegate’s sent mail shows their address alongside the owner’s, or only the owner’s, is a setting. So attribution in mail is configurable, which is unlike any log these guides discuss.

Forwarding. The org-wide control decides whether the forwarding option appears in a user’s settings at all. Google’s page on it says nothing about what happens to forwarding that already exists, and nothing about filters.

That second gap is the one that matters, because a filter that forwards is a different object from the forwarding setting. Somebody can have automatic forwarding switched off and a filter quietly sending a copy of everything matching a keyword.

So the hostile departure guide is right: the admin console has no view of one user’s filters, forwarding addresses or delegations. They exist only through the API.

Third-party access. Several OAuth scopes give an application full read of a mailbox, and Google classifies them as restricted. The broadest is described in Google’s own words as letting an app read, compose, send and permanently delete all your email.

That one you can see, in the accessed-apps list the token guide sends you to, which is the one piece of good news here. Worth doing today: filter that list for anything holding a mail scope, and read the names. An application that can read, send and permanently delete all of somebody’s mail is a different category from one that can see their calendar, and the list does not sort them for you.

what the admin console shows you, surface by surface

• Drivesharing report
• groupsdirectory of members
• appsaccessed-apps list, downloadable
• mail delegationone switch, no list
• forwarding filtersno view at all
• delivery logthirty days, no content

only reachable through the Gmail API

the log does less than you think

Email log search covers delivery. It does not show message content, and Google says so explicitly.

Its useful window is thirty days. Past that you can still search, but the recipient address and the message ID both become mandatory, delivery status is unavailable, and group addresses cannot be searched at all. So beyond thirty days it answers questions about specific messages you already know about, and stops answering questions about what happened.

Put that next to the six-month horizon in the super admin guide, and mail is the exception that is worse than the rule.

why this is how attackers stay

The reason to care shows up in the business email compromise record.

In November 2020 the FBI sent a private industry notification, reported by SecurityWeek and others, describing attacks from that August in which criminals set up forwarding rules in victims’ webmail. At one company, a manufacturer, three rules forwarded anything matching the words bank, invoice, wide and payment.

The mechanism named in that notice is the one to carry: rules created in the web client often do not sync to the desktop client, which hides them from administrators looking in the wrong place.

A forwarding rule is the cheapest persistence there is. A password reset does not touch it, because it is a setting and has nothing to do with the credential. Revoking sessions does not touch it either. It costs nothing to create, it produces no alert, and the only way to find it is to look in a place your console does not offer.

Your offboarding acts on the login. The things that persist live somewhere else.

the check, and its uncomfortable price

Under an hour. Read the last step before you start.

Five minutes. Record both org-wide switches, per organisational unit: whether delegation is allowed and whether automatic forwarding is allowed. This is your baseline, and it is the only part visible in the console.

The part that needs somebody who writes code. Create a service account with domain-wide delegation, scoped as narrowly as the API allows for reading settings. Loop over every user and pull four things: delegates, filters, forwarding addresses and the automatic forwarding setting. Output one file.

If nobody at your company writes code, this step does not happen, and no no-code path exists. You can still do the five minutes above and the European footnote below, and write the gap down the way the super admin guide describes.

Ten minutes. Flag three categories. Any delegation at all, because each should have a reason somebody can state. Any forwarding address outside your own domains. Any filter with a forwarding action, which is the category that produces the surprises.

Ten minutes. Run email log search against the two worst findings to see what has been flowing.

Then delete the key. Today, before you close the laptop. The service account you just created is exactly what the service accounts guide warns about: a delegated client that can act as anybody, looks unused, and will still be there in 2029 if you leave it.

Yes, that means you cure a blind spot in mail by minting the most dangerous grant in your tenant. That is the actual state of the product, and a routine that quietly leaves a service account behind would be worse.

what you still cannot see afterwards

Even with the file in front of you: who created a delegation, and when. Whether a delegate has read anything. Anything in the delivery log older than thirty days. Message content, at all. Copies already pulled down over IMAP. And any rule somebody deleted before you looked.

So this is a point-in-time snapshot, the same limitation the super admin guide describes, arriving in the one place where the horizon is thirty days.

That suggests one change to the quarterly routine in the log export guide: add this pull to it. A quarterly snapshot will not catch an attacker, but four snapshots a year give you something the console never will, which is a sequence. A delegation that appears between one quarter and the next stands out, and comparing two files is work a spreadsheet does for you.

the european footnote

One boundary, because this guide tells you to look at people’s mail settings.

The French data protection authority’s position is a useful summary of the general European shape: a message sent or received from a work mailbox is presumed to be professional, and the employer may access it. A message marked as personal or private, in its subject or by sitting in a folder named that way, is private correspondence, the employer must respect its secrecy, and breaching it is a criminal matter.

The check in this guide reads settings, which sits on the comfortable side of that line. The moment you open a message to see what a rule has been forwarding, you have crossed to the other side, and the hostile departure guide’s advice applies: stop, and get somebody who can do it properly.