Multi-factor Authentication (MFA) For Shared Inbox Google Accounts

Multi-factor authentication (MFA) for shared inbox Google accounts works like MFA for any other accounts, with the following unique features:

  1. Shared inbox Google accounts (via SSO) require separate authentication factors for each user. Since each type of factor can only be used by one person on an account, the set of users must decide who will use which factor. MFA methods include: Okta Verify, Security Key or Biometric Authenticator, Google Authenticator, SMS Authentication and Voice Call Authentication. If all the authentication options are taken, the remaining users must use a security key or biometric key as their authentication method. This is because only one account can have multiple security or biometric keys.
  2. The first person to establish an MFA factor for the shared account assists others in setting up their factors. We recommend that the first person to set up MFA for the shared account set up SMS or Google Authenticator, because the unique authentication codes can be easily communicated, so the other users can set up their new factor.
    • Note: If a user loses access to their factor, other members can help them reset the factor by removing and re-adding their factor.
  3. For delegates of shared Google accounts (a user who will only access the account by swapping in to the account from Gmail rather than signing in directly), only the account owner sets up MFA. The account owner also manages who delegates user access. We recommend that the account owner set up at least two factors for self-service recovery in case of a lost factor.

Below is an example of how delegated accounts look in Gmail. Click the icon in the top right of your Gmail inbox to find the list of Gmail accounts.

Shared Inbox accounts with delegated in italics written on the right-hand side

Use this chart to understand Google shared inbox user types.

Google Shared Account User Type

Description
Account Owner
  • Owns account
  • Manages delegates
  • Manages MFA factors and other account settings
Delegate
  • Access to view the inbox
  • Ability to send and delete messages
  • Can sign into a shared account without directly signing in


Shared Inbox Example:

John and Jane work in Student Involvement and have access to various student organizations' shared inboxes.

Possible solutions for John and Jane to set up MFA:

  • Each person with access to the email account sets up a different MFA factor
    • e.g., John sets up Google Authenticator, Jane sets up Okta Verify, etc.
  • John and Jane can install the Google Authenticator app on a shared iPad or other device, serving as an MFA authentication method for Shared Inbox Google Accounts. If John and Jane chose this method, they must have the device available to access the shared account.


For MFA setup assistance, please visit the related support articles and resources:

Was this helpful?
0 reviews
Print Article