A linked mailbox is an email mailbox tied to a separate user account so the mailbox can be accessed without granting that user a full licensed identity. In identity and access terms, it is a delegated mailbox relationship that separates mailbox ownership from authentication, often used to control human access in shared or transitional roles.
What a linked mailbox is in access architecture
A linked mailbox is not a separate security domain, it is a mailbox-access pattern. The mailbox is owned by one account, while another user account is linked to it so the mailbox can be opened without granting that user a fully licensed primary identity.
This separation matters because ownership, authentication, and mailbox access do not always move together. In practice, the linked account becomes the access path, while the mailbox itself remains the protected resource and audit object.
Why linked mailboxes exist
Linked mailboxes are typically used when an organisation needs someone to read or manage mail without giving them a full primary mailbox license or turning the mailbox into a shared mailbox. That can support transitional roles, delegated administration, or cases where the person behind the mailbox is not the real operational owner of the communications stream.
The design is easiest to understand as a delegation model. One identity authenticates, another mailbox is exposed, and the relationship between the two is what makes the arrangement useful. That makes the pattern attractive in environments that want cleaner access separation and lower licensing overhead.
How linked mailboxes differ from shared access
Compared with a standard shared mailbox, a linked mailbox is more tightly bound to a specific user account relationship. The linked user is not simply one of many people with generic access; the mailbox is intentionally tied to that account so access can be granted in a more controlled way.
That distinction can be important for ownership, lifecycle management, and review. If the linked account changes role, leaves the organisation, or loses trust, the mailbox relationship needs to be treated as part of the access model rather than as a loose convenience setting.
Security and governance implications
Because linked mailboxes separate mailbox ownership from authentication, they can reduce licensing friction while still preserving access control. They can also make governance clearer when a mailbox must survive role changes, but only if the linked relationship is inventoried and reviewed like any other privileged or delegated access path.
The main security concern is that mailbox access may outlive the business need for it. If the linked account is not recertified, disabled when the role ends, or investigated after suspicious activity, the mailbox can become a quiet persistence point for email access, forwarding abuse, or message review by the wrong person.
Risk and Threat Considerations
Linked mailboxes can create a hidden access dependency if administrators treat the mailbox as “just email” and forget that it is still a delegated identity relationship. The risk is not the mailbox label itself, but the chance that access remains active after role change, offboarding, or compromise.
Failure mechanism: A linked account retains mailbox access after the business relationship has changed, or an attacker who compromises the linked user inherits the mailbox relationship and can read messages, harvest tokens, or abuse message-based trust.
Impact: Confidential email exposure, unauthorized action through inbox-based workflows, and delayed detection because the access path looks like legitimate delegated use rather than obvious mailbox takeover.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Linked mailbox access depends on governed account relationships and lifecycle control. |
| IA-2 — Identification and Authentication (Organizational Users) | The linked user must still authenticate before mailbox access is granted. | |
| AC-6 — Least Privilege | A linked mailbox should expose only the minimum mailbox access needed for the role. | |
| Recommendation — Review and remove linked mailbox access when the associated account no longer needs it. Verify that the linked account uses strong authentication before it is allowed mailbox access. Limit linked mailbox permissions to the smallest access set required for the job. | ||
| NIST CSF 2.0 | PR.AA-05 — Least Privilege | Linked mailbox access is an access-control design that should follow least-privilege principles. |
| GV.RM-01 — Risk Management Strategy | Mailbox delegation needs governance because it creates persistent access and lifecycle risk. | |
| Recommendation — Align linked mailbox permissions with least-privilege access requirements. Include linked mailbox relationships in identity and access risk management reviews. | ||
| CIS Controls v8 | CIS-5 — Account Management | Linked mailbox relationships are account-management artifacts that require inventory and review. |
| Recommendation — Track linked mailbox relationships in account inventories and remove stale access. | ||
Practitioner Guidance
Why practitioners should care: Treat linked mailbox relationships as governed access paths, not just administrative convenience. The important question is who can open the mailbox today, who approved that access, and whether the relationship still matches the role.
What to watch for: Review linked mailbox mappings during joiner-mover-leaver events, privilege reviews, and incident response. If the mailbox holds sensitive operational mail, ensure the linked account is covered by the same monitoring and access review discipline as other delegated access.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org