Work account vs shared accounts

A worker can use several Microsoft or Google accounts at once: its own, and those lent to it. This article explains the difference, what each allows, and how Delos chooses which one to use.

Two roles, not two features

Both rely on the same mechanism: an OAuth connection, and a per-service binding. The only difference is the binding's role. A work account carries the workspace role, a shared account the connector role.

The work account: the worker's identity

This is the account the worker uses to write, file, and receive. One per provider. It carries the synchronized mailbox, the calendar, the file sources, and the worker's Teams or Google Chat subscriptions. Everything it sends carries this account's name.

An address can only be the work account of a single worker. If you try to connect as a work account a mailbox that already belongs to a colleague, Delos refuses and suggests sharing it instead.

See A worker's work account: what is it? and Give a worker a work account.

The shared account: a lent access

A shared account is an account that belongs to someone else and that the worker can read and use: your mailbox so it sorts your email, a colleague's calendar so it books slots there, the team's generic support@ mailbox.

It is not the worker's identity: when it sends from this account, the owner's name appears.

A shared account can lend one or more services. Each service is managed in the Connectors tab with its own toggle. The Shared access section of the Work account tab summarizes everything the worker reads in addition to its own account.

How to lend an account

1. Open the worker's profile, Connectors tab.
2. On the service tile (Outlook, Gmail, Teams, Google Drive…), choose to add a shared account.
3. Sign in with the account to lend. If this address is the worker's work account, Delos refuses: an account cannot be both its own and a loan.
4. The service appears as a shared account, with the owner's address.

Microsoft shared mailboxes

Special case: an Exchange shared mailbox (support@, billing@) has no account of its own. The worker accesses it through an account that has the right, its own or a shared account, provided the organization has granted shared mailbox permissions in the Policies. It is connected from the worker's Email tab.

How Delos chooses the account

When several accounts cover the same service, the rule is fixed and the same everywhere:

1. The work account first. The worker's tools, incoming email, Teams subscriptions, SharePoint sources: everything uses the work account if it has one for that service.
2. Otherwise, the oldest shared account. A worker without a Microsoft work account but with a shared Outlook account receives and sends via that shared account, under its owner's name.
3. Unless the task names another account. When you ask "reply from the support mailbox", the worker uses that account for this action.

Consequence to know: a worker that only has a shared Teams account is synchronized and triggered on Teams, but everything it writes there carries the account owner's name. If that is not intended, give it a work account.

Recurring cases

I want the worker to sort my email without sending in my name. Lend your mailbox as a shared account, and leave sending to the worker's work account. In the Firewall rules, you can forbid sending from the shared mailbox.

Two workers must read the same mailbox. Both take it as a shared account. Only one can have it as a work account, and the uniqueness rule prevents it anyway.

I connected my account as a work account by mistake. The worker's profile shows it: "This work account is yours". Give it its own account, then when switching, choose Keep it as a shared account: the worker keeps reading your mailbox without acting under your name anymore.

I remove a shared account, what does the worker lose? Everything that account lent: the mailbox and its email, the calendar, the synchronized files, the Teams subscriptions running on it. The routines that watched that mailbox are paused. The account itself is untouched at the provider.

The shared account is disconnected or its password changed. Delos marks the connection as revoked and the worker stops using it. Reconnect it from the Connectors tab: the same address resumes its place on all the services it lent.

In summary

• Work account: the worker's identity. One per provider. It acts under this name.
• Shared account: a lent access. As many as needed. It acts under the owner's name.
• Priority: work account, otherwise the oldest shared account, unless explicit instruction in the task.