Cybersecurity Blog

Shared/delegated email accounts and MFA – 01/12/22

Google has started sending reminders to those who haven’t yet enabled multi-factor authentication (MFA) on their Mount Royal email account.  For those with a single email account the process is easy. However if you use a delegated, google group or shared email account there may be some confusion. Do you have to enable MFA or not? Well that depends on what type of account you have and how you use it.

Delegated accounts allow you to access emails from your own Mount Royal email account. Neither you nor anyone else that uses the account ever logs into it.  If you click on your profile pic in Gmail and see the account listed with delegated next to it, it is a delegated account.

Even though you may have received a notification to enable MFA on that account, you don’t have to. We know that is confusing so we are working on identifying all the delegated accounts so hopefully you will not get notifications in the future.

Shared accounts require you to login with a separate username and password to access emails.  The username and password are often shared by several people. They are usually set up because the generic account needs a Youtube channel or to set up its own google forms. If you have a shared account, please do not ignore the MFA notifications and contact the IT Service Desk to find out if MFA is required. This will be determined on a case by case basis depending on how the account is used.

Google groups aren’t actually email accounts so you don’t see them listed with your delegated accounts. They are mail lists that you subscribe to or create.  They are often set up to send emails directly to your inbox,  however you can also access the emails from the Google Group app. As Google groups are part of the Google Workspace, you don’t need to MFA them separately.  They are protected when you enable MFA on your MRU email account.

For more information on enabling MFA visit the Multi-factor Authentication web page.

Leave a Reply

Your email address will not be published.