How Should a Small Business Set Up Email Accounts and Shared Inboxes?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Give each owner, employee, and trusted contractor their own email account on your business domain, and set up shared inboxes for jobs like sales, support, billing, and general questions. Use business-owned addresses, not personal ones, for anyone who runs your important accounts. That way, every login can be traced to one person, and nothing is lost when someone leaves.

What this means

This page covers four outline lines:

12.1.2 Individual accounts: one account per person, so you know who did what.
12.1.3 Shared inboxes: role addresses like sales@, support@, billing@, and hello@ that more than one person can watch.
11.7.1 Business-owned email: administrators of your key accounts use company email, not personal email.
23.10.5 Communication accounts: assign business-owned email, phone numbers, and messaging accounts to staff.

A shared inbox can be a group address that delivers to several people, or a shared mailbox that several people open. Ask your email provider which it offers.

Made-up example: Oak and Iron Remodeling has an owner, an office manager, and two crew leads. Each has a named address. The office manager and owner both watch estimates@ and billing@. The GBP is owned by the owner’s business address, with the office manager as a manager. When a crew lead leaves, his account is turned off and his email is forwarded to the owner for 30 days, and nothing else changes.

Why it matters

Sharing one login hides who did what. The Federal Trade Commission (FTC) advises separate user accounts and giving access on a need-to-know basis.
Personal email owners can walk away with your accounts. If your GBP or domain belongs to someone’s personal Gmail, it’s theirs.
Customers write to a role, not a person. A shared inbox keeps leads coming in even when someone is sick or on vacation.
Turning off one person is simple when they have their own account.

Who this applies to

Every business with more than one person touching email, and solo owners who want a general address that can be handed off later. Contractors who send email for you, such as a bookkeeper or marketer, can get an account too. Give them only what their work needs.

How to do it

List the people and roles. Who needs a named account, and which roles need a shared inbox?
Create named accounts like firstname@yourbusiness.com for each person.
Create shared inboxes for the roles customers contact. Start small: hello@ and billing@ are often enough.
Assign an owner to each shared inbox so someone is responsible for replies (see 16.2.1 Lead Response Ownership).
Use business email for admin accounts. Your GBP, registrar, website host, bank, and social accounts should sign in with business-owned addresses. Have two business-controlled administrators (see 8.4.6 Two Business-Controlled Administrators and 14.3.8 Profile Ownership).
Turn on multi-factor authentication for every account (see 11.7.3 Multi-Factor Authentication).
Store passwords in a password manager, not a spreadsheet (see 11.7.2 Password Manager).
Record it in your access inventory (see 11.7.5 Access Inventory).
Plan for departures. Decide ahead of time whether a leaving person’s email is forwarded, turned into a shared mailbox, or archived (see 11.7.7 Removing Access When People Leave).

What proof to keep

The email admin user list
A list of shared inboxes and who watches each
The access inventory showing which email owns which key account
Offboarding notes for anyone who left

Common mistakes

One shared password for everyone. You can’t tell who did what or lock out one person.
The GBP owned by a personal address. Move it to a business address now, while you still can.
A shared inbox nobody owns. Leads sit unread.
Too many shared inboxes. Five addresses for a three-person business means things fall through the cracks.
Contractors on full admin accounts. Give them only what they need.

When to get help from a pro

An email provider or information technology (IT) helper can set up group addresses and shared mailboxes. Questions to ask:

Does our plan include shared mailboxes, or only group addresses?
What does it cost per named user, and are shared inboxes free?
What happens to a mailbox when we remove a user?

Bill’s note

[Bill: add a short note. For example, a client whose Google Business Profile was owned by a former employee’s personal email, and how long it took to get it back.]

If you’d rather have this done for you, SiteSmarty handles Google Business Profile setup and ownership checks.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: SiteSmarty’s named accounts, shared inboxes, and which address owns each key account]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the email admin user list]
[Result so far:]

Questions people ask

Should employees share one business email account? No. Give each person their own account, and use shared inboxes for roles.

What is a shared inbox? An address like sales@ or support@ that more than one person can read and answer.

Should contractors get a company email address? If they send email for your business, yes, with only the access their work needs.

What email should own my Google Business Profile? A business-owned address on your domain, with a second business-controlled person as a backup owner or manager.

Audit check

Question: Does every person have their own business email account, and are key accounts owned by business addresses?
Pass looks like: Named accounts for each person, a few shared inboxes with clear owners, the GBP and registrar on business email, two administrators, and multi-factor authentication on.
Fail looks like: Shared logins, personal email owning key accounts, shared inboxes nobody watches.
Evidence to collect: Email admin user list, shared inbox list, and the access inventory.

Where this fits

Do this first: 12.1.1 Business Email Domain

Do this next: 12.1.4 Email Signatures

Sources

Federal Trade Commission, "Start with Security: A Guide for Business" (checked October 17, 2026)
Cybersecurity and Infrastructure Security Agency, "More than a Password" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.