Suspending Sign-In for a Mailbox

Sometimes you need to close someone's access without closing their mailbox. A client has not paid this month. Someone has left and you are not ready to delete anything yet. A contractor is between projects.

Suspending sign-in does exactly that: the person can no longer get in, but their email keeps arriving. Nothing bounces, nothing is lost, and the moment you switch it back on everything that came in while they were locked out is sitting there waiting.

It is available on every plan.

Where to find it

Go to Mailboxes, click the mailbox, and open the Limits tab. The Sign-in card is there, under Drive access.

Type a short reason if you want one — "unpaid invoice 42" is the sort of thing that saves you guessing in three weeks' time — and press Suspend sign-in.

What stops

• Webmail, Outlook, Apple Mail, phones — anything that signs in
• Sending, from anywhere
• Any session they already had open; they are signed out immediately
• Calendar and contacts sync on their phone and laptop
• Device passwords for file sync
• API access through any message token issued for the mailbox
• Password-reset links they were sent earlier

They cannot get back in by resetting their password. That is the point: a reset changes the password, and the password is not what is blocking them.

What carries on

• Incoming email is delivered as normal and waits in the mailbox
• Forwarding rules and filters keep running
• Nothing is deleted — every message, contact and file stays exactly where it is
• The mailbox still counts toward your plan and still uses storage

That last one is worth being clear about: a suspended mailbox is a live mailbox. You are still paying for it, because it is still doing the job of catching mail for someone.

Switching it back on

Open the same tab and press Restore sign-in. They sign in with the password they always had, and their mail is all there.

One thing does not come back: device passwords for file sync. Those were revoked when you suspended, and they will need to create new ones from webmail. Everything else — email, contacts, calendar, files — is untouched.

Doing it for a whole client at once

If you run a domain per client, you can suspend all of them in one go. On the Mailboxes page, tick the mailboxes you want, then choose Sign-in access… from the bar at the bottom, pick Suspend sign-in, and apply.

Shared mailboxes in your selection are skipped. A shared mailbox has no sign-in of its own — people open it from their own mailbox — so suspend the members instead, and that carries into any shared mailbox they open.

What the person sees

They get one line on the sign-in page: sign-in for this mailbox is suspended, contact your administrator. No reason, no dates, nothing about your billing. The note you typed is for you.

Suspending versus pausing versus deleting

Use suspend when the person might come back, or when their mail matters to you even while they cannot read it — the unpaid-client case, almost always.

Use pause when you want the mailbox to stop entirely, senders included.

Use delete when you are done with the address for good. See Deleting a Mailbox for what that involves.

Doing it from a script

Everything on this page is also available through the API and to AI agents through MCP, one mailbox at a time or a whole domain at once. See Suspending Mailbox Sign-In via API.