domainwidedelegation.comStart free

Use cases → Admin and governance

Apply email legal hold across all users

Enforce legal hold on every mailbox in the domain using a delegated service account, without relying on manual admin actions or inconsistent Vault rules.

Who it is forIT, legal or compliance teams needing to preserve email for audits or litigation.
APIsAdmin SDK, Gmail API
Typical scopesadmin.directory.user.readonly, gmail.settings.basic

The problem

Legal hold requires that no email is deleted, by user or admin, across the entire organisation. Manual Vault configuration is error-prone, and new users can slip through gaps if rules are not enforced programmatically.

How it works

  1. Enumerate all active users with the Admin SDK.
  2. For each user, use domain-wide delegation to impersonate and apply Gmail retention settings.
  3. Log each mailbox and the applied hold state for audit purposes.
  4. Schedule regular re-checks to capture any newly created accounts.

What changes

Every mailbox is covered, including new joiners, and the process is fully auditable and repeatable.

The trap in this one. Applying legal hold via the Gmail API is not instantaneous—there’s a propagation delay before the hold is enforced. If you script a 'set and verify' loop, you’ll hit false negatives: the API will report success, but deletions may still be possible for several minutes. Never rely on immediate confirmation from the API; always re-verify after an interval, and treat any failures as potentially transient.

Questions people ask

Does this cover emails already deleted before the hold?

No. Legal hold only prevents future deletions. Anything already purged from mailboxes or Trash is not recoverable by this process.

How can I audit that every user is under hold?

Maintain a log of each applied hold, re-scan all active users periodically, and alert if any mailbox is found without the correct retention settings.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.

Reduce an over-broad delegation grant safely

Find out which scopes your automation genuinely uses, then cut the grant down to them.