Protect your sign-in
Use a unique password and enable TOTP two-factor authentication where available. Keep recovery material in a safe place. Review active devices and sign-in activity, and revoke access you no longer need.
For compatible IMAP/SMTP clients, create a dedicated app password instead of reusing your main password. App passwords are credentials: store them privately and revoke them when you stop using the app.
Understand domain authentication
SPF identifies authorized sending sources, DKIM adds a domain signature, and DMARC describes the treatment of authentication failures. Follow the portal’s records and readiness checks.
Authentication is a signal about a message’s claimed domain. A passing result does not guarantee that content, links, or attachments are safe. Always review requests that involve credentials, money, or sensitive information.
Use attachment information
The platform assesses risks such as suspicious extensions, file-type mismatches, and active content. Malware scanning depends on the service’s scanning configuration. Review warnings before opening attachments, and independently confirm unexpected files.
A risk label helps guide attention; it is not a promise that every dangerous file is detected. Sharing links and file access also follow organization policies.
Know which encryption you are using
TLS secures supported connections in transit. Optional user-key mail encryption protects compatible stored content, and end-to-end sending requires compatible recipient keys and setup. These protections have different purposes.
OpenPGP and S/MIME require careful key management. Keep private keys, passphrases, and recovery material safe. Turning on encryption does not retroactively encrypt older messages. Losing the key or passphrase can make encrypted content inaccessible.
Team chat has its own device-based end-to-end encryption. That does not automatically encrypt ordinary email conversations.
Protect team conversations and calls
Team chat uses device-based end-to-end encryption. Review device verification and safety numbers, and keep conversation membership current as people and responsibilities change.
Voice and video calls start within direct or group conversations. Browser media permissions let you choose microphone, camera, and screen access. Check what is visible before sharing your screen and stop sharing when the discussion is finished.
Call availability and participant capacity follow the service configuration. Ask our team about guest access, recording, and other conferencing requirements before relying on them for your organization.
Keep administrative access focused
Invite administrative members only when needed and choose a role that fits their responsibility. Organization management is separate from the mailbox app. Administrative views exclude message bodies by design; authorized operational metadata and attachment-library access are separate and audited.
Review your organization’s requirements for data handling, recovery, retention, and service terms with the team. Do not assume a compliance certification from the availability of a particular feature.