Start with roles, not names
Before you create any mailbox or shared folder, list the roles in your organisation. A fundraiser, programme manager, volunteer coordinator and trustee all need different access. If you start with names only, permissions become messy the moment someone leaves, changes duties or steps in for a few weeks.
For non-profit teams in Cape Town, Johannesburg, Durban, Pretoria or Bloemfontein, it helps to map access by function and not by title alone. Some people need full editing rights, others only read access, and some only need to receive information through our contact form. Keep the list short, practical and easy to review at month end.
- Give each person the minimum access needed for their job
- Use role-based groups for shared functions such as finance, projects or trustees
- Separate day-to-day staff access from board or governance access
- Review access again when duties change, not only when someone leaves
Set mailbox access for continuity
Shared mailboxes are useful for our contact form, our contact form, our contact form and support inboxes, but they must be assigned carefully. If too many people have full control, important messages can be deleted, moved or answered twice. If too few people have access, work stops when the main handler is on leave or away during load-shedding.
Decide who may read, send and manage mail from each mailbox. A practical rule is to give sending rights to staff who reply to the public, and full access only to the people who need to manage the folder structure and rules. Keep a backup person assigned to each critical mailbox so a sick day does not create a backlog.
- Main mailbox owner
- Backup user for leave cover
- Manager with full access for oversight
- Temporary access for migration or training only
Use calendars for visibility, not confusion
Shared calendars should make planning easier, especially for field work, meetings and venue bookings. The aim is not to let everyone edit everything. It is to make sure people can see what matters, add what they are responsible for, and avoid double-booking rooms, vehicles or support sessions. In smaller offices, this saves time and cuts down on WhatsApp messages asking who is where.
Set separate calendars for the organisation, teams and key resources. For example, a general events calendar can be visible to all staff, while a trustee meeting calendar is limited to the relevant group. When volunteers use their own devices, keep calendar permissions simple so they can view what they need without seeing private appointments.
- Public or internal event calendar
- Programme team calendar
- Board or governance calendar
- Resource calendar for rooms, cars or equipment
Control document spaces by project
Document libraries work best when each folder has a clear owner and a clear purpose. Do not place all files in one large shared space. Separate governance papers, donor documents, project plans and HR records so that the right people can find what they need without trawling through everything else. This also helps with POPIA duties and makes handover easier when staff change.
For active projects, give edit rights to the core team and read-only access to wider staff or trustees where needed. Keep sensitive records in a restricted area. If a folder contains signed agreements, ID copies or payroll material, only a small admin group should have access. A simple folder structure is easier to manage than a complicated one with many exceptions.
- Open access for shared templates and general forms
- Edit access for active project teams
- Read-only access for oversight groups
- Restricted access for HR, finance and signed records
Build in handover, leave cover and admin rights
Every non-profit needs a plan for leave, resignations and sudden changes. The person who sets up the system should not be the only one who knows how it works. Keep admin rights limited, but make sure at least two trusted people can manage mailboxes, calendars and document permissions if needed. That avoids delays when someone is travelling, away from the office or unavailable during a power cut.
When a role changes, update access on the same day if possible. Remove old rights, assign the new role group and check the shared items tied to that user. For organisations with branches or sites in more than one city, this step matters even more because local teams often keep their own files and calendars.
- Nominate primary and backup admins
- Keep a simple handover note for each critical account
- Remove access immediately when a role ends
- Check shared folders, calendars and delegated mail together
Review permissions before go live and after training
A permission setup should be checked before everyone starts using it, then reviewed again after the first few weeks. The best time to spot problems is when staff are still learning the system. Ask who can see too much, who cannot open the right folder and whether meeting invites are going to the correct people. Small fixes now prevent bigger admin headaches later.
Training should cover the basics in plain language: how to accept a shared calendar, how to use delegated mail, how to request access and how to report a problem. Keep the steps written down in one place. If the team changes often, this note becomes just as important as the settings themselves.
- Test access from a normal user account
- Check that the right people can edit, not just view
- Confirm mobile access for staff who work off site
- Record who approved each permission change
A simple monthly permissions checklist
A quick monthly check keeps administration under control. It does not need to take long. Look at new starters, leavers, role changes and any temporary access granted for projects or migration work. If the list is kept up to date, you avoid clutter and reduce the risk of old access staying active for months.
Use one page, one owner and one review date. That is enough for most non-profit teams. The aim is steady control, not extra paperwork. When permissions are clear, staff can focus on service delivery, fundraising and reporting instead of chasing access issues.
- Are all active users still in the correct role group?
- Have temporary access rights been removed?
- Do shared mailboxes still have a backup user?
- Are sensitive folders still restricted to the right people?
- Has the admin note been updated after any changes?
