← Help centreOpen the Admin console
MGRM Admin console Help
For the people who run MGRM for your organisation: where things are in the Admin console and how its settings behave.
The Admin console
Open it at /console/, or from Admin console in the apps menu of Mail or the MGRM Account page (only administrators see it). It uses the same MGRM Account as every other app, and administrators always need their second step (an authenticator app or security key) to sign in.
The search box at the top finds pages and settings by name or help text. Every setting shows its control, its default, who changed it last, and whether a change applies at once, after a reload or after a service restarts.
Who may do what
- Super administrators can do everything, including giving administrator roles.
- People administrators add, change, suspend, delete and offboard people, and manage groups, shared mailboxes, rooms and announcements. They can also set a company's or group's own value for apps and AI.
- Help desk administrators see people and reset passwords and 2-Step Verification, unlock accounts and sign people out.
- Mail administrators look after the Mail and Spam & threats pages: domains, mail flow, trace, queue and forwarding.
- Security administrators look after the Security and Compliance pages and can read the audit log and the Backups page.
- Auditors can read every page, the audit log and the settings download, but change nothing.
A super administrator gives roles on a person's page, under Groups and roles; a new role counts from the person's next sign-in. An administrator can also be limited to some companies: they then see and change only those companies' people and values. Only a super administrator can change another administrator.
A company's or group's own value
Where a setting allows it, Add a value for a company or group gives some people a different value from the rest of the organisation. A group's value wins over its company's, and a company's over the organisation's.
Administrators limited to some companies set values only for their companies and read the organisation's values. A person's own choice (for example turning an AI feature off for themselves) still applies on top.
Defaults for people, with locks
People › Settings › Defaults for people sets what people get in Mail One's Settings until they choose themselves: for example theme, density, reading pane, conversation view, keyboard shortcuts, undo send, read receipts, desktop notifications and the week's first day. You can set them for the organisation, a company or a group.
Add a setting to Locked: people cannot change these and everyone gets it as you set it. In their Settings it shows greyed with Set by your organisation. Unlock it and each person's own earlier choice comes back. People who changed an unlocked setting can go back with Use my organisation's default.
History, revert and reset
Every change is kept: who made it, from what to what, when and why. Revert puts the earlier value back as a new change, so a revert can itself be reverted. Reset to default brings back the built-in value. Without any change, everything works as it did before the console existed.
If someone else changed a setting while you were editing it, your save is refused and the current value is shown, so you can check it and save again.
Confirm it's you
Risky actions need a recent sign-in: for example deleting a person, resetting a password or 2-Step Verification, giving roles, changing security or compliance settings, and downloading or importing settings. If your sign-in is older than the time set in Security (5 minutes by default), the console asks you to Confirm it's you. Sign in again with your password and second step, then repeat the action.
Home
How many people are active and suspended, who signed in today, the number of companies, whether AI is on, and the latest setting changes, each with Revert. The Service status card says whether every service is healthy.
Reports
Figures over time, worked out every night at about 03:40 (your organisation's time) and kept 13 months: counts, sizes and times only, never anyone's mail, messages or files. Choose a period (the last 7, 30 or 90 days, 12 months, or your own dates), a company and a group; every chart has Show as table and every table a CSV.
Overview: active people, mail sent and received, failed sign-ins, storage and 2-Step, each with how it compares with the period before. People: who is active in each app, who has done nothing for 30 days, storage by person (mailbox and documents) and who is near their mailbox size, who has no 2-Step. Mail: mail per day, who sent and received most, delivery problems, and what the spam filter did with mail from outside. Apps: Chat, Meet, AI, calendar, contacts, tasks and notes, and documents storage. Security: sign-ins, locked accounts, app-password use and 2-Step over time. Services: how much of each day each check was working.
Activity is filled back from what the last weeks' records still hold the first night; storage and 2-Step start that night, because nothing kept them before. Administrators of some companies see their companies' people only. Super administrators can Work out again a period, for example after a restore. Whether the figures run and how long they are kept are on the Settings tab.
People
Find people by name, address, title or department, and filter by company, state, group, role or 2-Step. Add one person or import a CSV file (checked row by row before anything is written). A temporary password is shown once: give it in person or by phone, never by email.
On a person's page: profile, aliases, mailbox size, forwarding and automatic reply, password and 2-Step resets, unlock, signed-in devices, app passwords, groups and activity. Suspend stops sign-in everywhere at once. Delete can be undone for 20 days by default, then everything of theirs is removed. Offboard hands their mail, meetings, calendars, contacts, spaces and files to someone else step by step. Nobody can suspend or delete themselves.
Its settings include the largest profile photo, how many people one CSV file may hold, and under Directory how often the directory is read again (a person disabled there loses their mail apps' sessions at the next reading).
Groups
Mailing lists (with an address) and groups used only for settings. Set who may send to a list (anyone, your organisation, members or owners) and where replies go, and add members and owners. Owners manage their lists themselves under Groups I manage on the MGRM Account page.
Rooms & resources
Meeting rooms and equipment that people book by inviting them to an event. Each has its seats, place, features and a booking policy: accept when free or wait for an approver, who may book, how far ahead, the longest booking and bookable hours. Approvers decide in Calendar under Room requests.
Services
Every service checked the way people's apps use it, with certificates, free disk and the last backup. Problems that last raise alerts to administrators by Inbox notice, push and email. Super administrators can start, stop and restart services and read their logs; each action asks first and is recorded. Each service's history is kept 90 days by default (Checking).
Backups
Whether everything is backed up: each part of the last backup (mailboxes, databases and directory, the server's own files, people's backups of old mailboxes and their data exports, the documents app's database, the off-site copy) with its size and time, and what failed and why. Back up now runs one at once; the schedule is on the Settings tab. A backup that failed offers Retry the failed parts, which copies only what failed. A scheduled backup that fails tries again by itself.
Restore checks restore the copies into scratch copies and compare them, without touching anything live; they also run every month. The off-site copy keeps an encrypted copy in other storage (any S3-compatible service): set it up on the Settings tab and keep the repository password away from the server, because nobody can read the copy without it.
Everything that runs shows a progress bar with the part it is at and the time left. Every restore has From: the latest copy, an older snapshot (List the older points), or an uploaded archive.
Downloads: the whole backup, one person's mailbox (as .mbox files that Thunderbird and Outlook import) or one part, encrypted with a passphrase you type twice. Keep the passphrase in a password manager: it is not stored with the archive and cannot be recovered. Download makes a link that works once. Upload takes such an archive back (on this server or a new one); if the upload stops, choose the same file again and it carries on. Open it with its passphrase, then restore from it.
Restore (super administrators, after Confirm it's you) puts a person's messages back by subject, or their whole mailbox. Before a whole mailbox is replaced, it is kept as it was, so Undo brings back mail that arrived after the copy. A restore that stopped half way offers Resume and Undo. The person is told in their Inbox. If the page says the backup agent is not installed or has not reported, ask whoever runs the server to check it (make backup-agent).
On the Restore tab you can also bring back a person's calendar, contacts, tasks or notes (only what is missing comes back; nothing they have is changed) and a part of the server: the databases, the directory, the server's files, people's backups and exports (restore the databases first: only the archives they list come back; nothing stops), or the documents app. The page says how long sign-in or mail will be down first, and asks you to type the part's name. Both can be undone.
The forwarding policy (off, only your domains, or also approved domains, with an hourly limit), your mail domains with the DNS records to publish and signing keys, DMARC reports, mail-flow rules, message size and sending limits. Trace follows a message's path (never its content) and Queue shows what is still waiting to be delivered.
Under Policies: Domains sets the MX, SPF and DMARC records the domains' pages ask you to publish and how often DNS is checked; Connecting mail apps sets the server name and ports that people's Connect your apps page and the iPhone and Mac profile give; Limits for people sets how far ahead a message can be scheduled and how many muted conversations, clean-up rules and quick steps each person may have. When someone reaches a limit, they are told the number you set.
Spam & threats
When mail goes to Spam, is held for review or is refused; greylisting, learning and attachment types never delivered. Release or delete held mail with a safe preview, look at recent decisions, and keep allow and block lists for everyone or a company. Viruses are always refused. Also how long a virus scan may take, how many safe senders each person may keep, and how long the filter's counts are kept.
AI
AI on or off for everyone, each feature's switch, and hourly and daily limits per person, each with values for a company or group. Also the models, the AI server's capacity, meeting captions and notes, and the AI index (pause it or wipe it). Usage is counted without any content.
Apps
Which apps people have: Chat, Meet, Documents, Notes and Tasks, each on for everyone, with values for a company or group. Mail and Calendar are always on. After that come each app's own settings, such as who may create spaces, guests and recording in meetings, file size limits, what the directory shows and what offline mail keeps.
Turning an app off first asks Turn off …?, saying what people lose and how many people it reaches; Cancel leaves it on. Nothing is deleted. For those people the app stays in the apps menu, greyed and marked Turned off by your organisation, and opening it explains why. Their data is all there when you turn it back on, which asks nothing. With Documents off, mail attachments, chat files and meeting recordings keep working.
Security
Password rules, how long sign-ins last, locking after wrong passwords, 2-Step Verification for everyone, a company or a group (with time to set it up), mail and calendar apps and app passwords (and how many each person may have), and telling people about new sign-ins. Also a record of sign-ins, network allow and block rules, and Sign everyone out after an incident.
Compliance
Holds keep everything the people on hold delete, and a copy of their mail, out of their sight, until the hold ends. Retention deletes or archives mail, chat messages or past events older than a number of days; a policy does nothing until its dry run has been checked and it is started. People on hold are always skipped.
Exports make an archive of what holds keep for a case: Export on a person on hold (their current data, what holds kept of them and their Documents' bin), or Export this hold on a hold's page (everyone it covered, in one archive). Each asks for a reason and a recent sign-in. The archive lists every file with its SHA-256 and says which hold, whose data, why, who asked and when; the export's page shows the file's SHA-256 to check it against, and every download. The person is never told.
Data export
Export a person's data - their mail (each folder as an .mbox file Thunderbird and Apple Mail open), calendars (.ics), contacts (.vcf), tasks and notes, chats (a page to read, and the data), meetings with their transcripts and notes, settings, and their own Documents files - or, as a super administrator, everyone's, a company's or a group's, as one archive per person, one archive with everything, or both. The export first shows what there is; choose the parts, then download it (each download link works once, for 5 minutes) or save it to your Documents, in a folder "Data exports". Exports are kept 7 days by default and are encrypted while they are kept.
An export of what a litigation hold keeps is made on the Compliance page instead (see Compliance) and never shows here.
The person is told in their Inbox when an administrator exports their data (a setting can turn this off for cases that must stay discreet: the export is then not shown anywhere on their own account page). People can also export their own data from their account page, under Data & privacy › Download your data, unless the organisation turned that off for them. Auditors see that an export was made, never what is in it. How long exports are kept, how many downloads each allows and who may export their own data are on the Settings tab.
Migration
Imports and backups lists every person's imports and backups, with their progress, whoever set them up. Open one for its details, folders and timeline, and to pause, resume, cancel, bring new items, try the failed items again or finish it. Set up for a person starts an import or a backup for someone: choose the person and the old account (Zoho Mail, Gmail, Zimbra or another mail account), then type that account's sign-in. It is kept sealed for that job only, and the person is told in their Inbox.
Batches start many at once. Import a CSV takes one row per person (address, source, server, port, security, username, password, mode). Every row is checked first and nothing starts while a row is wrong; the file is never kept. Each job then starts by itself once its old account has been looked at. Invite people asks people, by address, group or company, to connect their own account from their Import page, so you never see their passwords; Remind asks again those who have not set it up.
Backups kept lists every backup. Download, Restore (into the person, or into someone else, such as the successor of someone who left) and Delete ask you to sign in again if you have not recently. People administrators can do all of this for their companies' people; auditors can look.
On the Settings tab: what people may bring across themselves with Import data on the MGRM Account page (from Google, Gmail, Zoho Mail, other mail accounts and Zimbra), how many people may import at once, how long saved sign-ins for imports are kept, the largest message imported and how much disk is kept free for uploaded archives.
Google (live import): with your organisation's Google OAuth client set here (its client ID and secret), people choose Google account in Import data, sign in with Google and bring Gmail, Calendar, Contacts, Drive and Tasks, read-only, with new items brought later on request. Who their Drive files were shared with is listed in the import's report (sharing is not recreated). Finishing an import takes its access back at Google.
Connections (super administrators): a Google Workspace connection - a service account your Workspace allows through domain-wide delegation - lets you import Workspace people without their sign-in: Set up for a person › Google Workspace, or a CSV with the source google_workspace (no password column). Adding or removing one asks you to sign in again; its key is never shown again. Check again says, scope by scope, what the Workspace allows.
A Zimbra connection (super administrators) imports people's Zimbra accounts - mail, calendars, contacts, tasks and Briefcase - without their passwords, with an administrator's login (it can also list the domain's people) or the domain's preauth key. A certificate your server uses that this server does not trust is shown with its fingerprint; trust it only if it is your Zimbra server's. Then Set up for a person › Zimbra › Through the connection, or a CSV with zimbra rows without a password. People who import their own Zimbra account in Import data get their calendars, contacts, tasks and Briefcase too, from the server's web address.
Mailbox backups: whether people may Back up a mailbox (a copy of an old mailbox kept on the server, encrypted, to download or restore later), how many days each backup is kept (90), and how many backups and how many GB each person may keep (10 and 20). A backup past its time is deleted.
Zoho Mail (API): with your Zoho OAuth client (a server-based application in the Zoho API Console, its redirect URI /api/migration/zoho/callback on this server, Multi-DC on if your people are in other Zoho data centres), its client ID and secret, and your organisation's Zoho data centre, people can Sign in with Zoho in Import data instead of using an app password. Their mail comes with its folders, read and flagged marks and tags (as labels), into their mailbox or as a backup. You can invite people to either. Zoho Mail over IMAP still works without these settings.
Moving people for good (cutover)
Each import keeps each pass: the first full one and every Bring new items, with what each brought on its own. A later pass first looks at the old account again, so folders, calendars and lists made there since are added. Check against the old account (an import's page, or Verify all on a batch) counts the old account again and sets it against what is here now: each mail folder, and each other kind of item. A folder here may hold more (mail that arrived since) - that is fine; fewer is listed as a difference.
A batch has actions for everyone at once - Pause all, Resume all, Bring new items for all, Verify all, Finish all - and a Cut over page that takes you through the move step by step: (1) everyone's full pass; (2) lower the MX records' TTL to 5 minutes at your DNS host, checked here; (3) switch the MX records to the ones shown, checked here until every MX record is this server's; (4) the final pass for everyone; (5) verify everyone, with the differences per person; (6) finish - the saved sign-ins are deleted, each provider's access (Google, Zoho) is taken back and the Drive grants are given back. Every step is kept, so you can leave and come back. If this server cannot see your DNS (an internal DNS), confirm a step by hand; it is recorded as such. To go back after a switch, put the old MX records back - what came here stays, and nothing was removed from the old accounts.
An import that stops because the person's mailbox is full shows Raise the quota (if you may change people): give the mailbox more room and the import goes on. Their migration on a person's page lists every import and backup of theirs.
Organisation
The names people see, the brand colour and images, in every app, on the sign-in pages and in emails, with Restore the original brand. Also the support contact, links to help, privacy and terms pages, the organisation's time zone and default working hours, and companies' display names.
Announcements
A strip over every app for everyone, a company or a group: information, warning or critical (critical ones can't be dismissed), with an optional button, a start and an end. A preview shows it before you publish. People who dismiss one don't see it again on any device.
Integrations
API keys let a script or another system use the console's API: each key holds only the permissions ticked for it (never what needs you to confirm it's you, such as resets, deletes and restores), optionally only for some companies and from some addresses, until the date it expires. The key is shown once; what it does is in the audit log as the key. Revoke stops it at once.
Webhooks send events as they happen (people, groups, security, mail, compliance, backups, service alerts and more) to another system, signed with the webhook's own secret so the receiver can check they came from here. They go only to hosts listed on the Settings tab. A webhook's page shows each delivery and what the receiver answered; one that keeps failing is turned off and you are told.
Settings backup
Download the settings saves every setting you may see as a file, without secrets. Import settings first shows what would change. Every item is checked before anything is written; if one is wrong, nothing is imported. Both ask you to confirm it's you.
Audit log
Everything administrators and the system did: who, what, on what, the outcome and from where, but never anyone's mail or files. Filter by person, action, target, outcome and dates, and Download CSV (the newest 5,000 matching rows). Downloads are recorded too.
If the console doesn't open
The console needs the sign-in service, the directory, the database and the web server. If one of them is down, the people who run your server can check and restart services from the server itself, as described in their runbook.