Is Your Email Inbox the Master Key to Your Business?

What happened in our own shop

This week I set up a new laptop with our password manager and the tools we use to reach our systems. It couldn't reach anything. That was annoying. It was also useful, because it got us to look at our own setup the way we look at a client's.

That evening we traced where every sign-in really comes from. We didn't look at the passwords. We looked at the recovery path. When a new device asks for a code, where does the code go? Where does the reset link land? What else gets in through that same door?

The answer kept pointing to one place: a single email inbox.

One inbox was the master key

The sign-in link for our AI tools went to that inbox. So did the password manager's new-device codes. So did the access PIN for one of our web login gates. On top of that, the machine that runs our automation reads that same inbox, and that machine had no copy of its work stored anywhere else.

That puts two risks side by side. If someone got into that one account or that one machine, they would get far more than one account. If we lost that machine, there was no backup to restore from.

None of this happened through carelessness. It built up one reasonable step at a time, the same way it builds up in most small offices. Every new service asks for an email for codes, and the owner's inbox is always the easy answer.

Why AI tools raise the stakes

When an office connects an AI assistant to its work, email is usually the first thing it gets connected to. The assistant reads messages, drafts replies and sums up the day. That is useful. It also means the assistant now holds the same master key the owner does.

In many offices the AI tool signs in as the owner and can see everything the owner sees. That works fine until a laptop goes missing, a password leaks, or the tool itself misbehaves. At that point the question is not only what it read. It is what it could reach.

If you found this page searching for AI local training in Spokane, this is a part people often skip. Using AI well means good prompts, and it also means knowing what each tool is connected to and whose sign-in it is using. We cover both in our AI training for Spokane offices.

How to map your own master keys

Start with paper, not software. List the accounts your business can't run without: email, banking, payroll, your password manager, your Microsoft 365 or Google admin account, your domain, and your website. Next to each one, write where its reset link and sign-in codes go, both the inbox and the phone number.

Circle any inbox or phone that shows up more than twice. That is your master key. You don't have to fix it all at once. Knowing it is there changes how carefully you treat it.

Then make a second list of the AI tools that touch your email, calendar or files. For each one, write down whose account it signs in as and what it is allowed to read. In Microsoft 365, an admin can see connected apps and their permissions. Tools on personal accounts won't appear there, so ask your staff as well. If you'd like help reading that list, our Microsoft 365 services page explains what we look at.

On our side, we moved our server keys that same evening into a locked cloud vault that keeps deleted items recoverable for 90 days. Getting an off-site backup for that automation machine is still on our list. We're telling you that because this kind of cleanup usually takes more than one evening, even for an IT company.

What to do this week

Choose your five most important accounts and write down where each one's codes go. It takes about as long as a cup of coffee.

If one inbox shows up everywhere, think about adding a second recovery path for the most critical accounts, such as a second admin or a hardware security key kept somewhere safe.

Make a list of every AI tool connected to your email and note whose sign-in it uses. Where you can, give the tool its own limited access so you can turn it off without touching anyone else's account.

Finally, check that the one machine you would miss most has a copy stored somewhere else. If you'd like someone to go through it with you, that is the kind of work we do in AI consulting and cybersecurity services for offices around Spokane and Coeur d'Alene.

Quick answers

How can I see which AI tools are connected to our Microsoft 365? An admin can see connected apps and their permissions in the Microsoft admin tools. Tools signed in on personal accounts won't show up there, so ask your staff too.

Should an AI assistant sign in as the business owner? We would avoid that where possible. Give the tool its own limited access to just the mailbox or folder it needs, so you can switch it off without affecting anyone else.

Isn't a password manager enough? It helps a lot. Still, check where its own recovery codes go. If they land in the same inbox it protects, that inbox is still the master key.

Keep reading

• Which AI Note-Taker Should a Small Office Use? We found two AI note-takers at one client. Here is why we recommend picking one, and what we suggest for Microsoft 365 offices.
• Should a Small Business AI Policy Allow AI Agents? A client's AI policy drew the line at chatbots from known sources. Here is why that rule works for most small offices, and how to back it up.
• The Six Numbers Every Business Owner Should Check Every Morning Cash, unpaid invoices, backups, patching, sign-ins and missed calls: where each one lives, and how to see them on one page.
• How Much Do Managed IT Services Cost in Spokane? (2026) Real numbers: $50 to $150 per computer per month, what moves the price, and what to ask before you sign.
• Should You Let ChatGPT Read Your Business Website? Many small business websites quietly block AI crawlers. Here is what that costs you, and how to decide.
• What Is DMARC, and Does Your Small Business Need It? One small DNS record decides whether a scammer can send email that looks like it came from you.
• All articles and guides