Do you need a company-wide email?

Most businesses past a handful of staff have an address like all@ or staff@ that drops one message into every inbox at once. Whether that list helps depends on what those inboxes already hold, and on who's allowed to send to it.

What the inbox already carries

Microsoft's Work Trend Index put numbers on the load in June 2025. The average worker receives 117 emails a day, "most of them skimmed in under 60 seconds", plus 153 Teams messages each weekday. People using Microsoft 365 are interrupted every two minutes by a meeting, email or notification.

Group email is growing inside that pile. "Mass emails with 20+ recipients are up 7% in the past year, while one-on-one threads are on the decline (-5%)," the report says.

An overseas study from the University of California, Irvine, measured what email traffic does to the people reading it. Informatics professor Gloria Mark and her colleagues fitted heart rate monitors to civilian staff at a US Army research centre and tracked how often they switched windows. Staff with email switched an average of 37 times an hour, against about 18 for those taken off email for five days.

"We found that when you remove email from workers' lives, they multitask less and experience less stress," Gloria said in UC Irvine's 2012 release. She added that "participants loved being without email, especially if their manager said it was OK."

Gallup's US data shows staff still want to hear from the business. In a January 2026 analysis, Gallup chief scientist Jim Harter reported that clarity about what's expected at work had dropped nine points since 2020. Asked what would help, 35% of respondents named better communication, well ahead of direction from leadership at 7%. Gallup found workers "are seeking more communication about both the direction of their company and their own individual development."

That split gives the all-staff list a narrower job. Company direction, a policy change or a site closure reaches everyone. Roster swaps, a team's project news and the lost-property notice can go to a Teams or Slack channel people join by topic, an intranet page staff come back to, or a weekly newsletter that bundles five small items into one email.

Who gets to press send

Microsoft 365 lets a business decide that in its admin settings. Microsoft Learn says an Exchange Online distribution list rejects mail from outside the organisation by default. A "specified senders" setting goes further, and if senders are on that list, "they are the only ones who can send mail to the group." A moderation option holds every message for a named moderator to approve or reject before it reaches staff.

Those settings also limit phishing. In March 2026 the National Cyber Security Centre warned that criminals were "gaining access to business email accounts and using them to send mass phishing emails that contain malicious links". Tom Roberts, NCSC Threat and Incident Response team lead, said in the alert that "As there are phishing emails coming directly from the business's genuine email address, it can make the phishing emails hard to spot as they will look legitimate".

If any staff account can post to the all-staff list, a compromised account can too. With a specified-senders list in place, only the accounts on it can. The NCSC also advises businesses to check email accounts for unknown auto-forwarding rules, to confirm an unexpected link by calling the sender, and to report suspected attacks to the NCSC.

What the Privacy Act expects

The Office of the Privacy Commissioner, which oversees the Privacy Act 2020, says sending electronic information to the wrong recipient "is the most common type of privacy breach reported to us". It received 1,093 breach notifications in the year to 30 June 2025, according to its annual report.

An all-staff send raises a second question, which is how much personal detail one colleague's news should carry to everyone else. OPC's guidance on telling staff that a colleague is sick says "an employer should apply discretion in deciding whether or not to disclose the nature of the illness, injury or condition." It adds that "A workplace is unlikely to need to know the exact reason why a person is unable to attend work."

For mass emails, OPC's advice is to "double‐check that all emails are contained in the 'Bcc' section". It also suggests delays on emails to recipients outside the business, and pop-up reminders that ask staff to check recipient addresses. "Treat an email breach as a privacy breach and respond accordingly. If it is serious you must notify the Privacy Commissioner," the guidance says.

In Microsoft 365, a business can check two settings on its all-staff list before the next send. The first is who's on the specified-senders list. The second is whether moderator approval is switched on.