Can an Employee Take Back Access to Their Mailbox?

Yes, at any time, without asking anyone. Each employee grants access on the mail provider’s own consent screen and can revoke it there.

The Employee Grants Access, and Can Take It Back

Each employee connects their own mailbox on Microsoft's or Google's own consent screen, and can revoke it at any time without asking anyone.

What Happens Next

Once access is revoked, nothing more is read from that mailbox. Contacts the employee already released stay in the CRM with their provenance. Contacts they never released are not shared.

Company-Wide

The company can also end access for everyone at once by removing the application registration it owns. See RelationLens.