Shared mailbox security in Microsoft 365, explained
Why Microsoft says to block sign-in for shared mailbox accounts, how Full Access and Send As permissions work, and how mailbox auditing records their use.
Where to start: shared mailbox security
People use a shared mailbox through their own accounts, so most of the checks are about that hidden account and who holds permissions. These are the points Microsoft's documentation raises.
- Check sign-in is blocked for each shared mailbox's own accountMicrosoft says to always block sign-in for the shared mailbox account and keep it blocked. New shared mailboxes start blocked; older ones may differ. Microsoft links to Graph PowerShell steps for blocking many accounts at once.Why Microsoft says to block sign-in
- Review who has Full Access and Send AsIn the Exchange admin center, go to Recipients > Mailboxes, select the mailbox, then Edit > Manage mailbox delegation. Full Access lets someone read and delete everything; Send As lets them send as the mailbox.Full steps for permissions
- Remove access people no longer needUse Remove in the same delegation list, then Save. When someone leaves the organisation, Microsoft's offboarding steps also cover their own account.Offboarding steps in Microsoft 365
- Check the mailbox for unexpected rules and forwardingMicrosoft lists rules that forward mail to unknown addresses, or move it to folders such as Notes or RSS Subscriptions, among the signs of a compromised account.How to check inbox rules
- Know where shared mailbox use is recordedMicrosoft says mailbox audit logging is on by default and covers shared mailboxes, including Send As and Send on Behalf by delegates. Admins can search the audit log for these records.How auditing works
- Check the licence positionMicrosoft says a shared mailbox needs no licence up to 50 GB, each person using it needs their own licensed Exchange Online mailbox, and Exchange Online Plan 2 raises the limit to 100 GB.Encryption and licensing
Based on Microsoft Learn's shared mailbox, Exchange Online and mailbox auditing pages, checked October 2026. Menus can change; Microsoft's pages have the latest steps.
Key points
- Microsoft describes a shared mailbox as a common address, such as info@ or support@, that a group of people can monitor and send email from.
- Microsoft's Exchange Online page states that creating a shared mailbox also creates an active user account with a system-generated password.
- Microsoft says people with access can't be prevented from deleting messages in a shared mailbox, and points to a Microsoft 365 group where deletion needs to be restricted.
- Microsoft states that email sent from a shared mailbox can't be encrypted, because the mailbox doesn't have its own security context.
Most small businesses have at least one address that several people answer, such as info@ or accounts@. In Microsoft 365 this is usually a shared mailbox, and Microsoft’s documentation says to always block sign-in for the shared mailbox’s own account and keep it blocked, with people reaching the mailbox through their own accounts. Because a shared mailbox often receives invoices, enquiries and password-reset emails, it is worth understanding how Microsoft says access to it works. This page explains how Microsoft’s documentation describes shared mailboxes, permissions and auditing, including why Microsoft says to block sign-in for the shared mailbox’s own account.
What a shared mailbox is
Microsoft’s Exchange Online documentation states that shared mailboxes “make it easy for a group of people in your company to monitor and send email from a common account”. When someone replies from it, the email “looks like it was sent by the shared mailbox, not from the individual user”.
Microsoft’s “About shared mailboxes” page lists typical uses: company information addresses, support addresses, and reception or front-desk mailboxes. It also notes some limits:
- Only internal people. Microsoft states that only people inside the organisation can use a shared mailbox, and that external people, such as someone with a personal email account, can’t be given access. The guide to Microsoft 365 guest access covers how outside people are given access to other resources.
- Access through people’s own mailboxes. Microsoft states that a person accessing a shared mailbox needs their own licensed Exchange Online mailbox, and that “delegate access must be done through the delegate’s own mailbox”.
- Number of users. Microsoft’s page states that a shared mailbox “supports a maximum of 25 users”. In the same entry it explains that if too many users access the mailbox at the same time, they “might experience connection failures or duplicated messages”, and points to a Microsoft 365 group for larger teams.
- Deletion. Microsoft notes that people with access can’t be prevented from deleting messages in a shared mailbox, and points to a Microsoft 365 group where deletion needs to be restricted.
Why Microsoft says to block sign-in
Behind every shared mailbox is an ordinary user account. Microsoft’s Exchange Online page states that creating a shared mailbox “also creates an active user account with a system-generated (unknown) password”.
Microsoft’s “About shared mailboxes” page is direct about how that account is meant to be used:
“A shared mailbox isn’t intended for direct sign-in by using its associated user account. Always block sign-in for the shared mailbox account and keep it blocked.”
The same page adds that the account’s password “isn’t known or intended for use”, and says not to use the account to sign in to the shared mailbox. People reach the shared mailbox through their own accounts instead, with the permissions described below.
Microsoft’s pages don’t set out a detailed security rationale. What they make clear is that the shared mailbox’s own account isn’t meant to be used at all: access comes through each person’s own account, which carries that person’s own sign-in protections. The guide to how Microsoft 365 MFA methods compare explains how those protections work.
Microsoft’s “Create a shared mailbox” page states that “by default, every new shared mailbox has sign-in blocked”. Read together with the Exchange Online page, the account exists and is active, but new ones start with sign-in blocked. Older shared mailboxes, or ones changed since, may differ. Microsoft’s create page links to its instructions for blocking sign-in with Microsoft Graph PowerShell, including for many accounts at once. Microsoft 365 Lighthouse, Microsoft’s portal for managed service providers, has a page on finding and blocking sign-in for shared mailbox accounts across customer tenants.
Permissions: Full Access, Send As and Send on Behalf
Microsoft’s documentation describes three permissions:
| Permission | How Microsoft describes it |
|---|---|
| Full Access | Lets a user “open the shared mailbox and act as the owner of that mailbox”: read, change and delete messages, and create calendar items, tasks and contacts. On its own it doesn’t allow sending. |
| Send As | Lets a user “impersonate the shared mailbox when sending mail”, so the email looks as if the mailbox itself sent it. |
| Send on Behalf | Lets a user send on behalf of the mailbox, so the email shows as “name on behalf of mailbox”. Microsoft’s Exchange Online page says this permission can’t be granted in the Exchange admin center; it’s set with the Set-Mailbox cmdlet and its GrantSendonBehalf parameter. |
Microsoft’s “Create a shared mailbox” page states that Full Access and Send As are both “required for successful shared mailbox operation”. In practice that means anyone given those permissions can read the mailbox’s contents and send email that appears to come from the business address.
A fictional example: at yourbusiness.example, Priya and Tom both answer accounts@yourbusiness.example. With Full Access, each can read every invoice in that mailbox. With Send As, a reply either of them sends shows only “accounts@yourbusiness.example” as the sender, so customers can’t tell which person wrote it. Under Microsoft’s description, the audit log, covered below, is where those Send As actions are recorded against each person’s own account.
How to see who has Full Access and Send As
Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s Create a shared mailbox page has the latest steps.
- In the Exchange admin center, go to Recipients > Mailboxes.
- Select the shared mailbox, then select Edit.
- Under Mailbox permissions, select Manage mailbox delegation.
- The list shows who holds Full Access and Send As. Add or Remove changes them; select Save to keep changes.
Microsoft’s page says new shared mailboxes are created in the Microsoft 365 admin center under Teams & Groups > Shared mailboxes (select Show all if Teams & Groups isn’t visible), by someone with the Exchange admin role.
Email that appears to come from a trusted business address is central to the fraud described in business email compromise explained. Rules that hide or forward messages are a related concern, covered in the guide to suspicious inbox rules in Microsoft 365.
How shared mailbox use is recorded
Microsoft’s Purview documentation states that “mailbox audit logging is turned on by default in all organizations”, and lists shared mailboxes among the supported mailbox types.
Microsoft records actions by three types of sign-in. A Delegate is “a user assigned the SendAs, SendOnBehalf, or FullAccess permission to another mailbox”. Microsoft lists the actions logged by default for delegates, including SendAs, SendOnBehalf, HardDelete, SoftDelete, MailItemsAccessed and UpdateInboxRules. Admins can search the audit log for these records.
Microsoft also notes that some default actions are added “subject to the user having the appropriate license”, and that audit log retention is now managed in Microsoft Purview. Microsoft’s auditing page has the details, and the guide to Microsoft 365 audit log retention and alerts explains how long records are kept.
Encryption and licensing
- Encryption. Microsoft states that email sent from a shared mailbox can’t be encrypted, because the mailbox “doesn’t have its own security context (username and password)”.
- Licensing. Microsoft states that a shared mailbox “can store up to 50 GB of data without assigning a license to it”, and that to raise the limit to 100 GB it needs an Exchange Online Plan 2 licence. Each person who uses it needs their own licensed Exchange Online mailbox. Microsoft’s pages list litigation hold and in-place archiving among the cases that need a licence; see the licensing note on this page.
Common questions
Should I block sign-in for a shared mailbox?
Microsoft’s “About shared mailboxes” page says: “Always block sign-in for the shared mailbox account and keep it blocked.” Microsoft explains that a shared mailbox isn’t intended for direct sign-in, and its account’s password “isn’t known or intended for use”. People reach the mailbox through their own accounts, with permissions. Microsoft says new shared mailboxes have sign-in blocked by default. Why Microsoft says to block sign-in has the detail.
What’s the difference between Full Access and Send As?
Microsoft describes Full Access as letting a user open the shared mailbox and act as its owner: read, change and delete messages, but not send on its own. Send As lets a user send email that looks as if the mailbox itself sent it. Send on Behalf shows “name on behalf of mailbox”. Permissions: Full Access, Send As and Send on Behalf compares all three.
Does a shared mailbox need a licence?
Not for basic use, according to Microsoft. Microsoft states a shared mailbox “can store up to 50 GB of data without assigning a license to it”, and needs an Exchange Online Plan 2 licence to raise that to 100 GB. Each person who uses it needs their own licensed Exchange Online mailbox. Microsoft lists litigation hold and in-place archiving among cases that need a licence. See Encryption and licensing.
How do I check who has access to a shared mailbox?
Microsoft’s steps: in the Exchange admin center, go to Recipients > Mailboxes, select the shared mailbox and select Edit, then under Mailbox permissions select Manage mailbox delegation. The list shows who holds Full Access and Send As, and Add or Remove changes them. How to see who has Full Access and Send As sets out the steps.
Can I see who sent an email from a shared mailbox?
Microsoft’s Purview documentation says mailbox audit logging is on by default in all organisations and lists shared mailboxes among the supported types. Actions by delegates, including SendAs, SendOnBehalf, HardDelete and UpdateInboxRules, are logged by default, and admins can search the audit log for them. How shared mailbox use is recorded explains what Microsoft records.
How many people can use a shared mailbox?
Microsoft’s page states that a shared mailbox “supports a maximum of 25 users”. In the same entry, Microsoft explains that if too many users access it at the same time, they “might experience connection failures or duplicated messages”, and points to a Microsoft 365 group for larger teams. Microsoft also says only people inside the organisation can use a shared mailbox. What a shared mailbox is lists the limits.
Related guides
- Defender for Office 365 explained
- Suspicious inbox rules
- Responding to a compromised Microsoft 365 account
- Offboarding a user in Microsoft 365, including converting a leaver’s mailbox to a shared mailbox