Shared mailboxes: why you should block sign-in on their user accounts

A hidden user account behind every shared mailbox

When you create a shared mailbox, Exchange Online provisions a user object in Entra ID, with a UPN and a generated password. Nobody is supposed to use it directly: people open the mailbox through Full Access, Send As or Send on Behalf permissions, using their own identity.

The most common scenario, however, is a converted user mailbox: an employee who left, or a "contact@" address originally created as a named account. The original account keeps its password, sometimes known by several people, sometimes reused elsewhere.

Why an enabled account is a target

A shared mailbox account that can still sign in combines several weaknesses:

• it has no identified owner, so nobody notices an unusual sign-in;
• it is often left out of MFA registration campaigns because "it is not a real user";
• it may fall outside Conditional Access policies that target groups of licensed users;
• its address is public (billing, support, recruitment), which makes it an ideal password spraying target.

An attacker who takes it over can read sensitive conversations, send convincing messages from a trusted address and, depending on configuration, reach other Microsoft 365 resources.

Blocking sign-in without breaking delegated access

Blocking sign-in (setting accountEnabled to false) does not affect delegated access: authorised users keep opening the mailbox with their own credentials. This is also Microsoft's recommendation. You can block sign-in from the Microsoft 365 admin center or with Microsoft Graph PowerShell.

$shared = Get-EXOMailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited
foreach ($mbx in $shared) {
    $u = Get-MgUser -UserId $mbx.ExternalDirectoryObjectId -Property AccountEnabled,UserPrincipalName
    if ($u.AccountEnabled) { $u.UserPrincipalName }
}

This script lists shared mailboxes whose account is still enabled. Once the list is reviewed, Update-MgUser -AccountEnabled:$false is all you need for each one.

Licensing: handle with care

A shared mailbox generally does not require a licence as long as it stays under a certain size and does not use features such as online archiving or litigation hold. The exact conditions change over time and depend on your agreement, so check the current Microsoft documentation. The key point is that an assigned licence is never a reason to leave sign-in open.

What an audit checks

• shared mailboxes whose account is still allowed to sign in;
• recent successful sign-ins on those accounts;
• converted accounts whose password was never changed;
• Full Access and Send As delegations granted to inactive or external accounts.