Microsoft’s shared-mailbox overview describes shared mailboxes for addresses used by multiple people, such as support or reception. It says delegates should access through their own licensed Exchange Online mailboxes and that the associated shared-mailbox account is not intended for direct sign-in. Microsoft instructs administrators to block that sign-in and keep it blocked.
\nMicrosoft’s recipient-permissions documentation distinguishes Full Access, Send As, and Send on Behalf. These permissions produce different capabilities: opening mailbox contents is not the same as sending with the mailbox identity. Microsoft also documents licensing and feature conditions that can apply based on mailbox size, archive, hold, Defender, Purview, and other use.
\nLicensing and service limits change, so the current Microsoft service description and tenant entitlements must be checked. Retention, litigation hold, privacy, records, labor, and industry obligations require qualified governance or legal input. Blocking direct sign-in does not remove delegated access, application access, forwarding, rules, or content already copied elsewhere.
\n\nCreate a register for every shared mailbox: SMTP addresses, purpose, business owner, technical owner, delegates by permission, approved send behavior, applications, forwarding, data classification, retention or hold, license, expected volume, continuity use, review date, and closure trigger. A mailbox without an accountable business owner should be escalated, not automatically preserved forever.
\nReview high-impact mailboxes more frequently and after owner, team, vendor, application, or business-process change. Monitor permission changes, sign-in enablement, forwarding, unusual sending, rule creation, and administrative modifications through the tenant’s available audit and alerting capabilities. Investigate a mailbox account that authenticates directly.
\nThe review record should distinguish business approval from technical verification. An owner approves who needs what; administrators prove the resulting permissions, sign-in state, rules, licensing, and controls. That separation turns a shared mailbox from an inherited convenience into an accountable communications service.
\nFor the review sample, use both directions: start with delegates and confirm their authorized mailbox need, then start with mailboxes and confirm every delegate and send permission. Send a controlled message only where appropriate to prove display identity and reply handling. Stop closure if a legal hold, application, regulated record, customer-facing address, or continuity process has no approved disposition; resolve ownership before changing delivery.
\n\n