How to Secure Shared Inboxes in Microsoft 365

Almost every small business has them: info@, accounts@, sales@, bookings@. Shared inboxes are where enquiries arrive, invoices get paid and customers get answered. They are also one of the least checked parts of most Microsoft 365 setups.

That matters, because these inboxes hold exactly what criminals want: supplier bank details, invoices, customer information and a trusted email address they can send from. The UK Government’s Cyber Security Breaches Survey 2026 found that 46% of small businesses had a cyber security breach or attack in the last year, with phishing (fake emails designed to trick staff) by far the most common type.

The good news is that securing shared inboxes is not a big project. Here is what to check and why.

What is a shared mailbox?

In Microsoft 365, a “shared mailbox” is an inbox that several people can open from their own Outlook. Nobody logs in to it directly. Instead, each person signs in with their own account, and Microsoft 365 gives them permission to see the shared inbox alongside their own.

That is the safe way to do it. But many shared inboxes were set up years ago, or in a hurry, and we often find one of these:

• An info@ address that is really a normal user account, with one password that the whole office knows.
• A former employee’s mailbox turned into a shared mailbox when they left, with their old password still working.
• Everyone in the business having access to accounts@, “just in case”.
• Nobody being sure who can send emails as the company.

Each of these is a door left open. Here is how to close them.

1. Stop anyone signing in to it directly

A shared mailbox should never have its own password that people type in. If it does, that password usually ends up on a sticky note, in a WhatsApp group or in the head of someone who left two years ago. It also means the inbox can’t be protected by two-step sign-in (a code from your phone as well as your password), because there is no one person whose phone it is tied to.

Microsoft recommends blocking direct sign-in for shared mailbox accounts, and new shared mailboxes now have sign-in blocked by default. Older ones may not, so it is worth checking:

• In the Microsoft 365 admin centre, go to Users > Active users and find each shared mailbox.
• Check that sign-in is blocked.
• If one of your shared inboxes is really an ordinary user account with a shared password, convert it to a proper shared mailbox and give people access through their own accounts instead.

Once that’s done, everyone who opens the shared inbox does so through their own sign-in, with their own two-step check. If someone leaves, you remove their access and nothing else changes.

2. Tidy up mailboxes from people who have left

Turning a leaver’s mailbox into a shared mailbox is a common and sensible way to keep their emails without paying for a licence. But there is a catch that catches many businesses out.

Microsoft’s own guidance says that if you don’t reset the password when you convert the mailbox, the original username and password will continue to work after the conversion. In other words, the person who left, or anyone who has stolen their old password, may still be able to get in.

So whenever you convert a leaver’s mailbox:

• Reset the password and block sign-in at the same time.
• Decide who actually needs to read those emails, and give access only to them.
• Set a date to review it. Many old leaver mailboxes can be archived or removed after a few months.

Our new starters and leavers checklist covers this and the other accounts that tend to be forgotten when someone moves on.

3. Check who has access, and what kind

There are three different kinds of permission on a shared mailbox, and it helps to know the difference:

• Full access: the person can open the inbox, read, move and delete emails.
• Send as: emails they send look as if they came from the shared address itself, such as accounts@yourbusiness.co.uk.
• Send on behalf: emails show as “Jane Smith on behalf of Accounts”.

Over the years, access tends to grow: holiday cover, a manager added to keep an eye on things, a temp never removed. Before long half the business can read the accounts inbox and send emails as it.

Every few months, list who has access to each shared inbox and ask a simple question: does this person need it for their job today? Pay particular attention to finance inboxes, because “send as” access to accounts@ is exactly what a criminal needs to send a convincing fake request to change bank details. We explain why too much access is such a common risk in our article on staff data access.

4. Make sure every person with access is properly protected

A shared inbox is only as secure as the weakest account that can open it. If six people can open accounts@ and one of them has no two-step sign-in and reuses an old password, that is the way in.

Check that everyone with access to a shared inbox:

• Has two-step sign-in switched on, ideally using the Microsoft Authenticator app rather than text messages.
• Uses a unique password, not one shared with other websites.
• Has had some basic training on spotting fake emails, especially fake invoices and “we’ve changed our bank details” messages.

5. Keep an eye on what happens inside it

Criminals who get into a mailbox often stay quiet for weeks, reading emails and waiting for a big invoice. A common trick is to set up a hidden inbox rule that moves certain emails out of sight or forwards copies elsewhere, so the real staff never see the replies.

It’s worth checking shared inboxes now and then for:

• Inbox rules nobody remembers creating, especially ones that move, delete or forward emails.
• Automatic forwarding to outside email addresses.
• Sent emails that nobody in the team recognises.

If you find anything odd, don’t just delete it. Change passwords for everyone with access, and get advice, because it may mean an account has been taken over. Our guide to business email compromise explains what usually happens next and how to respond.

A quick note on licences and size

Shared mailboxes usually don’t need a paid licence, which is one reason they are so popular. Microsoft’s rules say a licence is needed if a shared mailbox has more than 50 GB of email in use, uses an online archive, or is placed on litigation hold (kept for legal reasons). If your busiest shared inbox has been collecting email for ten years, it is worth checking its size so it doesn’t quietly stop working or need an unexpected licence.

How often should you check?

For most small businesses, a quick review every quarter is plenty, plus a check every time someone joins, leaves or changes role. It takes a few minutes per inbox.

If you’d rather not think about it, this is the kind of housekeeping we do as part of our cyber security service: checking access, watching for suspicious inbox rules and making sure leavers are fully removed, all included in our fixed monthly price.

Need a hand?

If you’re not sure who can get into your shared inboxes, or whether old passwords still work, we’re happy to take a look. Our free Get It Green IT audit checks your Microsoft 365 setup, including shared mailboxes, and gives you a simple red, amber and green report of what needs attention.

Book a free IT audit or a 30-minute call and we’ll help you get it sorted.