Shared mailboxes in Microsoft 365: why an SME should not share passwords

Shared mailbox versus shared password

In Microsoft 365 a shared mailbox is meant for addresses such as info@, sales@ or support@: the mailbox has no password of its own for signing in. Employees open it from their own Outlook or Outlook on the web after you grant Full Access (and optionally Send As or Send on Behalf). A named-user account with a shared password is not a shared mailbox: everyone signs in as the same identity. That feels the same in the inbox — until you need logging, MFA or offboarding.

In practice: with a real shared mailbox, audit stays on the named user; with a shared password you share one key and one MFA profile (often: no MFA at all).

Why “info@ on one login” is risky

Three situations keep returning in SMEs. Audit: you want to know who answered a complaint or sent a quote; with one shared account you only see “info@”. MFA: multifactor authentication belongs to a person; a shared password invites turning MFA off or parking the authenticator app on one phone. Leaver: when someone leaves and still knows the password, access stays open until you reset it — and then every remaining colleague needs the new password. That is not a theoretical edge case; it is the usual failure mode of shared credentials.

See also our pieces on admin accounts (separate privilege, no day-to-day sharing) and turning on MFA in Microsoft 365: MFA only works when every sign-in is a named user.

What you should decide in writing

Keep it short enough to decide this quarter:

• which shared mailboxes exist (info@, sales@, …) — and whether any “fake shared” named users with a shared password still need converting;
• who owns each mailbox (not “everyone in the office”);
• who has Full Access and who may Send As / Send on Behalf — and why;
• that MFA is required on the named users tied to that mailbox;
• review on joiner and leaver: add or revoke rights, tied to your joiner and leaver checklist;
• whether guests or partners may ever reach that mailbox (usually not) — see also guest accounts.

Write those points on one page. That is your mailbox policy; the tenant follows that text.

What Floor ICT configures — and what you decide

In the Microsoft 365 tenant we typically: create shared mailboxes or convert from a named user with a shared password; set Full Access and Send As on named users; expect MFA on those accounts; run a periodic rights inventory; and include shared-mailbox rights in joiner/leaver processes. We help clean up “info@ as an ordinary user account” where that still exists.

You still decide: which addresses may be shared, who may mail on behalf of the company, and how strict the review is. Technical toggles without ownership do not fix “everyone still knows the old password”; policy without configuration does not either.