Almost every small office I visit in the Magic Valley and the Wood River Valley has one: an info@ or office@ address that the whole front desk signs in to with the same password. We see it with our remote clients around the country too. It works, so nobody thinks twice about it.

Until something goes wrong.

Why one shared login is a problem

  • Someone leaves. Everyone who ever worked the front desk still knows the password. To lock out one person, you have to change it for everyone, so it rarely gets changed.
  • Phishing. If one person types that password into a fake sign-in page, the attacker now has your main business address, plus everything in it.
  • No accountability. When an odd email goes out from info@, there's no way to tell who sent it.
  • The sticky note. A password that five people need ends up taped under a keyboard or on the monitor. I've found more than a few.
  • MFA gets awkward. Multifactor authentication is tied to one phone, so a shared login usually ends up with weak MFA, or none.

What a shared mailbox is

A shared mailbox is a mailbox in Microsoft 365 that a group of people can read and send from. It keeps your info@ address and its own inbox and calendar, but nobody signs in to it directly. Microsoft blocks direct sign-in to shared mailboxes by default, and recommends keeping it blocked.

Instead, each person opens it with their own Microsoft 365 account, protected by their own password and MFA.

It doesn't need a license of its own

A shared mailbox can hold up to 50 GB without a license. The people using it need their own Exchange Online mailbox, which your staff already have if they use Microsoft 365 email.

A license is needed if the mailbox grows past 50 GB, uses an archive, or is placed on litigation hold. Most office mailboxes never get close.

Who sent that?

When we set one up, we decide how replies should look:

  • Send As: the email looks like it came from info@ itself.
  • Send on Behalf: it shows the person's name "on behalf of" info@, so the customer sees who replied.

Either way, you can still tell whose account sent it.

When someone leaves

This is my favorite part. You remove that one person's access, and nobody else's routine changes. No new password to pass around, and no sticky note to rewrite.

It just shows up in Outlook

Once someone is given access, the shared mailbox usually appears in their desktop Outlook folder list on its own after they close and reopen Outlook. It also works in Outlook on the web and in the Outlook phone app.

If you already have a shared login, you don't need to start over. An existing mailbox can be converted into a shared mailbox, so the address and old email stay put. It's a small change that closes a big gap, and it's one of the first things I look for when I start working with a new office.

#microsoft 365#outlook#email#security