Shared mailbox security risks build up slowly. A shared mailbox can be safe on the day you create it. Over time, permissions pile up, people change roles, forwarding rules appear, nobody remembers why the mailbox exists, and the list of who can read it grows longer than anyone can explain. The fix is to treat each shared mailbox as something with a lifecycle, meaning a named owner, blocked sign-in on its own account, a regular access review and someone watching for changes.
This matters because the addresses involved are the ones every attacker already knows. The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the last 12 months, and phishing was the most common type, affecting 38% of businesses. Addresses such as info@, accounts@ and sales@ sit in public and attract plenty of it, and our overview of how many UK businesses were breached in 2026 shows how routine that has become.
What are the main shared mailbox security risks?
The main shared mailbox security risks are permissions that grow and never shrink, sign-in left enabled on the mailbox’s own account, Send As rights that hide who actually sent a message, forwarding rules nobody notices, and mailboxes with no owner. None is dramatic on day one. Together, over months and years, they leave more people with access than you can account for.
| Risk | How it develops | What it puts at stake |
|---|---|---|
| Permission creep | Access is added for holiday cover or a busy period and never taken away | More people can read sensitive mail than ever should |
| Movers keep old access | Someone changes role but keeps what they had before | Staff see client, HR or finance mail they no longer need |
| Sign-in left enabled | Every shared mailbox has a user account, and older or converted mailboxes may need checking | A reset or stolen credential gives direct access |
| Send As anonymity | Delegates send as the mailbox without their own name appearing | Harder to trace who sent a message |
| Hidden rules and forwarding | An attacker or a well-meaning user sets up forwarding | Mail leaks quietly for weeks or months |
| No owner | A mailbox is created for a project and then forgotten | Nobody reviews it, tidies it or switches it off |
| Mailbox as an identity | A shared address is used to register tools and services | Whoever reads the mailbox can reset those passwords |
| Retention and licensing gaps | Mail grows past limits or needs archiving, retention or legal hold | Mail stops arriving or is not kept as required |
How a shared mailbox drifts over time
For illustration, picture a finance@ mailbox set up for three people in the accounts team. In the first month the access list is short and everyone knows why. By the end of the first year, a manager has been added for cover, a temp has come and gone, a director asked for access and kept it, and someone moved to another team. The mailbox now has nine people with access and no record of why.
Nothing was done carelessly. Each step was reasonable. That is exactly how the risk grows, and it is the same pattern we describe in user access risks in recruitment firms, where fast growth leaves permissions far ahead of the process for checking them.
In our experience working with UK SMEs, shared mailboxes are the part of Microsoft 365 that nobody owns. They are not quite a person and not quite a system, so they fall between the joiner process and the leaver process. A leaver checklist for Microsoft 365 usually covers the person’s own mailbox and licences, and it should cover their access to shared ones as well.
Why attackers like shared mailboxes
Shared mailboxes tend to hold exactly what criminals want. Finance mailboxes hold invoices, remittance details and supplier conversations. HR mailboxes hold personal data. General enquiry mailboxes receive attachments from strangers all day, so a malicious one does not look out of place.
The route in is usually one of the people with access. If a delegate’s account is phished, the attacker inherits everything that person can reach, including every shared mailbox they are on. This is how business email compromise tends to unfold, with the attacker reading threads, then sending a convincing message from a trusted address asking for a payment to new bank details.
So protecting a shared mailbox largely means protecting the people who can open it. That starts with strong sign-in. Standard MFA is a good baseline, though MFA can still be phished, so move towards passkeys and phishing-resistant sign-in for anyone with delegated access to sensitive mailboxes. Make sure your anti-phishing settings in Microsoft 365 cover the people who use shared mailboxes, not only the mailbox addresses themselves.
Should you block sign-in on shared mailboxes?
Yes. Microsoft explains that every shared mailbox has a corresponding user account that is not intended for direct sign-in, and it advises blocking sign-in for that account and keeping it blocked. Microsoft also says every new shared mailbox has sign-in blocked by default, but older or converted mailboxes should still be checked. People should reach the mailbox through their own account using delegated permissions.
The reason is simple. If sign-in is enabled, an admin resetting the password or an attacker obtaining it gives direct access to the mailbox, with no useful individual identity attached and none of the controls you apply to named users. Microsoft sets this out in its guide to creating a shared mailbox. Older mailboxes are the ones to look at first, particularly any that began life as a leaver’s mailbox and were converted to shared.
If a shared password was ever handed round, anyone who knew it still held the keys until sign-in was blocked and the account secured. A zombie tech audit is a good way to find mailboxes and accounts like this that nobody has looked at for years.
Full Access, Send As and Send on Behalf
The three permission types behave differently, and most reviews only check one of them. Each needs its own look.
| Permission | What it allows | Main risk | When to grant it |
|---|---|---|---|
| Full Access | Open and manage the mailbox contents, but not send as the mailbox on its own | Sees everything, including personal data | Staff who genuinely work from the mailbox |
| Send As | Send messages that appear to come from the mailbox itself | The individual sender is not obvious to the recipient, so tracing depends on audit records | Only where sending as the address is essential |
| Send on Behalf | Send messages that show who sent them on behalf of the mailbox | Lower risk, with a clearer trail | The sensible default for most teams |
A common mistake is granting Full Access and Send As together by default, because it is quicker. Grant Send As only where the work really needs it, and record who approved it.
A practical review routine
You do not need specialist tools to get control back. You need a short routine and someone responsible for running it.
- Name an owner for every shared mailbox and write down why it exists.
- Confirm sign-in is blocked on every shared mailbox account, starting with the oldest.
- List the Full Access, Send As and Send on Behalf permissions for each mailbox and remove anything without a reason.
- Check for forwarding and inbox rules, especially anything sending mail outside the business.
- Make sure mailbox activity is audited and that someone actually looks at it.
- Remove or archive mailboxes that nobody uses.
- Review access every quarter, and whenever someone changes role or leaves.
Check the size and licensing at the same time. Microsoft’s guidance on shared mailboxes says a shared mailbox can store up to 50 GB without assigning a licence. More storage needs an Exchange Online Plan 2 licence, and archiving or litigation hold also needs the right Exchange licence or archiving add-on. The people who use the mailbox still need their own licences. A mailbox that quietly fills up can stop working at the worst possible moment, and a proper Microsoft 365 backup policy should cover shared mailboxes too.
Data protection and AI
Shared mailboxes often hold personal data, such as customer enquiries, CVs, HR matters and payment details. Under UK GDPR, you need appropriate technical and organisational measures to protect it, and the Information Commission, still commonly known as the ICO, is the regulator. Tight access makes life easier elsewhere too. You cannot answer a request properly if you do not know who can see what, as we explain in managing subject access requests, and why IT compliance matters covers the wider duty.
AI tools add another reason to tidy up. Assistants such as Copilot work with whatever a user can already reach, so loose permissions get surfaced faster. Our guide to Copilot security controls explains why access hygiene comes first. The same logic sits behind zero trust, which gives people the least access they need and keeps checking it.
Making it stick across the business
A one-off clean-up helps for a few months and then the drift starts again. What lasts is a process. Cyber Essentials treats user access control as one of its five technical controls, and the NCSC’s Cyber Essentials overview sets out what is expected. Insurers ask about it too, as we note in cyber insurance renewals.
Growing firms feel this first, because new starters and new tools arrive faster than reviews do, which is where IT support for growing businesses and a proactive IT support and management plan earn their place. Smaller firms are not exempt either, because criminals prefer 30 person companies with lighter controls.
If you have offices in several countries, apply the same rules everywhere. European IT support and global IT support for international projects help keep mailbox standards consistent, so one region does not quietly fall behind. Sensible IT consulting can design the ownership and review process, and outsourcing IT to an MSP means somebody is actually running it each quarter. Network penetration testing shows what an attacker could reach from a single compromised delegate account.
Frequently asked questions
Are shared mailboxes secure?
They can be, but only if they are managed. A shared mailbox account should not be used for direct sign-in once that access is blocked, so security depends mainly on the accounts of the people with access. Keep the access list short, protect those accounts with strong MFA, review permissions regularly and watch for forwarding rules.
Do shared mailboxes need MFA?
You should not sign in to the shared mailbox account at all, so block it instead. What needs MFA is every person who has delegated access, because their account is the way in. Phishing-resistant sign-in such as passkeys is better still for anyone with access to finance or HR mailboxes.
How do I see who has access to a shared mailbox?
Use the Exchange admin centre or PowerShell to list three things for each mailbox. Check Full Access, Send As and Send on Behalf, because each is granted separately and checking only one misses the others. Compare the list with who should have access, and remove anyone without a clear reason.
Does a shared mailbox need a licence?
Not by itself, up to 50 GB. Microsoft says more storage, archiving, litigation hold or some advanced compliance and security features can require an Exchange licence or add-on. The people who open the mailbox still need their own Exchange Online licences, so a shared mailbox is not a way to avoid licensing users.
Get shared mailboxes back under control
Shared mailboxes are useful precisely because they are simple, and that is why they get forgotten. A named owner, blocked sign-in, a short access list and a quarterly review stop the slow drift into risk. Northern Star helps businesses review and tidy their Microsoft 365 access, backed by managed IT support in London and a team that explains what it finds in plain English. Call 0800 319 6032 or request a callback to review who can reach your shared mailboxes today.
