# Shared Mailbox Sign In

> Although shared mailboxes are intended to be used in a delegated fashion, it is possible to sign into them.

Although shared mailboxes are intended to be used in a delegated fashion, it is possible to sign into them.  You should disable sign-in for all shared mailboxes unless the shared mailbox is to be accessed by a 3rd party integration or similar.  Note if sign-in is required, then we suggest considering MFA for this account if possible.

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline applies per user, through a user-level scheme or an Azure group rather than to the tenant as a whole. It evaluates only accounts whose mailbox is a shared mailbox, so ordinary user accounts are unaffected.

1. Add it directly to a user or an Azure group ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or bundle it into a user-level scheme and deploy that to the groups covering your shared mailboxes ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). See [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/) for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.
2. Leave **sign-in** blocked; it's the only setting on this baseline. Microsoft 365 creates every shared mailbox with sign-in blocked, so a deviation usually means someone re-enabled it later, deliberately or by mistake.
3. If a shared mailbox needs direct sign-in (most often for a third-party integration that authenticates as the mailbox itself), keep that account out of the group or scheme that carries this baseline rather than leaving sign-in open for every shared mailbox you manage.
4. Save. With **Auto-remediation** on, Octiga blocks sign-in the next time it finds a shared mailbox account with sign-in enabled, so exclude any account that still needs it before you turn remediation on.

> **Caution:** Blocking sign-in immediately stops anything that uses the account's own credentials, including a third-party integration that authenticates as the shared mailbox rather than through a licensed user's delegated access.

## Check it worked

Passing means sign-in is blocked for the shared mailbox account. To confirm it in Microsoft 365, open the Microsoft 365 admin centre, go to **Users → Active users** and select the account: its sign-in status reads blocked. On the user roster or a group's member list, Passing shows as a green dot for this baseline, and Deviated (red) means sign-in is currently allowed. Users with delegated access to the mailbox notice nothing and keep using it through their own accounts; only direct sign-in with the mailbox's own credentials stops working.

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)