Shared Mailbox Sign In

Although shared mailboxes are intended to be used in a delegated fashion, it is possible to sign into them. You should disable sign-in for all shared mailboxes unless the shared mailbox is to be accessed by a 3rd party integration or similar. Note if sign-in is required, then we suggest considering MFA for this account if possible.

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

This baseline applies per user, through a user-level scheme or an Azure group rather than to the tenant as a whole. It evaluates only accounts whose mailbox is a shared mailbox, so ordinary user accounts are unaffected.

1. Add it directly to a user or an Azure group (Adding a baseline), or bundle it into a user-level scheme and deploy that to the groups covering your shared mailboxes (Deploying a scheme). See Groups and priority for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.

2. Leave sign-in blocked; it’s the only setting on this baseline. Microsoft 365 creates every shared mailbox with sign-in blocked, so a deviation usually means someone re-enabled it later, deliberately or by mistake.

3. If a shared mailbox needs direct sign-in (most often for a third-party integration that authenticates as the mailbox itself), keep that account out of the group or scheme that carries this baseline rather than leaving sign-in open for every shared mailbox you manage.

4. Save. With Auto-remediation on, Octiga blocks sign-in the next time it finds a shared mailbox account with sign-in enabled, so exclude any account that still needs it before you turn remediation on.

Caution

Blocking sign-in immediately stops anything that uses the account’s own credentials, including a third-party integration that authenticates as the shared mailbox rather than through a licensed user’s delegated access.

Check it worked

Passing means sign-in is blocked for the shared mailbox account. To confirm it in Microsoft 365, open the Microsoft 365 admin centre, go to Users → Active users and select the account: its sign-in status reads blocked. On the user roster or a group’s member list, Passing shows as a green dot for this baseline, and Deviated (red) means sign-in is currently allowed. Users with delegated access to the mailbox notice nothing and keep using it through their own accounts; only direct sign-in with the mailbox’s own credentials stops working.

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→