Instead, users who have permission to access the shared mailbox can use their credentials.

One of the leading security risks with Exchange Online shared mailbox is that it does not require a password from a delegated mailbox or license to access. However, shared mailboxes also pose security risks that must be addressed and mitigated. Allows multiple users to monitor and reply to emails sent to an email address.Įxchange Online, the cloud-based email service from Microsoft, offers shared mailboxes as a feature for its customers.Allows departments that provide centralized services to employees to respond to employee questions.Provides a generic email address that customers can use to inquire about your company.Note: There are a few ways to access a shared mailbox – directly is one of them. In Exchange 2003 and earlier, shared mailboxes were just regular mailboxes to which an administrator could grant delegate access. Once that’s done, users sign into their mailboxes and access the shared mailbox by adding it to their Outlook profile. To access a shared mailbox, users must first be granted Send As or Full Access permissions to the mailbox. What is Shared MailboxĪ shared mailbox is a type of user mailbox. This post provides a specific security risk with Shared Mailbox in Exchange Online, how to attack it, and block sign-in with a few tips and commands. One of them is the “hidden object” in Azure AD. Because a shared mailbox allows multiple users to access the same mailbox, it has security gaps. Organizations primarily use a shared mailbox for users who left or, if we need to collaborate, an inbox for multiple users. A Shared Mailbox is available from the early days of the Exchange servers, and the same is for Exchange Online.

Exchange online shared mailboxes