Your info@ mailbox is a login nobody protected

Every small business has one: the info@ address on the website, or sales@, or accounts@. Several people can see it, replies go out under it, and it does its job quietly for years. You think of it as an address — a shared inbox, not a person.

Microsoft 365 doesn’t quite see it that way. Behind most shared mailboxes sits a real user account, and that account can, under the wrong settings, still be signed into — with a password, from anywhere on the internet, often with no multi-factor authentication in the way. It’s the sort of account nobody thinks to protect, because nobody thinks of it as a login at all. To an attacker running through leaked passwords, it’s an ordinary door, generic in name, unlikely to have anyone watching it, and quite possibly never given a second factor.

That’s the quiet failure: not a missing mailbox, but a mailbox that’s also a login — and the login half is the part no one has looked at.

Why it stays invisible

When you convert or create a shared mailbox, Microsoft’s guidance is that its underlying account should have sign-in blocked — the mailbox works through the permissions of the people who share it, so the account itself never needs to log in. In a clean, modern setup that’s the default.

The gap is everything that isn’t clean and modern. A mailbox that started life as a normal licensed user and was later “turned into” a shared mailbox often keeps its old password and its ability to sign in. One set up years ago may predate the point where blocking sign-in became the norm. And because the mailbox works either way — mail flows, people read it — nothing ever prompts anyone to check whether the login is still open.

So it sits there: a valid username (your most public address), quite possibly a weak or reused password set once and forgotten, and no MFA — because MFA got rolled out to the people, and nobody counted the shared mailbox as a person. It won’t show up when you think about “who works here,” it won’t get offboarded, and it’s exactly the kind of account that password-spray attacks are built to find.

Find it yourself

You can check every shared mailbox in about ten minutes. You’ll need to be an administrator.

1. List your shared mailboxes. In the Microsoft 365 admin centre, go to Teams & groups → Shared mailboxes (or Exchange admin centre → Recipients → Mailboxes, filtered to shared). Write down each one.

2. Check whether sign-in is blocked. Still in the admin centre, go to Users → Active users and find each shared-mailbox account. You want its status to show Sign-in blocked. If it doesn’t, that account can log in.

3. Check for MFA and a licence. While you’re on each account, note whether it has multi-factor authentication registered and whether it’s holding a paid licence it doesn’t need. A shared mailbox under 50 GB shouldn’t require a licence at all — an unexpected one is often a sign it’s really a full user account in disguise.

4. If you’d rather not click through each one, an administrator can list the sign-in state of every account at once with a single PowerShell command, but the click-through above is enough to find the obvious offenders and needs no tooling.

The usual reaction is finding at least one info@ or sales@ sitting there with sign-in enabled and no second factor — a door you didn’t know was a door.

The fix

Closing this is quick, and it doesn’t interrupt anyone’s mail.

Block sign-in on every shared mailbox account. In the Microsoft 365 admin centre, under Users → Active users, open each one, choose Block sign-in, and tick Block this user from signing in. The people who share the mailbox keep reading and sending exactly as before — they’re using their own accounts’ permissions, not this login — so nothing they do changes. You’ve simply removed a way in that nobody was using on purpose.

Reset the password while you’re there. Blocking sign-in is the real fix, but resetting the account to a long random password closes the gap for good, so that even if the block were ever lifted the old, possibly-leaked password won’t work.

Drop any licence it doesn’t need. A genuine shared mailbox doesn’t need a paid licence unless it’s very large or archiving. Removing one tidies your bill and confirms the account isn’t secretly a full user.

Make it a standing check. New shared mailboxes get created as the business grows, and a mailbox converted from a real user is the easy one to miss. A note to re-run this review each quarter keeps the side door from reopening.

None of this needs a consultant or a project. It needs someone to remember that the most public address you own is also an account — and to spend ten minutes making sure it can’t be logged into.

The theme running through this one and the OAuth-grants issue is the same: the accounts and permissions nobody thinks of as accounts are the ones left unguarded. Both take ten minutes to check, and both are worth a quarterly look.