Guide · Security
A licensed mailbox with a password everyone knows and MFA switched off is a licensing breach and the softest target in the tenant. The fix is free, takes twenty minutes, and loses nothing.
By Alex Makey · 6 September 2026 · 6 min read · Verified against Microsoft documentation, September 2026
A licensed user mailbox, one password, four people. It is in almost every small company we audit, usually called info@ or sales@, and usually with multi-factor authentication switched off “because it kept asking everyone”. It is a licensing breach, a security hole, and the fix is free. Here is why it matters and how to do it in twenty minutes.
Licensing. Microsoft licences are per named user. One licence, one person. Four people signing in as one account is four people using one licence, and the terms say so plainly. Nobody is going to raid the office over an info@ mailbox, but it is the kind of thing that turns up in an audit or a due-diligence review and looks careless.
Security. A shared password cannot have MFA, because MFA needs a second factor that belongs to a person. So the account is protected by a password alone — one that four people know, that has been typed into four browsers, and that nobody changes when one of the four leaves. It is the most attacked kind of account in a tenant and the least defended.
Accountability. When a message is sent from it, nobody knows who sent it. When it is used to reset another account’s password, nobody knows who did that either.
Cost. It is paying for a licence that the correct configuration does not need.
A mailbox with no sign-in of its own. Nobody logs in as it. Instead, named users are given permission to it, and it appears in their Outlook alongside their own mailbox. They read it, reply from it, and every action is logged against the person who took it. It needs no licence up to 50 GB.
Everything the four people were doing with the shared password, they can do this way: send as it, reply from it, see the same folders, use the same calendar. What changes is that they do it as themselves.
1. Confirm who needs access. Ask. The answer is usually fewer people than have the password.
2. Convert the mailbox. While the licence is still assigned:
Set-Mailbox -Identity info@contoso.com -Type Shared3. Grant access. Full Access to read, Send As to send from the address:
Add-MailboxPermission -Identity info@contoso.com -User alice@contoso.com -AccessRights FullAccess -AutoMapping $true
Add-RecipientPermission -Identity info@contoso.com -Trustee alice@contoso.com -AccessRights SendAs -Confirm:$falseRepeat for each person, or put them in a mail-enabled security group and grant the group.
4. Block sign-in on the shared mailbox’s account. Entra admin centre → the user object → Block sign-in. A shared mailbox does not need to sign in and should not be able to.
5. Change the password anyway, to something nobody knows, so the old shared one is dead.
6. Remove the licence. Only after step 2 has completed. Confirm with Get-Mailbox info@contoso.com | Select RecipientTypeDetails — it should say SharedMailbox.
7. Tell the four people. The mailbox appears in their Outlook automatically within an hour or so; on mobile they add it as a shared mailbox. Sent items from a shared mailbox land in the shared mailbox’s Sent folder if you set:
Set-Mailbox -Identity info@contoso.com -MessageCopyForSentAsEnabled $true -MessageCopyForSendOnBehalfEnabled $true“We will lose the mail.” Nothing moves. The mailbox is the same object with a different type. Every folder, message and calendar entry stays.
“The phone app needs a password.” Outlook mobile opens shared mailboxes under the user’s own account. No separate sign-in.
“We use it for a service that logs in.” A scanner, a website contact form, a ticketing system sending mail. That is the one case where something needs to authenticate as the address, and the answer is not a shared password for humans plus one for a machine. Use a dedicated sending account with an app password or, better, an application registration with Graph permissions, and keep it out of the humans’ hands.
“It is over 50 GB.” Then it needs an Exchange Online Plan 2 licence after conversion — still far cheaper than the full licence it had, and still converted. The options are the same as for a large leaver mailbox.
If there is one, there are more. A quick way to find them: licensed mailboxes whose sign-in logs show several devices, several locations, or several browsers within the same hour. Get-MgAuditLogSignIn filtered by user and grouped by device will show it. Each one is a licence to recover and a password to retire.
One email a month, at most
Postmortems, timelines, licensing changes that cost people money. If a month has nothing worth your time, you hear nothing.
Please enter a work email address.
Done. Unsubscribe by replying to any email; we will not argue.
Related questions
Yes. Microsoft 365 licences are per named user. Several people signing in as one licensed account is a breach of the terms, quite apart from the security problem of a shared password with no MFA.
Convert it to a shared mailbox and grant each person Full Access and Send As permissions. Nobody signs in as it; it appears in each person’s Outlook and every action is logged against the person. No licence needed up to 50 GB.
No. The mailbox is the same object with a different type. Folders, messages and calendar entries all remain.
Block sign-in on the account in the Entra admin centre and change the password to something nobody knows. A shared mailbox does not need to sign in.
Do not give a machine the shared human password. Use a dedicated sending account with an app password, or an application registration with the specific Graph permission, and keep it separate from people.
Rather not do this yourself?
Describe the situation and you get back a sequence, an honest view of what will be slow, and a fixed price — usually within one business day. Or ask one question and get one answer.