How to block sign-in to shared mailboxes

What this check looks at

Checks that the Entra account behind every shared mailbox is blocked from signing in, so the mailbox is reached only through the people given access to it.

A shared mailbox in Exchange Online is backed by a user account in Microsoft Entra ID. People reach the mailbox through Full Access, Send As or Send on Behalf permissions on their own accounts; nobody needs to sign in as the mailbox itself. Exchange gives a new shared mailbox a password nobody knows, but its account is still enabled for sign-in, and a user mailbox converted to shared, the usual way to keep a leaver’s mail, keeps its old password and any MFA methods.

The check lists every shared mailbox and looks up its Entra account. It fails when any shared mailbox account allows sign-in, and warns when for some accounts it cannot tell (the account was not read and Exchange did not say); it passes when sign-in is blocked for all of them. The evidence lists up to 25 of the accounts that allow sign-in.

An enabled shared mailbox account is an ideal target for password spraying: its address is usually printed on the website (info@, accounts@, sales@), its password is often an old leaver’s or one an administrator set long ago, and shared accounts are often left out of MFA because nobody can answer the prompt. Once in, the attacker holds the mailbox that handles invoices or customer enquiries.

Why it matters

Every shared mailbox has an account with a password nobody manages and usually no MFA. If sign-in is allowed, a password spray that guesses it gets straight in. Blocking sign-in costs nothing: people with access keep it.

The accounts@ mailbox of a 25-person wholesaler is a perfect launch point for invoice fraud, because it already writes to every customer about payments. An attacker who guesses or reuses its password can send change of bank details messages from the real address, and read the replies, without touching any named person’s account or triggering their MFA.

Blocking sign-in costs nothing and changes nothing for the people who use the mailbox, as they open it with their own accounts and their own MFA. It also removes a class of accounts that is easy to forget in access reviews and leaver processes.

CIS Microsoft 365 Foundations Benchmark 1.2.2 asks for sign-in to shared mailboxes to be blocked. NIST CSF 2.0 PR.AA-05 (access managed with least privilege), ISO 27001 A.5.16 (identity management) and A.8.5 (secure authentication), CIS Controls v8 5.1 and NCSC CAF B2.a all expect every enabled account to have an owner and a reason to exist.

How to fix it

Where: Microsoft 365 admin centre → Users → Active users

Before you start

• Check none of the shared mailbox accounts is signed in to directly by a device or app (sign-in logs, filter on the account). Give such a device its own account first.

Step by step

1. 1Check nothing signs in as the mailbox. In the Microsoft Entra admin centre, go to Entra ID > Monitoring & health > Sign-in logs, filter by each shared mailbox account in the evidence and look at the last 30 days of interactive and non-interactive sign-ins. Successful sign-ins mean a person, device or app (a scanner, a CRM, an old phone) uses the account directly; give it its own account or a connector before blocking.
2. 2Block sign-in in the Microsoft 365 admin centre. In the Microsoft 365 admin centre, go to Users > Active users and select the shared mailbox account. In the panel select Block sign-in, tick Block this user from signing in and select Save changes. Repeat for each account in the evidence.
3. 3Or block them all in PowerShell. Connect with Connect-ExchangeOnline and Connect-MgGraph -Scopes User.ReadWrite.All, then run Get-EXOMailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited | ForEach-Object { Update-MgUser -UserId $_.ExternalDirectoryObjectId -AccountEnabled:$false }. This blocks every shared mailbox account in one go.
4. 4Handle accounts synced from Active Directory. If a shared mailbox account is synced from on-premises Active Directory by Entra Connect, the cloud setting cannot be changed. Disable the account in Active Directory Users and Computers (or with Disable-ADAccount) and let the next sync carry the change to Entra ID.
5. 5Revoke sessions where the account was used. For any account whose sign-ins you cannot explain, open it under Entra ID > Users, select Revoke sessions, and review the mailbox’s inbox rules, forwarding and sent items as you would for a compromised account.
6. 6Confirm the accounts are blocked and the mailboxes still work. In Users > Active users each shared mailbox account should show sign-in blocked, or run Get-MgUser -UserId <object id> -Property AccountEnabled | Format-List AccountEnabled and check it is False. Ask someone with access to open the mailbox in Outlook and send from it. Any later sign-in attempt fails with error 50057 (account disabled) in the sign-in logs. The next assessment passes.

With PowerShell

Get-EXOMailbox -RecipientTypeDetails SharedMailbox | ForEach-Object { Update-MgUser -UserId $_.ExternalDirectoryObjectId -AccountEnabled:$false }

What users will notice

Nobody can sign in as the shared mailbox. People with access to it keep opening it from their own account.

How to confirm it worked

Microsoft 365 admin centre, Active users: each shared mailbox account shows "Sign-in blocked".

Frameworks and controls

This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Block sign-in for the shared mailbox account (Microsoft Learn)

Related checks

• How to restrict who can create shared Bookings pages
• How to set up user risk and sign-in risk policies
• How to block device code sign-in with Conditional Access
• How to set up the sign-in risk policy in Conditional Access

The full Microsoft 365 security checklist, worst first