What this check looks at
Finds shared mailboxes that need a licence and hold none. A shared mailbox needs no licence, unless it has an archive, is on litigation hold or holds more than 50 GB; then Microsoft requires an Exchange Online licence. Whether the licence is the right plan for a hold or an archive is not checked here.
A shared mailbox needs no licence of its own, which is why converting a leaver’s mailbox to shared is a common saving. Microsoft makes three exceptions: a shared mailbox needs an Exchange Online licence if it has an archive, if it is on litigation hold, or if it holds more than 50 GB.
This check reads Exchange’s list of shared mailboxes, whether each has an archive or a litigation hold, and its size from the mailbox usage report, then looks at the licences on each one’s account. It fails when a shared mailbox needs a licence and its account holds no licence with an Exchange Online mailbox plan. It does not check whether the plan is the right one (Plan 2 for a litigation hold, for example). Where the usage report gives no size, or the account is not found, it says so rather than pass.
The usual cause is a leaver’s mailbox converted to shared on purpose to keep it, often under a hold, and its licence then removed to save money.
Why it matters
A shared mailbox on litigation hold or with an archive but no licence is outside Microsoft’s licensing terms, and the hold or archive it relies on for records may not be what it seems. It often follows a leaver’s mailbox being converted to shared and its licence removed to save money.
At a 40-person firm, a departed director’s mailbox is converted to shared and placed on litigation hold for a dispute, then its licence is reclaimed in a tidy-up. The mailbox is now outside Microsoft’s licensing terms, and the firm is relying on a hold that it is not licensed to keep.
Licensing it is a small monthly cost set against records the business decided to keep. Where the hold or archive is no longer needed, removing it ends the need for the licence instead.
ISO 27001 A.5.33 (protection of records) and CIS Controls 3.4 (enforce data retention) expect records kept for legal or business reasons to be kept reliably.
How to fix it
Where: Microsoft 365 admin centre → Users → Active users (the shared mailbox’s account) → Licences and apps
Before you start
- Ask whoever owns the records whether each hold or archive is still needed before removing it.
Step by step
- Confirm each mailbox still needs what it has. For each shared mailbox in the evidence, ask whoever owns the records whether the litigation hold or archive is still needed, or why it holds more than 50 GB.
- License the ones that still need it. In the Microsoft 365 admin centre, open Users > Active users, find the shared mailbox’s account, and on Licences and apps assign an Exchange Online licence: Exchange Online Plan 2 for a litigation hold, or Plan 1 with Exchange Online Archiving for an archive.
- Or remove what needs the licence. Where the hold or archive is no longer needed, release it in line with your retention policy, or move content out to bring the mailbox under 50 GB. Then it needs no licence.
- Confirm. The finding clears at the next assessment once each listed shared mailbox is licensed or no longer needs a licence.
What users will notice
None: assigning a licence to a shared mailbox changes nothing for the people who use it.
How to confirm it worked
Each listed shared mailbox’s account shows an Exchange Online licence, or its hold, archive or size no longer needs one.
Frameworks and controls
This check maps to controls in 5 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| ISO 27001:2022 | A.5.33 Protection of records |
| CIS Controls v8.1 | 3.4 Enforce data retention (IG1) |
| NIST CSF 2.0 | ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- About shared mailboxes (Microsoft Learn)