A shared mailbox in Microsoft 365 lets multiple people send and receive email from one address, info@ or support@ are common examples, without any of them needing a personal license for that address or treating it as a separate inbox to manage. Configured well, it keeps role-based communication simple to run. Configured poorly, it creates the problems this article walks through: confusion, security exposure, and storage headaches. As a Pittsburgh-area managed IT provider, CyberJaz configures and troubleshoots shared mailboxes for small and medium businesses every week, and the same handful of details trip people up almost every time. Here’s what administrators and IT managers actually need to know.
What is a shared mailbox, and when should you use one?
A shared mailbox is a mailbox that multiple users can access and send email from, typically tied to a role or department rather than one individual. The most common examples are a general company contact inbox (info@), a customer support or help desk address (support@), and a reception or front-desk mailbox.
Users with the right permissions can send email as the shared mailbox address itself, or send on behalf of it, and the distinction matters because it changes what the recipient sees. Sending as the mailbox shows only the shared address as the sender. Sending on behalf of it shows both the individual user and the shared mailbox, so recipients can tell who actually wrote the message.
Shared mailboxes are built for people inside your organization. External contacts can email the shared address without any trouble, but they cannot be added as members with the same access internal users get. For the full technical rundown of what a shared mailbox can and cannot do, see Microsoft’s own shared mailbox documentation. If you need real collaboration with people outside the company, such as a shared calendar or document library alongside the inbox, a Microsoft 365 Group is usually the better fit, depending on what those outside users need to access and do.
Does a shared mailbox need its own license?
Only up to a point. A shared mailbox in Microsoft 365 doesn’t require its own license as long as its storage stays under 50 GB, though every user who accesses it still needs their own licensed Exchange Online mailbox (Exchange Online is the hosted email service behind Outlook and every Microsoft 365 mailbox). Your organization also needs a Microsoft 365 plan that includes Exchange Online to create a shared mailbox at all. Microsoft 365 Apps for Business doesn’t include Exchange Online. Microsoft 365 Business Standard does.
Past 50 GB, the free ride ends. Getting to 100 GB requires assigning the shared mailbox an Exchange Online Plan 2 license, and Microsoft’s published Exchange Online service limits spell out exactly where those thresholds sit. You’ll also need the right licensing to turn on in-place archiving, preserve mailbox content under a litigation hold (a setting that blocks anyone, including the user, from permanently deleting mailbox content while a legal matter is open), or use advanced compliance tools such as Microsoft Purview’s eDiscovery, which searches and exports mailbox content during an investigation, and its retention policies, which control how long that content is kept in the first place. Plan for these thresholds before they become a problem. A support mailbox that has been collecting attachments for three years hits 50 GB faster than most administrators expect, and catching that early is the same discipline behind avoiding common IT budgeting mistakes more generally: know your ceilings before you hit them, not after.
How do permissions, membership, and sign-in work?
Permissions to a shared mailbox are granted through the Microsoft 365 admin center by adding users as members, which gives you a clean, auditable way to hand out access without ever sharing a password. It’s the same zero trust access model at work in the rest of your Microsoft 365 environment: grant only the access a person actually needs, and review it periodically instead of leaving it in place indefinitely.
Every shared mailbox has a system-generated account behind it, but that account isn’t meant for anyone to sign into directly. Microsoft’s guidance is blunt: block sign-in for the shared mailbox account and keep it blocked. Leaving it open turns a mailbox nobody actively monitors into an easy target for identity-based attacks, since a compromised account with no single owner watching it can go unnoticed far longer than a personal one would. Users should always reach the shared mailbox through their own individual accounts instead, protected by current password guidance and multi-factor authentication, never through the shared account’s own sign-in.
Shared mailboxes also cap out at 25 concurrent users, meaning 25 people actively connected at the same time. Push past that and people start seeing connection failures and other odd behavior. Organizations that regularly need broader concurrent access, a large support team, for example, should look at consolidating sign-in with single sign-on or moving that use case to a Microsoft 365 Group instead, since Groups are built on a different architecture designed for larger user populations.
Can you access a shared mailbox from a phone or tablet?
Yes. Shared mailboxes work in Outlook on the web, Outlook on the desktop, and the Outlook mobile apps for iOS and Android. On desktop and web, the shared mailbox usually appears automatically as an extra folder next to your own inbox once you’ve been added as a member. On mobile, you’ll typically need to add it manually through the app’s account settings, though the process itself is quick.
One real limitation worth knowing about: email sent from a shared mailbox cannot be encrypted with a standard per-user encryption key, because the mailbox has no individual security context of its own to attach one to. If one member encrypts a message with their personal key through Microsoft Purview Message Encryption, other members of the same shared mailbox may not be able to open it. For a mailbox handling anything sensitive, that’s worth planning around rather than discovering after the fact.
Common shared mailbox setup mistakes to avoid
Two issues catch administrators more often than anything else.
First, creating a shared mailbox with an address already in use elsewhere in the tenant, as a mailbox or an alias, throws a proxy address conflict error (a rejection that happens because Microsoft 365 won’t let two objects claim the same email address). The fix is either to use Exchange Online PowerShell to create mailboxes that share an alias across different domains, or to create the mailbox under a temporary name and rename it afterward in the admin center.
Second, a brand-new shared mailbox sometimes throws a permissions error the first time someone tries to send from it, even when the permissions were assigned correctly. That’s almost always a replication delay on Microsoft’s end, the mailbox is still propagating across data centers, and it typically clears up on its own within about an hour without any further changes on your part.
Neither issue means something is broken. They’re quirks worth recognizing so you’re not troubleshooting a problem that’s already fixing itself, and the same goes for the rest of your Microsoft 365 setup. A lot of what looks like a security incident is really a configuration detail, which is why the same checklist CyberJaz uses for Microsoft Teams security gets applied to shared mailboxes too.
Frequently asked questions
Do you need a Microsoft 365 license just for a shared mailbox?
No. A shared mailbox doesn’t need a license of its own as long as it stays under 50 GB, though everyone who accesses it needs their own licensed mailbox. Storage beyond 50 GB requires assigning it an Exchange Online Plan 2 license.
Can employees sign in to the shared mailbox directly?
They shouldn’t. Microsoft recommends blocking sign-in on the shared mailbox’s own account and having everyone access it through their individual accounts instead, which keeps activity traceable to a person and closes off an easy target for attackers.
How many people can use a shared mailbox at once?
Up to 25 people can be connected at the same time. Beyond that, users may start seeing connection failures, so organizations needing broader concurrent access should look at a Microsoft 365 Group instead.
Can you check a shared mailbox from your phone?
Yes, through the Outlook mobile app for iOS or Android, though you may need to add it manually the first time. It’s also available in Outlook on the web and desktop, where it usually appears automatically as an extra folder.
Why does a new shared mailbox sometimes show a permissions error?
Almost always because of replication delay: the permissions haven’t finished propagating across Microsoft’s data centers yet. Waiting roughly an hour and trying again typically resolves it without any changes on your end.
Need help setting up shared mailboxes, configuring permissions, or running Microsoft 365 more efficiently overall? CyberJaz handles Microsoft 365 administration for Pittsburgh-area businesses of every size. Get in touch to see how we can help.
