Block sign-in for shared mailbox accounts

Description

Every shared mailbox has a Microsoft Entra user object. Sign-in is blocked on all of them (accountEnabled false). People reach the shared mailbox through delegated permissions (Full Access, Send As, Send on Behalf) with their own account.

Rationale

A shared mailbox account is not owned by a single person, often has no MFA method registered and is rarely monitored. If its password is set (during a migration or by a well-meaning admin) the account becomes a back door that Conditional Access and access reviews tend to miss. Blocking sign-in keeps every access attributed to a named user.

Impact

None known for normal use: delegated access does not need the shared account to sign in. Scripts or devices that sign in as the shared mailbox (for example to send mail) stop working and must use a dedicated, monitored account or an application identity.

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global Reader.
2. Browse to Teams & groups > Shared mailboxes and note the shared mailboxes.
3. Browse to Users > Active users, open each of these accounts and check that it shows Sign-in blocked.
4. Or, in PowerShell (read-only), with Exchange Online and Microsoft Graph (User.Read.All):

   Get-EXOMailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited |
     ForEach-Object { Get-MgUser -UserId $_.ExternalDirectoryObjectId -Property UserPrincipalName,AccountEnabled } |
     Where-Object AccountEnabled | Select-Object UserPrincipalName, AccountEnabled
   

   Graph equivalent per account: GET /users/{id}?$select=userPrincipalName,accountEnabled.
5. Fail if any shared mailbox account has accountEnabled set to true.

Remediation

1. In the Microsoft 365 admin center, browse to Users > Active users, select the shared mailbox accounts, then Block sign-in (User Administrator).
2. PowerShell equivalent (Microsoft Graph, User.ReadWrite.All):

   Update-MgUser -UserId <object id> -AccountEnabled:$false
   

3. For a synchronized account, disable it in Active Directory instead, otherwise the next sync restores it.

Rollback

Update-MgUser -UserId <object id> -AccountEnabled:$true.

References

• About shared mailboxes Microsoft, vendor-doc, accessed 2026-10-24
• Shared mailboxes in Exchange Online Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-ADMIN-005 License administrator accounts without mailbox or collaboration apps

People and lifecycle