{
  "id": "CB-M365-MAIL-012",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-012",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-012.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-012.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-012",
    "title": "Block sign-in for shared mailbox accounts",
    "finding": {
      "title": "Shared mailbox accounts can sign in directly",
      "description": "The user account behind a shared mailbox has an active sign-in, so anyone who sets or guesses its password gets in without being tied to a named user."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "shared-mailbox",
      "sign-in",
      "entra-id",
      "accounts"
    ],
    "description": "Every shared mailbox has a Microsoft Entra user object. Sign-in is blocked on all of them\n(`accountEnabled false`). People reach the shared mailbox through delegated permissions (Full\nAccess, Send As, Send on Behalf) with their own account.\n",
    "rationale": "A shared mailbox account is not owned by a single person, often has no MFA method registered and\nis rarely monitored. If its password is set (during a migration or by a well-meaning admin) the\naccount becomes a back door that Conditional Access and access reviews tend to miss. Blocking\nsign-in keeps every access attributed to a named user.\n",
    "impact": "None known for normal use: delegated access does not need the shared account to sign in. Scripts\nor devices that sign in as the shared mailbox (for example to send mail) stop working and must use\na dedicated, monitored account or an application identity.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global\n   Reader.\n2. Browse to **Teams & groups** > **Shared mailboxes** and note the shared mailboxes.\n3. Browse to **Users** > **Active users**, open each of these accounts and check that it shows\n   **Sign-in blocked**.\n4. Or, in PowerShell (read-only), with Exchange Online and Microsoft Graph\n   (`User.Read.All`):\n   ```powershell\n   Get-EXOMailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited |\n     ForEach-Object { Get-MgUser -UserId $_.ExternalDirectoryObjectId -Property UserPrincipalName,AccountEnabled } |\n     Where-Object AccountEnabled | Select-Object UserPrincipalName, AccountEnabled\n   ```\n   Graph equivalent per account: `GET /users/{id}?$select=userPrincipalName,accountEnabled`.\n5. Fail if any shared mailbox account has `accountEnabled` set to `true`.\n"
    },
    "remediation": {
      "manual": "1. In the Microsoft 365 admin center, browse to **Users** > **Active users**, select the shared\n   mailbox accounts, then **Block sign-in** (User Administrator).\n2. PowerShell equivalent (Microsoft Graph, `User.ReadWrite.All`):\n   ```powershell\n   Update-MgUser -UserId <object id> -AccountEnabled:$false\n   ```\n3. For a synchronized account, disable it in Active Directory instead, otherwise the next sync\n   restores it.\n",
      "rollback": "`Update-MgUser -UserId <object id> -AccountEnabled:$true`.\n"
    },
    "references": [
      {
        "title": "About shared mailboxes",
        "url": "https://learn.microsoft.com/microsoft-365/admin/email/about-shared-mailboxes",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Shared mailboxes in Exchange Online",
        "url": "https://learn.microsoft.com/exchange/collaboration-exo/shared-mailboxes",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-ADMIN-005",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}