Check ID: exchange_shared_mailbox_sign_in_disabled
Provider: Microsoft 365
Service: exchange
Severity: MEDIUM
Categories: identity-access
Resource type: NotDefined

​
What this check verifies

Microsoft 365 Shared mailboxes are used for collaboration and should not permit direct sign-in. This check verifies that the AccountEnabled property is set to false in Entra ID for all shared mailboxes, preventing direct authentication.

​
Risk

When sign-in is enabled on shared mailboxes, users with the password can bypass delegation controls and access the mailbox directly. This undermines accountability since actions cannot be attributed to individual users, and it increases the attack surface for credential-based attacks.

​
Recommendation

Block sign-in for all shared mailboxes to ensure users can only access them through delegation. This enforces accountability and reduces security risks from shared credentials.

​
Remediation

Get-EXOMailbox -RecipientTypeDetails SharedMailbox | ForEach-Object { Update-MgUser -UserId $_.ExternalDirectoryObjectId -AccountEnabled:$false }

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = exchange_shared_mailbox_sign_in_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks