Shared mailbox or shared login: how should your team use info@?
If several people handle emails sent to info@ or accounts@, a Microsoft 365 shared mailbox is usually the right starting point. Each person signs in with their own work account and gets access to the shared inbox. There is no need to pass one password around the office.
A user mailbox is for one person’s email. A shared mailbox gives the team a common place to handle email. In a small business, you will often need both.
What changes when you use a shared mailbox?
Imagine a business where the receptionist deals with general enquiries, the owner provides cover and an accounts colleague handles supplier invoices.
The receptionist and owner could have access to info@. The accounts colleague and owner could have access to accounts@. Each person uses their own account, and the business grants access to the inboxes their role requires.
Customers still use the familiar business addresses. Behind the scenes, you can change one person's access without handing a replacement shared password to everyone else. When someone leaves, use our Microsoft 365 offboarding checklist to plan access removal and the handover.
This also makes holiday cover clearer. You agree who covers each inbox and arrange access before someone goes away. You do not need to borrow their sign-in or ask them to approve a login while they are on leave.
Why sharing one login causes problems
A shared login often starts as a quick fix. Someone sets up info@ as an ordinary user account, then gives colleagues the password so they can help.
Over time, practical questions become harder to answer:
Who still knows the password, including former staff?
Whose phone receives the sign-in approval?
Can you remove one person's access without interrupting everybody?
Which other devices or services depend on that same login?
The NCSC recommends separate work accounts for each person. Sharing an account makes privacy and identifying who performed an action more complicated.
Protect each person's own account with the appropriate sign-in controls, including multi-factor authentication. Individual accounts do not remove every risk, but they give you a much clearer starting point for managing access.
How access and sending permissions work
Microsoft 365 shared mailboxes use delegated access: an administrator grants a person permission to use the mailbox through their own account. Microsoft's shared-mailbox guidance says the shared mailbox's own account should remain blocked from direct sign-in.
Opening the mailbox and sending from it are separate permissions:
Full Access lets someone read and manage its contents.
Send As lets their outgoing message appear from the shared address.
Send on Behalf shows that a named person is sending on behalf of that address.
Full Access alone does not give permission to send. Microsoft's permissions guide explains the differences. Ask whoever manages Microsoft 365 to match permissions to what each colleague actually needs.
Agree how the team will use the inbox
Shared access only solves part of the problem. Two people can still reply to the same enquiry, or each assume the other has dealt with it.
Agree a simple working routine:
Who checks the inbox each day, and who provides cover?
How do you show that someone is handling a message?
Where do completed messages go?
What happens when a reply needs the owner's decision?
Who reviews membership when roles change?
For example, the receptionist marks an enquiry as theirs and moves it to “Waiting for owner”. An agreed handover note records “Owner to confirm delivery date”. The covering colleague can check that note and the shared sent replies before responding.
For a small team, clearly named folders or agreed categories may be enough. Check that everyone understands and sees the same arrangement. A message being marked as read does not tell you whether the customer has received a useful answer.
Check sent replies too. By default, Microsoft says messages sent from a shared mailbox are saved in the sender's Sent Items rather than the shared mailbox's Sent Items. An administrator can configure shared sent-message copies. Test that a colleague providing cover can see the replies they need.
Does a shared mailbox need its own licence?
A shared mailbox can generally hold up to 50 GB without its own separate licence. Each person accessing it still needs their own licensed Exchange Online mailbox.
Larger mailboxes, archiving, holds and some advanced security or compliance features can need additional licensing. Check Microsoft's current requirements against the actual setup before removing anything. Sharing a mailbox is not a way to avoid licensing the people who use it.
Before replacing an existing shared login
Start by asking what the current account does. Does a scanner send through it? Does a website, booking system or automation use its credentials? Are there forwarding rules, calendars or records the business needs to retain?
Plan the change with your IT provider. Microsoft supports converting a user mailbox into a shared mailbox while keeping existing email and calendar information. The account anchoring the shared mailbox must remain; conversion also needs a separate check that direct sign-in is blocked.
Before calling the change finished, test incoming mail, replies from the correct address, shared sent-message visibility and access on the devices the team uses. Review old dependencies rather than assuming conversion has fixed them.
Common questions
Is an email alias the same thing?
An alias is another address delivering into an existing mailbox. It does not create a separate team inbox. Microsoft explains when to use aliases or a shared mailbox.
Does a shared mailbox replace a ticket system?
For light enquiry volumes, an agreed routine may be sufficient. If you need reliable assignment, escalation, response tracking or reporting, consider whether a dedicated system would suit the work better.
Can an external person be a member?
Shared-mailbox access is intended for people inside your Microsoft 365 organisation. Ask your provider about a suitable approach for external collaborators rather than sharing credentials.
Need a clearer way to manage your shared email?
Cache4 helps small businesses in Carlisle, across Cumbria and beyond with Microsoft 365 setup and ongoing management.
Book a free 30-minute Discovery Call with Paul Crooks. Bring an example of how your team currently handles info@ or accounts@, without sending passwords or private email contents. We can discuss access, cover and what needs improving. No pressure or obligation.
Comments