In Office 365, mailboxes are used to transmit email messages. As far as it is concerned, protecting those mailboxes is also necessary. A shared mailbox allows multiple users to access the same mailbox. But the real problem exists in shared mailbox security, especially with the auto-generated password when you create a shared mailbox. To Block shared mailbox sign-in is the best way to avoid those troublesome situations. Let’s check how!

A shared mailbox is a mailbox that is shared by a group of delegated users in Office 365 for sending and receiving emails based on the permission they hold. When you create a shared mailbox in Exchange Online, a password is generated for the mailbox at the back end. This password with the shared mailbox email address can be used as credentials for logging in by any user, leaving it open to severe outbreaks.

For instance, if admins reset the password for a shared mailbox and provide it to one of the users for any reason. That user, after leaving the organization may use the password to attack the organization’s resources. This risk underscores the importance of implementing security measures, such as regularly auditing shared mailbox activities.

If a shared mailbox has sign-in enabled but lacks a license, it violates Microsoft’s licensing terms, thereby becoming a non-compliant shared mailbox. To avoid this, you can either block sign-ins or assign the appropriate license. Similarly, you can disable sign-in for room mailboxes to prevent misuse of these shared resource mailboxes. Let’s now look at how to block shared mailbox sign-ins.

• Block shared mailbox sign-in using Microsoft 365 Admin Center
• Block shared mailbox sign-in using PowerShell

It’s a doddle to block shared mailbox sign-ins using Microsoft 365 Admin Center. All you have to do is to follow the steps given below.

Step 1: Log into the Microsoft 365 Admin Center.
Step 2: Under ‘Users’ select ‘Active Users’.
Step 3: Reach out to the shared mailbox for which you want to block the sign-in.

Step 4: Click on ‘Block sign-in’ from the flyout page that pops up.
Step 5: Then, check the box ✅ for ‘Block users from signing in’ and Save changes.

You can block shared mailbox sign-in using PowerShell in the following way.

Important: Before jumping into the cmdlets, ensure that you are not using the x86 version of Windows PowerShell to execute these steps without any error.

Step 1: Install the latest MSOnline module.

 Install-Module MSOnline

Step 2: Install the MSOnline public preview module to manage users from Azure Active Directory.

 Install-Module AzureADPreview

Step 3: Connect to MS Online and give credentials.

 Connect-MsolService

1. Check all the shared mailbox sign-in status.
2. Check specific shared mailbox sign-in status.
3. Block signing into a specific shared mailbox.
4. Block shared mailbox sign-ins using CSV.
5. Block all shared mailbox sign-ins.
6. Block only sign-in enabled shared mailboxes in Office 365.

It is important tofind the shared mailboxesand their current sign-in status, so firstconnect to Exchange Online PowerShelland run the following cmdlet.

Get-Mailbox -Filter {recipienttypedetails -eq "SharedMailbox"} | get-MsolUser | ft userprincipalname,blockcredential 

By entering the user principal name of the specific shared mailbox in the following cmdlet, you can check its sign-in status.

Get-MsolUser -UserPrincipalName <UPN of the shared mailbox> |fl *block*

If the result returns ‘false’, sign-in is not blocked for that mailbox.

Use the following cmdlet to prevent users from signing into a specific shared mailbox.

Set-MsolUser –UserPrincipalName <UPN of the shared mailbox> -BlockCredential $true

To block sign-in for shared mailboxes for multiple users at a time, create a CSV file and then run the following script. Make sure to have the column name as ‘UserPrincipalName’ in the CSV file to run without any errors.

Connect-MsolService
$UserPrincipalName = Import-Csv C:\sharedmailboxes.csv
foreach($userprincipalname in $userprincipalname){
Write-Progress -Activity "Blocking sign-in access to SMB -$user..."
Set-MsolUser -UserPrincipalName $UserPrincipalName.UserPrincipalName -BlockCredential $true
If($?)
{
Write-Host Blocked Successfully to $UserPrincipalName.userprincipalname -ForegroundColor Green
}
Else
{
Write-Host Error occurred while blocking to $UserPrincipalName.userprincipalname -ForegroundColor Red
}
}

You can use the following cmdlet to easily block sign-in for all mailboxes in your organization.

Get-Mailbox -RecipientTypeDetails "SharedMailbox" | ForEach-Object { Set-MsolUser -UserPrincipalName $_.UserPrincipalName -BlockCredential $false} 

The following cmdlet gets all the mailboxes with BlockCredential – ‘False’ and sets the value to ‘True’.

Get-EXOMailbox -Filter {recipienttypedetails -eq "SharedMailbox"} | get-MsolUser | Select-Object UserPrincipalName,blockcredential | Where {$_.BlockCredential -eq $False} | ForEach-Object { Set-MsolUser -UserPrincipalName $_.UserPrincipalName -BlockCredential $true}

Apart from these, it is also recommended to keep control over theshared mailbox permissions such as FullAccess, SendAs, and SendOnBehalf to ensure that the right people hold the right permissions on your resources. Some of the keynotes of the shared mailbox permission report using the PowerShell script are listed below.

• Filter outputs using permissions like SendAs, SendOnBehalf, FullAccess.
• Export permissions for specific or all mailboxes.
• Displays only explicitly assigned permissions.
• Schedule shared mailbox permission report.
• Export shared mailbox members to CSV.

Admins can get the Exchange Online shared mailbox sign-in status through Microsoft 365 admin center. However, it is a time-consuming process where they have to locate each shared mailbox and its details to check or verify the sign-in status of the shared mailboxes.

To get the shared mailbox sign-in status with ease, the AdminDroid Exchange Online reporter steps in!

AdminDroid’s “Shared Mailboxes” report helps you to easily capture the required sign in status of the shared mailboxes, preventingyour environment from risky threats.

Added to the above, make a strong layer of protection over your shared mailboxes by managing mailbox permissionswith Admindroid’s Exchange Online reporter.

Below are Shared mailbox permission reports by Admindroid’s Exchange Online reporter.

Mailbox Permission Summary: Get a summary of allshared mailboxesand their associated users with granted permissions like full access, send as, and send on behalf.

Shared Mailbox Permissions Detail: Retrieve all Microsoft 365 shared mailboxes in detail along with the users who have access to those mailboxes in your organization.

Also, you can build a security posture for your Exchange Online by governing the mailbox settings, mailbox usage, and permissions with AdminDroid Microsoft 365 management solution.

Added to the above, you can gain 65+ extensive auditing reports on O365 mailbox activities, access permissions, and configuration changes for effective Exchange Online auditing.

Furthermore,from AdminDroid’s Exchange Online dashboard, you can easily keep track of all your mailbox details such as mailbox utilization, mailbox storage, and mailbox audit settings from a single console.

AdminDroid: Explore Crystal Clear Statistics on Microsoft 365 Mailboxes for Efficient Exchange Online Management!

Give a try to AdminDroid now and experience supervision of the Shared mailboxes sign-in status from a single console.

I hope this blog will help you understand the concepts of blocking shared mailbox sign-in in Office 365.

Got any doubts? Feel free to reach us in the comments!