Exchange Online Shared Mailboxes: Setup, Permissions, Licensing, and Converting Leavers' Mailboxes

Shared mailboxes are one of the most useful and most misunderstood objects in Exchange Online. Most people meet them as support@company.com. Experienced admins also use them as a tool for handling departing staff, preserving mail cheaply, and routing work. This guide covers what they are, where each use fits, how to build them properly, and exactly where the licensing rules stop you.

What a Shared Mailbox Is (and Is Not)

A shared mailbox is a mailbox with its own address and its own storage, which several users access through permissions instead of a password. Behind it sits a user account, but that account is disabled for sign-in. People open it from their own Outlook, and send mail from its address.

What it gives you:

• One address that a group reads and answers, with a record of who did what in audit logs.
• No password to share, and no shared login that breaks MFA.
• A shared calendar and contacts, if wanted.
• Up to 50 GB of storage with no license.

What it does not give you:

• Assignment or status. There is no "assigned to me" and no ticket state. Teams that need those use a help desk tool or a shared inbox app.
• A place to sign in. Nobody should log in as the shared mailbox. It has no interactive use.
• Free features beyond 50 GB. Larger size, an online archive, and holds need a license (covered below).
• A Microsoft 365 group. A group adds files, Teams, and a Planner. A shared mailbox is mail and calendar only.

When and Where They Are Used

Use	Example	Why a shared mailbox fits
Team inbox	support@, sales@, billing@, info@	Several people answer; none owns the password
Role address	hr@, payroll@, security@	The address stays when the person in the role changes
Department calendar	A shared team calendar for leave, on-call, or events	One calendar, many editors
Departed employee	A leaver's mailbox kept for a manager	Keeps mail, releases the license
Alerts and automated mail	Monitoring and system mail landing in one place	Many readers, no sign-in
Intake for a process	Invoices, applications, abuse reports	Rules can sort mail to folders, and a process can read it
Mail drop for a workflow	A mailbox read by Power Automate or an app	Avoids tying automation to a personal account

Pick a Microsoft 365 group instead if the team also needs shared files, a chat channel, and a planner. Pick a distribution group if people only need to *receive* mail and replies come from their own addresses. Pick a shared mailbox if the team needs to *answer from one address and see the whole history*.

Planning Before You Build

Answer these first, because they are hard to change later:

1. Address and display name. Use a role name that will outlive the people. Avoid john.support@.
2. Who gets access and at what level. Decide who can only read, who can send as the address, and who manages.
3. Group-based access. Use one security group per mailbox, such as SM-Support-Members, so you add and remove people in one place.
4. Expected size. If the mailbox will grow past 50 GB, plan the license now.
5. Retention. Decide whether any compliance rule applies (see the retention section below).
6. Reply behavior. Decide where sent items go and what auto-reply the sender sees.
7. Spam and abuse. Public addresses like info@ attract spam; plan the filtering.

Create the Mailbox

In the Exchange admin center: Recipients, Mailboxes, Add a shared mailbox, enter the display name, address, and domain, then save. In PowerShell:

Confirm it exists and its type:

RecipientTypeDetails should read SharedMailbox. It can take a few minutes to appear everywhere.

Give Access (Groups, Full Access, Send As)

Create the group, then grant it:

The three kinds of access:

• Full Access opens the mailbox. It does not allow sending as it.
• Send As sends so the message shows only the shared address.
• Send on Behalf sends so the message shows "*Alex on behalf of Support*". Use it when the customer should see who answered.

Do not grant both Send As and Send on Behalf to the same person; Send As takes priority and is confusing.

Auto-mapping caveat. When you grant Full Access to a *group*, the mailbox often does not appear automatically in each member's Outlook. Either grant to individuals with -AutoMapping $true, or have members add it manually: File, Account Settings, Account Settings, double-click the account, More Settings, Advanced, Add. Permissions can take up to an hour to apply. For more on the permission types see delegate access.

Make Replies Stay in the Shared Mailbox

By default a message sent from the shared mailbox is saved in the sender's Sent Items, not the shared one. Teammates then cannot see what was already answered, and two people reply to the same customer. Fix:

Make sure members actually send *from* the shared address, not from their own. In Outlook, choose From in the new message and pick the shared address. In Outlook on the web, add the address in the From field the first time and it is remembered. In new Outlook and Outlook on the web, replying from within the shared mailbox picks the right address automatically.

Block Direct Sign-In

A shared mailbox's account should never log in. Confirm it is blocked: in the Microsoft 365 admin center go to Users, Active users, open the account, and choose Block sign-in. Also make sure the account has no password anyone knows and is excluded from services you do not want. Exchange Online creates it as disabled, but accounts converted from user mailboxes keep their old password until you block them (see the leaver section).

Licensing and Size: What the Rules Say

The licensing rules decide how you can use a shared mailbox, so read this section twice.

• A shared mailbox does not need a license while it is under 50 GB and has no online archive and no hold on it.
• A shared mailbox that is over 50 GB, or has an archive, or a litigation hold or other hold, needs an Exchange Online Plan 2 license (or an equivalent that includes Plan 2 features, or Plan 1 with an Exchange Online Archiving add-on for the archive).
• People using the shared mailbox always need their own licensed mailbox to open it.
• A shared mailbox does not receive the features that depend on a user license, such as Microsoft 365 apps and Teams.

Check usage:

These rules are published by Microsoft and change occasionally. Confirm them against Microsoft's current documentation before you design around them, because a mailbox that quietly needs a license will start restricting itself.

The Leaver Pattern: Convert a User Mailbox to Shared

This is the most useful trick with shared mailboxes. When someone leaves, the mailbox holds years of correspondence that the business may still need. A licensed user mailbox costs money each month. Converting it to a shared mailbox keeps the mail and releases the license.

Order matters. Convert first, then remove the license. If you remove the license first, the mailbox can be deleted after the grace period.

1. Block sign-in for the departing user and reset the password to a random value. Revoke sessions in the Entra admin center.
2. Preserve what you need. If you must keep a copy beyond 30 days, see the hold options in the next section *before* you proceed.
3. Convert:

4. Grant access to the manager or a team through a group, using Full Access (and Send As if they will answer from it).
5. Set an automatic reply so senders know the person has left and who to contact (see automatic replies).
6. Forward or redirect new mail if the business wants it elsewhere, using the mailbox's forwarding setting, a mail flow rule, or an alias on another mailbox.
7. Remove the license in the Microsoft 365 admin center (Users, Active users, Licenses and apps). The mailbox stays.
8. Document who has access, how long the mailbox will be kept, and when it will be removed.

Check that the mailbox is under 50 GB first. If it is above, you cannot simply remove the license. The data either has to be reduced or the mailbox needs a Plan 2 license.

Holding a Leaver's Mail: What Works and What Does Not

Admins often want to take this one step further: convert the mailbox, release the license, and keep the mail under a litigation hold for the legal retention period. Here is how that really behaves, because it is where mistakes are expensive.

Placing a hold on a shared mailbox needs a license. A litigation hold (or an eDiscovery hold, or a retention policy that holds data) on a shared mailbox requires an Exchange Online Plan 2 license for that mailbox. If you place a hold on a licensed mailbox and then remove the license, Microsoft's licensing rules are not met. The behavior I would plan for is that the mailbox is flagged and, after a grace period, can be removed. Do not rely on an unlicensed shared mailbox with a hold as a permanent store.

There are three legitimate ways to keep a leaver's mail, and which to choose depends on the length and the reason:

Option	License needed	Good for	Watch out
Converted shared mailbox (no hold)	None under 50 GB	Short-term access by a manager, weeks to months	No protection from deletion by anyone with access; not a legal hold
Shared mailbox + Exchange Online Plan 2 license	Plan 2 (or Plan 1 + Archiving)	Mail that must stay accessible and held	You pay for a license again, though it is cheaper than a full suite license
Inactive mailbox (hold or retention policy, then delete the user)	None for the inactive mailbox itself	Long-term legal or regulatory retention	Hold or retention policy must be in place *before* the account is deleted; access is through eDiscovery or restore

How an inactive mailbox works

An inactive mailbox is what remains when a mailbox that was on hold (a litigation hold, an eDiscovery hold, or a Microsoft Purview retention policy) has its Microsoft 365 account deleted. The mailbox is kept for the length of the hold, and it does not require a license. To use it:

1. Put the mailbox on hold *while it is still a normal, licensed mailbox*. A Purview retention policy applied to the mailbox is the preferred way:

Confirm the hold or retention policy has taken effect (this can take hours, and a new retention policy can take up to seven days to reach every mailbox).

2. Delete the user account in the Microsoft 365 admin center.
3. The mailbox becomes inactive. List inactive mailboxes:

4. To read the mail, search it with eDiscovery in Microsoft Purview, or recover it into another mailbox with a restore request when the business needs it. Restoring an inactive mailbox to a new mailbox is documented by Microsoft and requires specific roles.
5. When the retention period ends, the inactive mailbox is removed automatically. Remove the hold earlier only with legal's approval.

This is the cost-effective, supported way to keep a leaver's mail for years without paying for a license. The key requirements are the hold *before* deletion, and an honest record of why the hold exists.

What not to do

Do not treat the shared mailbox conversion as a way to *escape* a retention obligation. If a regulation, a contract, or a lawsuit requires mail to be kept, you must keep it in a way that is protected, whether that is a held and licensed mailbox, an inactive mailbox, or an archive. Quietly converting and removing a license, with no hold, leaves the mail open to deletion by anyone with Full Access and may be deleted entirely if it hits a size or retention limit. That is the opposite of retention, and the evidence trail matters if the data is later needed.

Confirm each licensing statement against Microsoft's current documentation for shared mailboxes, litigation hold, and inactive mailboxes in your tenant, and test the whole sequence on a throwaway account before you use it on a real leaver.

Rules, Filtering, and Spam

A public address attracts spam and automated mail. In a shared mailbox:

• Create server-side inbox rules in the mailbox to move newsletters or notifications into folders. Open it in Outlook on the web as a member and use Settings, Mail, Rules.
• Let Exchange Online Protection do the filtering. Confirm the mailbox is covered by your anti-spam policies (see Exchange Online protection).
• Use a mail flow rule to reject mail from known abusive senders before it reaches the team.

Shared Calendar and Contacts

A shared mailbox has a calendar. Share it with the team's group using Add-MailboxFolderPermission -Identity "support@contoso.com:\Calendar" -User "SM-Support-Members" -AccessRights Editor. It is a good place for team leave, on-call rotas, and deadlines. See sharing calendars.

Automation and Apps

Shared mailboxes are a clean target for automation, because they have no personal account to expire. Power Automate has triggers for new mail in a shared mailbox, and applications can read it through Microsoft Graph with application permissions limited to that mailbox. Use an application access policy to restrict an app to specific mailboxes so it cannot read everyone's mail.

Ongoing Maintenance

• Review membership every quarter, and always when a team changes.
• Watch size. Set an alert when a shared mailbox passes 40 GB.
• Audit sends. Turn on mailbox auditing and check who sends as the address:

• Clean up old shared mailboxes that nobody uses. An unused address that still receives mail is a risk.
• Document the owner of every shared mailbox, the group that controls it, and the license status.

How to Check It Worked

• Open the shared mailbox as a member and send a test message from its address.
• Confirm the sent copy appears in the shared mailbox's Sent Items.
• Confirm a non-member cannot open or send as it.
• Confirm sign-in to the underlying account is blocked.
• For a converted leaver mailbox: confirm RecipientTypeDetails is SharedMailbox, the manager has access, the license is removed, and the size is under 50 GB.

Troubleshooting

Symptom	Likely cause
Mailbox does not appear in Outlook	Group-based grant (no auto-map), propagation delay, or cached profile
"Cannot send as" error	Send As not granted, or it was granted a few minutes ago
Replies missing from shared Sent Items	MessageCopyForSentAsEnabled not set, or sent from the personal address
Converted mailbox disappears after license removal	It was over 50 GB, had a hold, or had an archive, so it needed a license
Cannot place a hold on the shared mailbox	It has no Plan 2 license
Leaver's mail still reachable by the old user	Sign-in not blocked and the password not reset
Mailbox stops receiving mail	Over its quota or blocked by a mail flow rule

A Short Decision Guide

• Team answers one address: shared mailbox with a security group.
• Team also needs files and chat: Microsoft 365 group or Team.
• Leaver, short term: convert to shared, remove the license, grant manager access.
• Leaver, long term legal retention: apply the hold or retention policy, then use an inactive mailbox, or license the shared mailbox with Plan 2.
• Mailbox over 50 GB: Plan 2 license, or reduce the data.

Related guides: retention policies and DLP, recovering deleted email, and delegate access.

Licensing and retention behavior are defined by Microsoft and change over time, and I have not run this sequence against your tenant. Treat the license and inactive-mailbox details here as a plan to verify against Microsoft's current documentation, not a guarantee. If you want help planning leaver handling and retention for a Microsoft 365 tenant, get in touch.