Most small businesses have a mailbox called info@ or office@ or billing@. It is the one on the website. It is the one customers reply to.
Ask who can get into it and you usually get a pause, then a name, then a caveat. Well, the office manager set it up years ago. I think the password is written down somewhere. Sometimes there is no somewhere.
That mailbox is one of the more useful things Microsoft 365 does, and one of the most commonly misused. Here is what is actually going on in there.
A shared mailbox is not a user account
Microsoft's own documentation is blunt about this. A shared mailbox has a user account behind it, but that account is not meant to be signed into. Microsoft's guidance to administrators is to block sign-in on those accounts and keep it blocked, because the mailbox was never designed to be a login.
The intended design is simple. The mailbox belongs to the business, not to a person. Each employee opens it from inside their own mailbox, where it shows up as a second inbox. They send from it without ever knowing a password for it. Access is granted to people by name, and taken away the same way.
That is the whole trick. Access is a list of people. Not a password that gets passed around.
Where it usually goes wrong
Two versions of the same mistake.
The first is paying for it. A shared mailbox holds up to 50 GB with no license attached. What needs a license is the humans. To open a shared mailbox, each person has to have their own licensed mailbox. So if you are carrying a full Microsoft 365 license for info@ on top of everyone else's, that is worth a look at your license list. It may not be doing anything you need it to do.
The second one is worse. Somebody creates info@ as an ordinary user account, sets a password, and hands it out. Now four people sign in as info@. Nobody can tell who answered the estimate request. Nobody can tell who deleted the thread. And when the person who set it up leaves, the password leaves with them, in their memory and probably on a note in a drawer.
Microsoft's documentation on converting a mailbox spells out how long that lasts. If you convert a mailbox to a shared mailbox and do not reset the password, the original username and password keep working on it after the conversion is finished. The mailbox outlives the employment. The credentials do too, unless somebody goes in and closes that door.
Why this is more than housekeeping
Multi-factor authentication is the thing everyone has been told to turn on, and the advice is good. It also assumes a person. A code goes to a phone, and the phone belongs to somebody. When four people share one login, the second step goes to one of them, and everyone else sits there waiting for that person to be at their desk. So people turn it off, or they start approving prompts they did not start.
That is the part that gets missed. Shared credentials and strong sign-in do not coexist well. You end up choosing one, and the shared password usually wins, because it is easier on a busy Tuesday.
What to check, in about fifteen minutes
Open the Microsoft 365 admin center, go to Users, then Active users, and find the mailbox. Look at what you are actually seeing.
Is it sitting under Shared mailboxes in the Exchange admin center, or is it just a person-shaped account with a generic name? Does it have a license assigned to it? If the display name is your company name with a photo of a storefront, that is not a shared mailbox. That is a login with a storefront on it.
Then the question that matters. Do you know the password? If you do, so does everyone who has ever been handed it, and that list is longer than you think.
Open the delegation list and read the names out loud. If anyone on it stopped working for you a few years ago, you have your answer, and you have it faster than you expected.
Last, check whether sign-in is blocked on that account. Microsoft says it should be.
What good looks like
info@ is a shared mailbox with no license attached to it. Sign-in is blocked on the underlying account, so there is no password for anyone to share. A short, current list of people can open it from their own mailboxes, and that list gets looked at when somebody joins or leaves, not once a year in a panic.
There is one more thing to watch. A shared mailbox that fills up stops sending mail, and after a while it stops receiving it too. Senders start getting bounce messages that say something technical and unhelpful. That is in the documentation as well. It is how a quiet storage problem turns into a Friday problem.
None of this is exotic. It is two settings and a habit of keeping a short list current.
The part that is actually yours
You do not need a project for this. You need to know where you stand, and the answer is either that it is set up correctly or that it needs an hour of somebody's time.
If you would rather not go poking around the admin center, that is a reasonable position to take. Ask whoever set up your Microsoft 365 to show you three things: the mailbox in the shared mailbox list, the delegation list, and whether sign-in is blocked. How they answer will tell you a good deal about everything else they touched.
Call us at (906) 662-4481, or contact us for a free assessment.