How to Find Non-Compliant Shared Mailboxes in Microsoft 365

Identifying and addressing non-compliant shared mailboxes in Microsoft 365 is crucial for several reasons:

Understanding licensing requirements for M365 shared mailboxes

Shared mailboxes with direct sign-ins violate Microsoft's licensing policies. While shared mailboxes typically don’t require licenses, any shared mailbox that requires direct sign-in access must be licensed.

Limitations of shared mailboxes due to lack of an Exchange Online license:

Security risks of non-compliant Microsoft 365 shared mailboxes

Data management of Microsoft 365 shared mailbox

Audit and monitoring of M365 shared mailboxes

Handy-Tip: To conserve the data of a former employee, convert the user mailbox to an inactive mailbox instead of a shared mailbox. This ensures data preservation, enhances security, and prevents unauthorized access. Inactive mailboxes also block the delivery of new emails, providing a secure solution for safeguarding the ex-employee's email data.

Disabling sign-in for a shared mailbox is crucial to strengthen security in Microsoft 365. Sign-in enabled shared mailboxes can create potential security risks, especially if they are not properly managed or licensed.

• Sign in to the Microsoft 365 admin center and navigate to Users»Active users.
• Find and select the shared mailbox for which you want to block the sign-in.
• Disable sign-in for the shared mailbox by clicking on Block sign-in.
• Then click Save changes to apply the updates.

Connect to the Microsoft Graph PowerShell with required permission using the below cmdlet.

Connect-MgGraph -Scopes "User.ReadWrite.All"

Run the below cmdlet in PowerShell to block sign-in for a shared mailbox in Microsoft 365.

Update-MgUser -UserId  -AccountEnabled:$false

Tip: Make sure that only authorized users have access and remove any unnecessary Microsoft 365 shared mailbox delegations to reduce potential risks.

Monitoring direct sign-in logs for shared mailboxes in Microsoft 365 is crucial for security. It allows admins to detect unauthorized access, identify risks, and take prompt action to protect organizational data.

• Sign-in to the Microsoft Entra admin center and navigate to Identity»Users»All users.
• Select the sign-in enabled shared mailbox from the Entra ID account list.
• Within the user properties, select Sign-in logs under the overview pane.

Since the portal method is time-consuming and requires manual monitoring of each user's sign-in logs, this PowerShell script allows you to efficiently retrieve the direct sign-in logs for all shared mailboxes in your M365 tenant at once.

Connect to the 'Exchange Online' PowerShell module using the below cmdlet.

Connect-ExchangeOnline

Run the following cmdlet with the appropriate start date and end date to retrieve the M365 shared mailboxes' direct sign-ins.

Get-Mailbox -RecipientTypeDetails SharedMailbox | ForEach-Object { 

Search-UnifiedAuditLog -UserIds $_.UserPrincipalName -Operations userloggedin -StartDate MM/DD/YYYY -EndDate MM/DD/YYYY 
} | ft

Enabling sign-in for a Microsoft 365 shared mailbox is generally discouraged, as it can lead to compliance and security issues. However, there are specific scenarios where enabling sign-in is acceptable:

Note: Allocate an EXO license to enable direct sign-in to a shared mailbox and regularly check M365 licensed shared mailboxes to manage assignments effectively.