A user mailbox represents an individual licensed user, while a shared mailbox supports a business address used by multiple authorized people.
What a User Mailbox Is
A user mailbox is associated with an individual Microsoft 365 user account. The person signs in with the account, receives an assigned license, uses email and calendar, and may access additional Microsoft 365 services.
User mailboxes are appropriate for employees, contractors, or other authorized individuals who need their own identity and sign-in.
What a Shared Mailbox Is
A shared mailbox provides a common business address such as support, billing, information, or scheduling. Authorized users open the mailbox through their own accounts.
The shared mailbox should have a business owner, approved members, documented permissions, and an offboarding process.
Use individual identities for accountability
Employees should normally access a shared mailbox through their own accounts rather than sharing one password.
Sign-In Differences
A user mailbox is designed for direct sign-in by the assigned person. A shared mailbox is normally accessed through delegated permissions from licensed user accounts.
Do not distribute a shared mailbox password to employees. Shared credentials reduce accountability and make multifactor authentication, offboarding, and auditing more difficult.
Licensing Differences
A user mailbox requires an appropriate Microsoft 365 or Exchange Online license. A shared mailbox usually does not require a separate license when it remains within Microsoft's unlicensed shared-mailbox limits and does not use features that require licensing.
Microsoft currently documents that an unlicensed shared mailbox can store up to 50 GB. A license is required for more than 50 GB and for certain features such as archiving or litigation hold. Verify current licensing guidance before implementation.
User Access Requirements
People who access a shared mailbox need their own licensed Exchange Online user accounts. The shared mailbox does not replace the user's individual account.
Remove shared mailbox access during role changes and offboarding.
Full Access Permission
Full Access allows a user to open and manage the shared mailbox. It does not automatically grant permission to send messages as the mailbox.
Assign only the permissions required and record the business reason.
Send As Permission
Send As allows a user to send a message that appears to come directly from the shared mailbox address.
This is useful for department communication, but it should be limited to approved employees and reviewed because recipients may not see the individual sender in the visible From field.
Send on Behalf Permission
Send on Behalf displays that the individual sent the message on behalf of the shared mailbox. This can provide clearer sender context in some workflows.
Select the permission type based on business, customer, legal, and accountability requirements.
Full Access does not automatically include sending permission
Test opening, Send As, and Send on Behalf separately and document exactly which permission was approved.
When to Use a User Mailbox
- An employee needs an individual business identity.
- The person needs direct sign-in.
- The person uses Teams, OneDrive, SharePoint, desktop applications, or other licensed services.
- Messages and calendar activity should be associated with the individual.
- The account is part of employee onboarding and offboarding.
When to Use a Shared Mailbox
- Several employees manage one business address.
- The organization needs a support, billing, scheduling, or information address.
- The mailbox should remain active when staff members change.
- Messages and calendars need to be shared by a team.
- The address represents a function rather than one employee.
Do Not Use a Shared Mailbox as a Shared Login
Employees should sign in with their own accounts and receive delegated access. Shared passwords make it difficult to identify who sent, deleted, moved, or changed information.
Individual identities also allow access to be removed without changing a password for every remaining user.
Mailbox Ownership
Assign a business owner who approves membership, sending permissions, retention, naming, automatic replies, forwarding, and review dates.
Assign a technical owner who manages the configuration and resolves delivery or permission issues.
Membership and Access Reviews
Review members and sending permissions at least quarterly for sensitive or externally facing mailboxes. Remove former employees, transferred employees, temporary access, and duplicate permissions.
Record the approver and completion evidence.
Retention and Legal Requirements
Shared mailbox data may be subject to records, legal, regulatory, or contractual requirements. Determine whether retention, archiving, litigation hold, or another licensed feature is required.
Do not remove a license or delete a mailbox until the impact on retention and data has been reviewed.
Mailbox Size and Monitoring
Monitor storage growth, deleted items, attachments, and retention. A mailbox approaching the unlicensed limit may require cleanup, retention changes, archiving, or an appropriate license.
Assign an owner for storage alerts and do not wait until the mailbox stops receiving or processing data correctly.
Automatic Replies and Forwarding
Use automatic replies to communicate service hours, staffing changes, or alternate contacts. Use forwarding only when approved and documented.
Permanent forwarding can hide ownership and create privacy or security risks. Set a review or expiration date.
Former Employee Mailboxes
An employee mailbox may be converted to a shared mailbox when approved employees need continuing access to business mail. Complete the conversion and verify data, permissions, retention, and storage before removing the user license.
This is not the right solution for every departure. Review business, legal, security, and records requirements first.
Shared Mailbox Checklist
- Use an individual user mailbox for each employee.
- Use shared mailboxes for business functions.
- Do not share mailbox passwords.
- Document the business and technical owners.
- Assign Full Access and sending permissions separately.
- Verify that members have licensed user accounts.
- Monitor storage and licensing requirements.
- Review retention and legal needs.
- Review membership and sending permissions quarterly.
- Remove access during role changes and offboarding.
Frequently Asked Questions
Does a shared mailbox need its own license?
Usually not when it remains within Microsoft's unlicensed limits and does not use features that require licensing. Verify current Microsoft guidance for storage, archiving, and hold requirements.
Can users sign in directly to a shared mailbox?
The normal design is for licensed users to access it through their own accounts and delegated permissions.
Can a former employee mailbox become a shared mailbox?
Yes, when the organization needs continuing access and completes the conversion, retention, permission, and licensing steps in the correct order.
When Professional Support Helps
Professional support can review mailbox design, create shared mailboxes, assign permissions, convert former employee mailboxes, review storage, and establish recurring access reviews.
Need help applying this?
Manage Microsoft 365 users and access securely.
J3 Systems Group LLC can review users, licenses, administrator roles, groups, shared mailboxes, authentication, onboarding, and offboarding.