To audit Microsoft 365 shared mailboxes, build a current inventory, verify who has access and what they can do, review mailbox settings and rules, search Microsoft Purview audit evidence, and document remediation. The goal is not simply to count mailboxes. It is to confirm that every shared address has a business owner, an appropriate access group, traceable activity, and a review date.
Talk with IGTech365 about Microsoft 365 administration or call (866) 365-7798 for help reviewing a tenant.
What should a Microsoft 365 shared mailbox audit prove?
A useful audit answers five questions for every shared mailbox:
- Why does the mailbox exist, and which business process depends on it?
- Who owns the mailbox and approves access changes?
- Which users or groups have Full Access, Send As, or Send on Behalf permissions?
- Are forwarding, inbox rules, automatic replies, and other settings consistent with the business purpose?
- Can the organization explain important activity, such as sending, deleting, moving, or accessing messages?
Microsoft describes a shared mailbox as a mailbox that multiple people can use to read and send messages from a common address. It is commonly used for addresses such as support, sales, or reception. The mailbox should have a defined business purpose, not exist as an undocumented shortcut for sharing credentials. See Microsoft’s shared mailbox guidance for the service-level basics.
Separate the audit into evidence and decisions
Export or record the current state before making changes. Then create a decision log for each exception. A disabled user with Full Access may be a stale permission, or it may be a documented temporary arrangement. An unexpected forwarding rule may be malicious, or it may support a legitimate business process. The audit should expose the difference and assign an owner to resolve it.
How do you inventory shared mailboxes and their owners?
Start with the Exchange Online tenant rather than an informal list maintained in a spreadsheet. Use the Microsoft 365 admin center or Exchange Online PowerShell to identify shared mailboxes, then reconcile the results with the organization’s service catalog, ticketing system, and department contacts.
Capture the minimum inventory fields
| Audit field | What to record | Why it matters | Follow-up question |
|---|---|---|---|
| Mailbox identity | Display name, primary SMTP address, alias, and mailbox type | Prevents duplicate or orphaned records | Is this address still used? |
| Business purpose | Process, department, and data handled | Connects the mailbox to a real operational need | What would break if it were removed? |
| Ownership | Business owner, technical owner, and approval contact | Creates accountability for access changes | Who approves the next permission request? |
| Review state | Last review, open exceptions, and next review date | Turns a snapshot into a manageable control | What evidence still needs validation? |
For a technical inventory, Microsoft’s Get-EXOMailbox documentation explains the Exchange Online cmdlet used to retrieve mailbox information. Select only the properties needed for the audit, store the export securely, and avoid putting mailbox contents into an ordinary spreadsheet.
Flag inventory exceptions before reviewing every permission
Prioritize mailboxes with no named owner, a generic address that no department recognizes, a purpose that includes sensitive information, or a mailbox that has not been reviewed in the organization’s normal governance cycle. Also flag addresses that appear to duplicate another mailbox. Consolidating duplicate processes can reduce confusion, but do not delete or rename a mailbox until the business owner confirms the impact.
Which shared mailbox permissions should you review?
Review permissions at the mailbox and folder level, then compare them with the access the user actually needs. The three mailbox permissions that usually require explicit review are Full Access, Send As, and Send on Behalf. They do different jobs, so a user who needs to read and manage messages may not need permission to send as the shared address.
Check direct and group-based access
Record whether access comes directly from a user assignment or through a security group. Group-based access can be easier to govern, but only when the group has a clear owner and membership review process. A report that lists only direct permissions can miss effective access inherited through a group.
Use Get-EXOMailboxPermission to inspect mailbox permissions, then review Send As and Send on Behalf assignments with the appropriate Exchange Online commands. Preserve the command date, the tenant context, and the identity that performed the review so another administrator can reproduce the result.
Classify every permission decision
- Retain: The permission supports a current job function and has a known owner.
- Reduce: The user needs access, but a narrower permission or group assignment is sufficient.
- Remove: The user has left the role, no longer needs access, or cannot be connected to a business purpose.
- Investigate: The assignment is unexpected, conflicts with policy, or cannot be explained by the owner.
Do not treat an audit as permission cleanup without approval. Save the before state, identify the approver, make a bounded change, and capture the after state. This creates a defensible trail and reduces the risk of removing access that supports a time-sensitive business process.
Need a repeatable Microsoft 365 access review? IGTech365 can help manage the process, document exceptions, and connect the findings to broader IT support.
How do you audit shared mailbox activity and settings?
Permissions tell you who can act. Audit evidence helps you understand what happened. Review mailbox rules, forwarding settings, automatic replies, delegates, and activity that could explain a missing message, an unexpected outbound email, or an unexplained change.
Review settings that can redirect or alter mail
For each mailbox, document whether external forwarding is configured, whether inbox rules move or delete messages, and whether automatic replies contain current business information. Review changes to these settings in the context of the mailbox purpose. A forwarding rule may be approved for a case-management workflow, but an owner should be able to explain the destination and the data exposure.
Also check whether the mailbox is used by a business process that needs retention, legal hold, or compliance review. Those requirements depend on the organization’s policies and licensing. If the mailbox handles patient, legal, financial, or other sensitive information, route the finding to the appropriate compliance owner instead of making a generic assumption about retention.
Search audit records by mailbox, not only by person
Microsoft’s guidance for investigating shared mailbox activity recommends using the shared mailbox address as a search term for actions performed in that mailbox. Common investigation areas include Send As activity, deleted messages, moved messages, FolderBind activity, mailbox rule changes, and forwarding changes.
When reviewing a specific incident, define the time window in UTC, identify the mailbox SMTP address, select the relevant operations, and record the search parameters with the result. For example, a Send As investigation should identify who sent a message from the shared address. A deletion investigation should distinguish a move to Deleted Items from a permanent deletion. If the result is empty, document whether the action is outside the available audit coverage or whether the search filters and permissions need review.
Validate audit roles and coverage before drawing conclusions
The Microsoft Purview documentation notes that the person performing the search needs the appropriate Audit Logs or View-Only Audit Logs role. It also explains that auditing behavior can differ based on whether the activity is performed by an owner, delegate, or administrator. Read the mailbox activity audit documentation before treating an absent record as proof that an event did not happen.
What should you do after finding a shared mailbox exception?
Convert each exception into a small remediation record instead of making a long list that nobody owns. The record should state the mailbox, the finding, the risk or operational impact, the proposed action, the approver, the person responsible, and the validation step.
| Finding | Immediate action | Approval | Validation |
|---|---|---|---|
| Unknown Full Access user | Confirm identity and business need; suspend only when policy permits | Mailbox owner or security owner | Re-export permissions and test required users |
| Unexpected Send As assignment | Investigate recent messages and assignment history | Business owner and security owner | Review outbound activity after remediation |
| Unapproved forwarding rule | Preserve evidence, then remove or disable under incident procedure | Security or incident lead | Confirm rule state and monitor for recurrence |
| No owner or business purpose | Find the process owner before changing the mailbox | Department leader | Update inventory and review date |
For suspected compromise, preserve relevant evidence and follow the organization’s incident-response process before changing settings. For ordinary governance findings, make one bounded change at a time and record the change. Avoid broad permission removals across the tenant when the audit identifies one mailbox or one specific assignment.
If the review covers a regulated workflow or a broader tenant risk, connect the mailbox findings to a documented cybersecurity assessment rather than treating shared mailboxes as an isolated technical task.
How often should you audit Microsoft 365 shared mailboxes?
The right cadence depends on risk and change frequency. A practical starting policy is to review the full inventory at least annually, review permissions after role changes, and perform a focused review after a security incident or unexplained mailbox activity. Higher-risk mailboxes may need a shorter interval set by the organization’s security or compliance owner.
Use a lightweight recurring checklist:
- Confirm the mailbox still has a business purpose and named owner.
- Reconcile current users and groups with approved access.
- Review Full Access, Send As, and Send on Behalf assignments.
- Check forwarding, inbox rules, automatic replies, and other relevant settings.
- Sample or investigate Purview audit activity based on the mailbox risk.
- Close, assign, or escalate each exception.
- Store the review date, approver, evidence location, and next review date.
Microsoft 365 administration is easier to manage when the audit is part of a broader operating process. IGTech365’s Microsoft 365 services can support tenant administration, documentation, and review planning without replacing the customer’s business approval responsibilities.
Shared mailbox audit FAQ
Can I audit a shared mailbox without reading message content?
Often, yes. Start with inventory, permissions, settings, and metadata from audit records. Access message content only when the investigation and the organization’s policies authorize it. Use least-privilege access and store exports in an approved location.
Does Full Access let a user send from a shared mailbox?
Full Access lets a user open and manage the mailbox, but sending permissions are separate. Review Send As and Send on Behalf assignments independently, and confirm the result with the organization’s approved permission model.
Why might a Purview audit search return no activity?
The search may use the wrong mailbox filter, time range, operation, or user context. Audit role assignments, mailbox type, retention or coverage limits, and the way an action is logged can also affect results. Validate the search method against Microsoft’s current mailbox audit guidance before concluding that no activity occurred.
Should every shared mailbox have the same review frequency?
No. Set the cadence from the mailbox’s business purpose, data sensitivity, access breadth, and rate of change. A public support address and a mailbox used for sensitive case information may need different review controls.
Request a Microsoft 365 audit conversation with IGTech365 or call (866) 365-7798 to discuss your tenant and shared mailbox review process.