How to Fix Unauthorized Access to Shared Exchange Online Mailboxes
Question details
Non-member users appear to be able to view or access a shared mailbox without having the required Full Access or Send As permissions.
- Product
- Exchange Online
- Device & OS
- not provided
- Scenario
- An administrator or team member notices that users who were not explicitly granted access seem to be able to open a shared mailbox.
- Observed behavior
- Users seemingly access the shared mailbox contents. However, this is frequently caused by users accidentally opening their own primary mailbox instead of the shared one, or due to misconfigured delegation settings.
Before troubleshooting, confirm the exact email address of the shared mailbox and ensure you have Exchange administrator privileges to review tenant permissions.
Verify Mailbox Delegation in Exchange Admin Center
Check the Full Access and Send As permissions to ensure no unauthorized users or groups are assigned to the shared mailbox.
Shared mailboxes strictly require permissions (Full Access, Send As, or Send on Behalf) for a user to view or interact with them. Verifying the delegation list is the first step to rule out incorrect admin configurations.
Log in to the Microsoft 365 admin portal with your administrator credentials and navigate to the Exchange admin center.
Go to Recipients > Mailboxes, and search for the specific shared mailbox that is experiencing the issue.
Click on the mailbox name, navigate to the 'Mailbox delegation' tab, and carefully review the users listed under 'Full Access' and 'Send As'. Remove any unauthorized users.
Test Access via Outlook on the Web
Determine if the unauthorized access is a local desktop client glitch or an actual permission issue by testing it strictly through the web portal.
Create a Test Shared Mailbox to Isolate the Issue
Create a brand new shared mailbox without any members to see if the vulnerability is tenant-wide or isolated to a specific mailbox.
Looking for a Lightweight Alternative to Microsoft Office?
While WPS Office does not manage Exchange servers, it provides a highly compatible, free, and lightweight suite for all your daily document, spreadsheet, and presentation needs, making it a perfect Microsoft Office alternative.
- 1. Download the installer: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install and launch: Run the installation file and open WPS Office. You will immediately notice the familiar, easy-to-use interface.
- 3. Open your files: Drag and drop your existing Microsoft Office documents directly into WPS Office to continue working without formatting issues.
Frequently Asked Questions
Why does a user see their own emails when trying to open a shared mailbox?
This is a common visual confusion. If a user incorrectly enters their own address or clicks incorrectly when prompted to 'Open another mailbox' in Outlook on the web, it will simply load their primary mailbox again in a new tab, giving the false impression they accessed the shared mailbox.
Do users need a separate license to access a shared mailbox?
No, a shared mailbox does not require its own standalone license, provided it remains under 50 GB. The users accessing the shared mailbox only need to have their own valid Exchange Online licenses.
How long does it take for mailbox permission changes to take effect in Exchange Online?
Changes to shared mailbox permissions, such as granting or revoking Full Access, can take anywhere from 15 to 60 minutes to replicate across Exchange Online and reflect properly in the Outlook desktop client.
