Shared Mailboxes Nobody Reviews

Shared mailboxes are one of the easiest things to lose track of in an access review.

A regular user account has an owner. Someone put their name on it, a manager approved it, and when review time comes there is a person who can vouch for what they still need. A shared mailbox does not work that way. Ten people might have access to a department inbox and nobody remembers approving half of them.

How Permissions Pile Up

Someone joins a project and gets added to the department mailbox for convenience. The project ends, the person changes roles, and nobody goes back to pull the access. It was never tied to a ticket or a review cycle to begin with.

Do that across enough departments over enough years and the permission list on a shared mailbox stops meaning anything. The mailbox does not get disabled when someone leaves. It does not show up on a standard offboarding checklist. It just sits there, accessible to whoever was last added and everyone before them.

The same dynamic applies to distribution lists, shared calendars, and any resource where access is granted informally and never audited formally. Shared mailboxes just happen to be the most common version of the problem in a Microsoft 365 environment.

Why Standard Reviews Miss Them

Most access reviews are built around individual accounts. The review asks a manager: does this person still need access to these resources? That question works when the resource is tied to a single identity.

Shared mailboxes invert the relationship. The question is not whether one person needs the mailbox. The question is whether the mailbox's entire permission list still reflects who should be in it. That question does not land on anyone's desk unless the mailbox has a designated owner, and most of them do not.

What Governance Looks Like in Practice

The fix is not complicated to describe. It is difficult to sustain.

Assign an owner to every shared mailbox. Same as you would a distribution list or a Teams channel. The owner is the person who gets asked during a review whether each member still belongs. Without an owner, that question has nowhere to go.

Put shared mailboxes on the same review cadence as individual accounts. If user access reviews happen quarterly, shared resource reviews should follow the same schedule. Treating them as a separate category that will "get to it eventually" means they never get reviewed at all.

Tie additions to a ticket. When someone gets added to a shared mailbox through a request, that request should be logged the same way any other access grant is. If there is no record of why access was granted, there is no basis for deciding whether it should continue.

The hardest part is not setting up the governance structure. It is getting someone to actually act on that ownership instead of treating it as an afterthought. Assigning an owner on paper and never following up produces the same result as having no owner at all.

The Accumulation Problem

Shared mailbox access does not fail dramatically. It degrades slowly. One extra person with access is invisible. Twenty extra people with access is a compliance finding waiting to be discovered during an audit.

The difference between a mailbox with clean permissions and one with accumulated sprawl is whether anyone looked at the list in the last year. For most shared mailboxes, the answer is that nobody has.