Shared mailboxes (sales@, info@, support@) often accumulate access over years. Periodic audits prevent ex-employees and former projects from retaining access.

1. Who has access right now

To check current permissions in Outlook (with admin rights):

  • Outlook → File → Open & Export → Other User's Folder
  • Enter the shared mailbox
  • Permissions can be viewed by admin

For non-admins: you'll need IT to query Active Directory.

2. Two types of permissions

  • Full access — can read, reply, manage
  • Send As — can send emails appearing from the shared mailbox
  • Send on Behalf — can send appearing as themselves on behalf

A user might have one but not others. Audit each separately.

3. Recent additions

To see who was added recently:

  • Audit logs in Exchange Admin Center
  • Shows who added whom and when
  • Useful for detecting "I never authorized this"

4. Mailbox delegation

Different from shared mailbox access:

  • Delegation lets one user manage another's mail temporarily
  • Often given for vacation coverage
  • Not always revoked after

Check if delegations on a shared mailbox have grown stale.

5. Common cleanup

To clean up:

  • Remove access for departed employees
  • Remove access for people who switched teams
  • Confirm current members actually need it
  • Standardize on group-based access

6. Group-based vs. individual

Best practice: use a group for shared mailbox access:

  • "Sales Team" group has access to sales@ mailbox
  • Users join/leave group; mailbox access follows

Easier to manage than individual permissions.

7. Sending limits

After cleanup:

  • Who can send AS this address?
  • Limit to current team members
  • Update if outsourced or external partner shouldn't be on the list

8. Audit log review

For sensitive shared mailboxes:

  • Pull mailbox audit log monthly
  • Look for unusual access patterns
  • Investigate access outside business hours

9. Compliance considerations

For regulated industries:

  • Some shared mailboxes need retention policies
  • Access logs may need archiving
  • Specific approval needed before adding access

10. Documentation

Maintain a list:

  • Each shared mailbox: who has access
  • Purpose of the mailbox
  • Owner (the person responsible)
  • Reviewed quarterly

Even a simple spreadsheet helps.

When to ticket

Raise a ticket if:

  • You need an access audit
  • You suspect unauthorized access
  • A former employee may still have access
  • You need to set up a new shared mailbox

Include the mailbox address, what action is needed, and any time-sensitive context.