Is sharing email passwords a security risk for my business?

Summary

This guide helps you troubleshoot and resolve: Is sharing email passwords a security risk for my business?. Follow the steps below to fix the issue.

Common Causes

Sharing a single email password for general addresses like accounts@ or sales@ is a common practice in small businesses, but it introduces serious security and accountability risks. When multiple staff members use the same credentials, you cannot track who sent or deleted a message, access cannot be quickly revoked when someone leaves the organisation, and a single compromised password puts every shared mailbox at risk. Moving to Microsoft Exchange Online shared mailboxes with individual user accounts and multi-factor authentication (MFA) removes these vulnerabilities while keeping your general enquiry addresses accessible to the right people.

Quick Fix Steps

1. Purchase or assign Microsoft 365 licences with Exchange Online for every staff member who needs email access.
2. Create individual user mailboxes for each employee instead of sharing one login.
3. Set up shared mailboxes for accounts@, sales@, and other general addresses.
4. Grant Send As or Send on Behalf permissions to relevant staff.
5. Enable multi-factor authentication for every individual user account.
6. Disable or delete the old shared password and block legacy IMAP/POP3 authentication where possible.

Detailed Instructions

Create individual user accounts

1. Sign in to the Microsoft 365 admin centre with an administrator account.
2. Go to Users > Active users.
3. Select Add a user and complete the details for each staff member.
4. Assign an Exchange Online licence to each user during creation.
5. Instruct each user to set up their own password and register for multi-factor authentication at https://www.microsoft.com/en-us/security/multi-factor-authentication or through their Microsoft account security settings.

Create shared mailboxes

1. In the Microsoft 365 admin centre, go to Teams & groups > Shared mailboxes.
2. Select Add a shared mailbox.
3. Enter the name and email address (for example, [email protected]).
4. Select Save changes.
5. Once created, select the shared mailbox to manage members and permissions.

Assign access and send permissions

1. Open the shared mailbox you created.
2. Under Members, select Edit to add the staff members who need to view the mailbox.
3. Under Send as or Send on behalf, select Edit to add users who should be able to send email from the shared address.
4. Send as makes the email appear as though it came directly from the shared mailbox.
5. Send on behalf shows User on behalf of [email protected] in the From field.
6. Select Save changes.

Enable multi-factor authentication

1. In the Microsoft 365 admin centre, go to Users > Active users.
2. Select Multi-factor authentication.
3. Select each user and enable MFA.
4. Users will be prompted to register their phone or authenticator app at next sign-in.

Migrate existing email and stop using shared logins

1. Export mail, contacts, and calendars from the old shared IMAP/POP3 or cPanel webmail account.
2. Import the data into the corresponding shared mailbox or individual user mailboxes in Exchange Online.
3. Update DNS MX records to point to Microsoft Exchange Online so new mail is delivered to the new platform.
4. Change the password on the old shared account and disable it, or decommission the legacy mailbox entirely.
5. Tell staff to remove the old shared account from their phones and email clients and add their individual Exchange Online account instead.

Additional Recommendations

• Use centralised email signatures through Exchange Online transport rules or a third-party signature manager so all staff, including those sending from shared mailboxes, present a consistent brand.
• Share calendars from the shared mailbox or individual calendars so teams can coordinate appointments without sharing login credentials.
• Configure SPF, DKIM, and DMARC records for your domain to reduce the chance of your emails landing in recipients' junk folders.
• Review shared mailbox membership quarterly and remove access for staff who no longer need it.
• Block legacy authentication protocols (IMAP, POP3, SMTP AUTH) in Exchange Online to prevent older apps from bypassing MFA.

Troubleshooting

Staff cannot see the shared mailbox in Outlook

• Ensure the user has been added as a member of the shared mailbox and that permissions have had time to replicate (this can take up to 60 minutes).
• Ask the user to restart Outlook or Outlook on the web.
• In Outlook for Windows, check File > Account Settings > Account Settings and confirm the correct Exchange profile is loaded.

Emails sent from the shared mailbox are going to junk

• Verify that SPF, DKIM, and DMARC are correctly configured for your domain.
• Ensure the sending user has Send as or Send on behalf permission, not just folder access.
• Ask recipients to add your domain to their safe senders list if the issue persists.

A former employee can still access the shared mailbox

• Remove the former employee's user account from the shared mailbox Members list immediately.
• Disable or delete the former employee's individual Microsoft 365 account.
• If the former employee knew the old shared password, change it and ensure no one is logging into the shared mailbox directly.

If you need assistance migrating from shared logins, cPanel webmail, or legacy IMAP/POP3 to Microsoft Exchange Online shared mailboxes, Open a Ticket and our team will help you get it sorted.

Still Having Issues?