Shared business inbox: set up without a shared password

Many small teams run an address such as info@ or accounts@ as an ordinary mailbox with one password that everyone knows. It works until someone leaves, the password has to change, and nobody can tell who sent what.

Microsoft 365 and Google Workspace both have a better way. Each person opens the shared address from their own login, so there is no shared password to pass around. This guide covers what each vendor’s documentation says, and the steps as they were written when we checked on 13 October 2026.

Why a shared password is the problem

Microsoft’s guidance is blunt. It says a shared mailbox “isn’t intended for direct sign-in”, and that you should always block sign-in for its account and keep it blocked. People reach the mailbox through their own account. On our reading, that means the two-factor authentication on each person’s login, if it is turned on, still protects it.

Google’s admin help says Google Accounts are intended for use by only one person. It warns that sharing an account increases the chances it will reach an account threshold, and that users might see a security challenge if Google suspects unauthorised access. If one person can’t pass that challenge, the account might be temporarily locked for everyone.

There is a practical reason too, and this one is also our own view, not a vendor’s. When each person uses their own login, removing one person’s access is a single change. Nobody else has to learn a new password.

Microsoft 365: use a shared mailbox

A shared mailbox is a mailbox several people can open and send from. A reply sent from it appears to come from the shared address, not the individual. It also has a shared calendar.

What it costs. Microsoft says a shared mailbox can hold up to 50 GB without a licence of its own. Each person who uses it needs their own licensed Exchange Online mailbox. Your subscription has to include email: Microsoft notes that Microsoft 365 Apps for business doesn’t. A licence is needed for the shared mailbox itself if you want more than 50 GB, an archive or a litigation hold.

The limits. Microsoft sets a maximum of 25 users. Only people inside your organisation can use it, and you can’t stop members deleting messages. If any of those is a problem, Microsoft points to a Microsoft 365 group instead. Email sent from a shared mailbox also can’t be encrypted.

To create one, you need an Exchange admin role. Microsoft’s steps are:

In the Microsoft 365 admin center, go to Teams & Groups, then Shared mailboxes. Select Show all in the left navigation if you can’t see Teams & Groups.
Select Add a shared mailbox and enter a name. This sets the email address, which you can edit.
Select Save changes. It may take a few minutes before you can add members.
Under Next steps, select Add members to this mailbox, then choose the people who will use it.

Members need two permissions to work normally. Full Access lets them open the mailbox and read, delete and change messages. Send As lets their replies go out from the shared address. Microsoft says both are required.

How staff see it. In most organisations the mailbox appears in each member’s Outlook automatically after they close and reopen it. That automatic step doesn’t work if you grant access through a security group, so add people by name. On a phone, members add it inside the Outlook app for iOS or Android: Microsoft’s steps are Add Account, then Add a Shared Mailbox. A new member may get a permissions error when they first try to send. Microsoft says to wait an hour and try again.

Check sent mail. By default, a message sent from the shared mailbox is saved in the sender’s own Sent Items, not the shared one. Colleagues then can’t see what was sent. To change it, open the shared mailbox in the admin center and select Edit under Sent items.

Confirm sign-in is blocked. Every shared mailbox has a matching user account behind it. Microsoft’s setup page says new shared mailboxes have sign-in blocked by default, and its guidance is to keep it that way. Ask your administrator to confirm, especially for a mailbox that was converted from a person’s account.

Google Workspace: three options

A shared inbox. Google’s admin help now describes a shared inbox that an administrator creates, for example sales@. The people given access are called delegates. They can read, send and delete its messages. Sent mail shows the shared address as the sender and, unless you hide it, which delegate sent it. Google lists it for Business Starter, Business Standard and Business Plus, and says it is being released in phases, so you may not have it yet. Where it is available, the path starts on the Admin console Home page: in the Users section, select Set up a shared email address. Google’s page doesn’t say whether the shared inbox needs a paid licence, so check before relying on it being free.

Gmail delegation. If the shared inbox feature hasn’t reached you, Google’s page says to use a delegated Gmail account. An admin first allows it in the Admin console, under Apps, Google Workspace, Gmail, User settings, Mail delegation. The mailbox owner then adds delegates in Gmail on a computer, under Settings, See all settings, Accounts, Grant access to your account. Delegates can read, send and delete email. They can’t change the password. Delegates must be in the same organisation, and access can take up to 24 hours to start. Google allows up to 1,000 delegates on a work account, with about 40 using it at once under typical use.

A Collaborative Inbox. This is a Google Group with extra tools for sharing the work. Members with the right permissions can take a conversation or assign it to someone, mark it complete, or mark it as a duplicate. It suits a support@ or bookings@ address where the question is who is handling each message. A group owner or manager turns it on in Google Groups: open the group, select Group settings, and under “Enable additional Google Groups features” choose Collaborative Inbox. Conversation history has to be on first. Then use the Who can post as group setting to choose who can reply from the group’s address.

What isn’t a shared inbox

An email alias is an extra address on one person’s account. Google lets you add up to 30 per user at no extra cost, but the mail still lands with one person.

A plain Google Group used as a mailing list, or a Microsoft distribution group, sends messages on to members’ own mailboxes. Microsoft describes distribution groups as a way to send notifications to a group of people. Neither gives you tools to assign a message or mark it done.

When someone leaves

Microsoft lets you convert a departing employee’s mailbox to a shared mailbox, which keeps the existing email and calendar. There are two catches in its documentation. Don’t delete the old user account, because the shared mailbox depends on it. And Microsoft warns that if you don’t reset the password, the original username and password keep working on the mailbox after conversion. It says a reset isn’t required, but for someone who has left we would do it.

Microsoft adds that for a departing employee you should take additional steps to make sure they can no longer log in.

If a departing person may have known a shared password, change it, as you would with logins a former web designer still holds.

Checklist

List every address that more than one person signs in to. Typical ones are info@, accounts@, bookings@ and support@.
In Microsoft 365, create a shared mailbox for each. In the admin center, go to Teams & Groups, then Shared mailboxes, then Add a shared mailbox.
Add each person by name with Full Access and Send As. Access given through a security group won’t make the mailbox appear in Outlook automatically.
Ask your Microsoft 365 administrator to confirm sign-in is blocked on the shared mailbox account. Microsoft says to block it and keep it blocked.
Change where sent mail is saved. In the shared mailbox settings, select Edit under Sent items so replies are kept in the shared mailbox.
In Google Workspace, check the Admin console Home page for “Set up a shared email address”. Google says to use delegated Gmail accounts if the shared inbox feature hasn’t reached you yet.
Change the old shared password once everyone has moved. This applies to any ordinary mailbox or Google account that staff used to sign in to together.
Reset the password when you convert a leaver’s Microsoft 365 mailbox to a shared mailbox. Keep the user account, because the shared mailbox depends on it.