Multi-factor on the shared inbox: the ten-minute fix.

The problem with one shared password

Clubs and small firms often run info@ or secretary@ as an ordinary account whose password is passed around. Nobody can turn on multi-factor sign-in, because the second factor would sit on one person’s phone. When that person leaves, the password usually stays the same.

Microsoft 365

1. Make sure everyone who needs the inbox has their own Microsoft 365 account with MFA switched on (the Microsoft Authenticator app is simplest).
2. In the Exchange admin centre, convert the account to a shared mailbox. Shared mailboxes don’t need a licence of their own.
3. Give each person Full Access and, if they reply from it, Send As.
4. Block sign-in for the shared mailbox account so nobody can log in to it directly.

Google Workspace

Use a Google Group set up as a collaborative inbox, or mail delegation from the existing account. Each member signs in with their own account and 2-Step Verification. Then reset the old password and remove any recovery phone or email that belonged to a former member.

Two checks people forget

• Forwarding rules. Look for rules that forward mail to personal addresses. Attackers add them too.
• Connected apps. Remove old apps and devices that still have access to the mailbox.

Write it down

Note who has access, the date you made the change and who approved it. That one line answers the MFA question in most supplier and insurer questionnaires.