Microsoft has released Security Updates (SUs) for vulnerabilities found in:
Exchange Server Subscription Edition (SE)
Exchange Server 2019
Exchange Server 2016
SUs are available for the f...
Updated Sep 08, 2026
Version 7.0
Blog Post
We found that after the July updates, our Exchange management accounts needed mailboxes associated or EPC threw a continuous error that prevented us from using the console. Is that a new known dependency? Thanks!
This is a common issue, if the system mailboxes are offline or not reachable. Technical background: login to ECP goes through OWA for authentication. OWA *always* requires a mailbox to sign-in. For Exchange Admins without mailboxes (not a mailbox user) or Exchange background tasks (e.g. mailbox move and migration), Exchange is silently utilizing one of the system mailboxes (arbitration mailboxes) for authentication.
So, if Exchange admin users do not have a mailbox (which is Microsoft best-practice for security reasons) AND the system mailboxes aren't available/reachable for some reason, the Exchange admins won't be able to login to ECP! This an Exchange architecture dependency only little known within Microsoft support ;-)
I know this doesn't seem like the right place to ask this question, but since others have mentioned management accounts and possible mailbox requirements I will ask it here. A year or so ago when we first installed Exchange SE, the Exchange administrator account that was used for installation had a mailbox created for it during install. I have left it but always wondered if it's needed. I figured it was since it was created but don't know what purpose it serves. All other mailboxes are in the cloud (outside of system and arbitration mailboxes) so it bothers me :) Is it safe to delete? Thank you.
If the account you use to install Exchange doesn't have a mailbox, the installer enables one. I typically disabled the mailbox afterward, just so it wasn't sitting around collecting email. I've never found there to be an impact if you disable the mailbox. Just make sure you disable it and not remove it, since the latter would delete the administrator account.
