Disabling Sign in for Shared accounts

When a new shared mailbox is created, a system-generated password is automatically assigned, but it is not known to anyone. However, an administrator can reset the password and then sign into the mailbox directly if needed.

Create a shared mailbox - Microsoft 365 admin | Microsoft Learn

Every shared mailbox has a corresponding user account. Notice how you weren't asked to provide a password when you created the shared mailbox? The account has a password, but it's system-generated (unknown). You aren't supposed to use the account to log in to the shared mailbox.

But what if an admin simply resets the password of the shared mailbox user account? Or what if an attacker gains access to the shared mailbox account credentials? This would allow the user account to log in to the shared mailbox and send email. To prevent this, you need to block sign-in for the account that's associated with the shared mailbox.