365 User accounts for work teams - Good idea or not?

[Deleted]

Hello, please bear with me this is my first post. Apologies if in wrong place!

I work for a small charity using E3 non-profit. We have user accounts and a combo of groups/shared mailboxes for some work teams. (Groups lack some features, hence the 'combo' approach!)

Our IT support company recommended using User accounts for everything as it is 'easier'

I had 1 response on a forum agreeing with this, saying that user accounts are more secure due to 2FA.

I completely agree with 2FA for user accounts, but I thought groups/shared mailboxes didn't have passwords, using a membership policy instead? Are they any less secure?

My question: Should we use User accounts for work teams?

It just seems odd so I would welcome some other opinions. Feel free to cite 'official' sources or your own practical experiences. NB I'm not after practical advice as I know how to use accounts, 2FA etc.

Thanks very much!

Andy

[#2 · Accepted solution]

You dont have to worry about shared mailboxes/Groups, you access these as "delegate" via your own account and credentials. Thus, you only need to protect your user accounts.

[#3]

@Vasil Michev Hi Vasil, thanks for your response.

This is what I thought! I can't understand why our IT support and the MS-certified respondent are advising me to switch to user accounts?

Thanks again,

Andy

[#4]

You cannot login as the shared mailbox hence 2FA is not required. It will be more of a risk if you have a user account that is shared with multiple users. I would just use shared mailbox for any non-user accounts for emails related.

[#5]

@MichaelVi24 thanks for this.

I've found that shared mailboxes still create a User account, which I've been told is a baked-in feature.

As long as I block sign-ins for this linked user account, that should be OK, right? 

[#6]

The AD account for shared mailbox is disabled by default. You can check if the account in AD is disabled or not. Also, you can disabled access to imap, pop, owa to prevent someone access the mailbox. B

[#7]

OK, that's good to know. It looks like they are disabled but I will check the other access options you suggest. Thanks very much!

[#8]

Hi, I would mark this as 'best response' too but it looks like you can only do this once :(

[#9]

All good.