Why does a user have access to a Shared Mailbox

[JorisDebonnet]

The 'usual way' of giving someone access to a Shared Mailbox in Office365, is to add them to the list of 'Members'.

Now, I have a user who has access to a shared mailbox, which is fine, but I cannot figure out how it is configured. I just want to understand it. He has it as a separate mailbox in his Outlook, so can send and receive as it.

Via Microsoft 365 admin center > Groups > Shared Mailboxes > (details of that mailbox):

• He is not a Member of the shared mailbox (nobody is).
• There is no Email forwarding.
• When I "Edit mailbox permissions", there are no 'Read and manage', 'Send as' nor 'Send on behalf'.

Via Exchange admin center > recipients > shared > (details of that mailbox):

• Mailbox usage: the last logon is less than an hour ago. Clearly, he somehow has access.
• Mailbox delegation: "Full access" list is empty, and "Send As" contains two items: "NT AUTHORITY\SELF" and some kind of hash starting with "S-1-5-21-583....-...-...-..."
• Mailbox features > Mail Flow has forwarding disabled.

... why does my client have access to this mailbox? How can I figure this out?

(Note: This most likely used to be a 'regular mailbox', and was converted to a 'shared mailbox'; not sure when)

[#2]

The most likely way is your last hunch of it being logged directly into, since you can still technically log into a shared mailbox as long as the account is not disabled.

[#3]

He might also have folder-level access. Simply looking into how the account is added in Outlook should give you the answer.

[#4]

Thanks for your suggestions!

I have monitored the situation over the past week because I saw conflicting information. Turns out this mailbox effectively jumps between being a licenced and unlicenced (e.g. shared) mailbox. When I look now, Office365 admin center shows it in the "Active users (licenced)" list (Essentials), but Exchange admin center does not include it under "mailboxes". Both Office365 admin and Exchange admin do show it (also) under 'shared' mailboxes. We can agree this is weird, right? :thinking_face:

I'm thinking perhaps I can explicitly "convert it to shared mailbox", and then explicitly convert it back to "licenced account". Hopefully that will stick.