A shared mailbox password is one that multiple people know and use to log into the same account. It feels practical for small teams — everyone can access the inbox without needing separate accounts — but it creates security and accountability problems that become apparent as soon as something goes wrong. This guide explains why, and what to do instead.
Why delegated access is cleaner
Delegated access allows each person to log into a shared mailbox using their own credentials. In Google Workspace, this is done through "Grant access to your mailbox." In Microsoft 365, shared mailboxes are a built-in feature that allows multiple users to send and receive from a shared address without sharing a single password. The mailbox appears in each authorised user's email client, but each login is tracked under their individual account.
This is cleaner for several reasons. First, each person's access can be revoked individually without changing a shared credential that everyone else also needs to update. When a staff member leaves, you remove their access from the shared mailbox — a two-minute task — rather than coordinating a password change across everyone who knew the old credential. Second, mailbox activity is logged against individual accounts, so if something goes wrong, you can identify who did what.
Most email platforms support delegated or shared mailbox access as a standard feature. Setup takes a few minutes and replaces the shared password without any disruption to how the mailbox is used day-to-day.
How shared accounts hide compromise
When an account has a single shared password and multiple users, it is impossible to tell from login logs which person actually signed in. If a suspicious login occurs at 3am from an unusual location, you cannot determine whether it was a compromised credential, a staff member working unusual hours, or an attacker who obtained the password. This ambiguity significantly complicates incident response.
Shared accounts also cannot use MFA effectively. Multi-factor authentication ties a second factor to a specific device or phone number. If five people share a login, whose device do you use? The result is that shared accounts typically have no MFA — making them easier targets for credential stuffing and brute force attacks.
If a shared password is included in a data breach (from a third-party service that used the same email/password combination), the attacker has access to the shared mailbox and potentially to every person who used that password elsewhere. Shared passwords tend to stay in use for longer than individual passwords and get shared in ways that are hard to track — over text, written on whiteboards, in shared documents.
A practical migration path
Migrating from a shared password to delegated access does not require IT expertise. The steps for Google Workspace and Microsoft 365 are both documented clearly in each platform's admin help centre. The basic process is: identify who actually needs access to the shared mailbox, grant each person delegated access using their individual account, confirm that each person can access the mailbox successfully, and then change the shared account's password to something long and random that no one needs to remember — it becomes a technical account rather than a human login.
- Stop sharing passwords for email accounts — use delegated access instead.
- In Google Workspace: Settings → Grant access to your mailbox, add each person's address.
- In Microsoft 365: Create a shared mailbox and add members via the admin centre.
- After migrating to delegated access, change the shared account password to a long random string.
- Enable MFA on each individual account that has delegated access.
- Review who has access to each shared mailbox when staff join or leave.
Shared passwords make accountability and fast incident response much harder.
Check email login security