Sign-in should be blocked for the accounts behind shared mailboxes

Every shared mailbox has a user account in the directory, even though it is not meant to be signed into. If that account is enabled and someone sets or resets a password for it, it becomes a shared login with no individual accountability and, in many cases, no multi-factor prompt. Attackers like such accounts because they are rarely reviewed.

Microsoft's documentation on shared mailboxes explains that people reach them through delegated permissions on their own accounts, and that the sign-in for the mailbox account should be blocked. See the pages under sources.

In the Microsoft 365 admin center, open Teams & groups, then Shared mailboxes, select a mailbox and look at the option to block sign-in. You can also open Users in the Microsoft Entra admin center and look at whether the account is enabled.

For many mailboxes at once, this read-only PowerShell lists every shared mailbox and whether its account is enabled (it needs the Exchange Online and Microsoft Graph modules and read permissions):

Connect-ExchangeOnline
Connect-MgGraph -Scopes 'User.Read.All'
Get-EXOMailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited |
  ForEach-Object { Get-MgUser -UserId $_.ExternalDirectoryObjectId -Property DisplayName,AccountEnabled } |
  Select-Object DisplayName,AccountEnabled

Any row with AccountEnabled set to True is a shared mailbox that can be signed into.

In the Microsoft 365 admin center, open the shared mailbox, choose the option to block sign-in and save. To do it in bulk, use PowerShell with the Graph module and the permission to update users, after you have reviewed the list from the check above:

Connect-MgGraph -Scopes 'User.ReadWrite.All'
Update-MgUser -UserId '<shared-mailbox-object-id>' -AccountEnabled:$false

Try the change on one mailbox first. ConfigCobra only reports this setting and never changes your tenant; an administrator applies the fix.

People who have Full Access or Send As rights on the shared mailbox are not affected. They continue to open it from Outlook or the web using their own accounts.

What stops working is any use of the shared mailbox's own credentials: someone signing in directly with its address and a password, or an old script, scanner or application that authenticates as the shared mailbox. Find those before you block sign-in, for example by reviewing recent sign-in logs for the account, and move them to a delegated or application-based method.