can i disable or delete the associated AAD user account of a shared mailbox

Question

Hi

I would like to know what would the consecuences of disabling the associeted AAD user account of a shared mailbox.
and what would be then the best practice if this is not possible
Block Sing in ??

Thanks in advance.

Answer 1

By definition, a shared mailbox has a disabled AD account.

You should always disable the AD account for it

https://learn.microsoft.com/en-us/exchange/collaboration/shared-mailboxes/shared-mailboxes?view=exchserver-2019

Answer 2

Either someone re-enabled them in Azure or somehow they were not created correctly.

In a hybrid environment, if you create the AD account on prem, disable the AD account as well before creating the user or remote shared mailbox.

Any shared mailboxes with active accounts in Exchange Online should have their AD accounts disabled as well to be compliant

Answer 3

Hi @Alain Diaz Quesada ，

For Exchange Online, It's the expected behavior that when a shared mailbox is created in Exchange Online, an active user account is also created with a system-generated (unknown) password. However, this account is not supposed to be used to log in to the shared mailbox.

I didn't see official article about if it's okay to disable the account, but according to the documentation below, the best and recommended practice is to block sign-in for it:
Block sign-in for the shared mailbox account

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Thank you @Yuki Sun-MSFT and @Andy David - MVP i have indeed seen both of your approaches on the internet but i'm left with the interrogation then.
when creating or converting to a shared mailbox i need to disable the AAD account AND Block Sign in ? to be safe or blocking sign-in is a plus for safety reasons?

thanks a lot.

Answer 5

I'm using a simple Azure Logic App to disable these accounts on a recurrence basis. Check out my blog: https://prof-it.services/blog/disable-shared-mailbox-user-accounts-with-graph-api-leveraging-azure-logic-app/