Guest User Invitation sent to Shared Mailbox in External Tenancy

Question

Hi all,

Are Entra external guest accounts that use a shared mailbox in their home 365 Tenancy as their email a viable option?

We have created a guest user account in our Entra directory. The email address used is for a shared mailbox in the external 365 tenancy. An invitation was sent to the same email address. However, when the external user is prompted to authenticate, they are prompted to sign in with the account of the invited guest - the shared mailbox - and are unable to use their own account despite having access to the shared mailbox.

We have inbound B2B cross tenant configuration set up for all users and applications. invitations to individual accounts rather than shared mailboxes works fine.

Thanks you.

Answer 1

Hello vonSmallHound,

Good day! Thank you for posting in the community.

Using a shared mailbox as the email for an Entra external guest account presents challenges, primarily because shared mailboxes in Microsoft 365 are not associated with a unique user account for authentication. Shared mailboxes are typically accessed by individual users with delegated permissions rather than having credentials of their own. Here’s why your setup encounters difficulties and potential considerations:

Shared Mailbox Authentication Limitation: Shared mailboxes don’t have their own login credentials, so they cannot directly authenticate when invited as a guest user in another Entra (Azure AD) directory. Guest account authentication requires a user identity tied to a unique login.

Inbound B2B Configuration Working with Individual Accounts: Invitations to individual accounts work because these accounts have their own authentication mechanisms, whereas a shared mailbox relies on its delegators.

Invite Individual Accounts Instead: Since your setup works for individual accounts, consider inviting specific users who have access to the shared mailbox. These users can act on behalf of the shared mailbox within your Entra directory.

Create a Dedicated Account: If using a shared mailbox email is essential, create a dedicated Microsoft 365 account in the external directory for the shared mailbox. This account can be associated with the shared mailbox and used to authenticate as a guest.

Clarify Access Requirements: Evaluate whether the guest really needs access tied to the shared mailbox or if individual user accounts suffice. Using personal accounts with delegated permissions is a more standard and reliable approach.

Cross-Tenant Access Settings: Verify if cross-tenant configurations, such as the "All Users" policy, include shared mailbox permissions or if adjustments are needed. However, this might still not resolve the authentication issue, as shared mailboxes inherently lack a credential-based sign-in.

The best practice is to avoid using shared mailboxes directly for guest user invitations. Instead, rely on inviting individual accounts with access to the shared mailbox or creating a dedicated account for it if absolutely necessary.

This aligns with Microsoft 365 and Entra directory’s authentication design.