Why shared mailbox passwords should be retired
One password held by five people means no accountability, no audit trail, and a fire drill every time somebody leaves.
It happens in every company eventually. A new mailbox is created, and the password is handed to three or four people. It works, so nobody questions it.
Four problems that compound
Accountability disappears
An incorrect message goes out. Who sent it? Everyone says it was not them, and you cannot prove otherwise, because to the mail server every one of them is the same user.
Every departure becomes a fire drill
Someone leaves. The password must change. Then the new password must reach the remaining four people, usually over a chat application where it will sit permanently in the message history.
Two-factor authentication becomes impossible
Two-factor requires a device. Whose, out of five? In practice shared mailboxes end up without it, which means the most business-critical mailbox is also the least protected one.
Access cannot be graduated
You want an intern to read but not delete. With a shared password there is no mechanism to express that.
The alternative
Treat a mailbox as a resource rather than an account. Every person signs in as themselves, with their own two-factor authentication, and is granted exactly the level of access to that mailbox that their role requires.
Three things then follow automatically:
- Every action is attributed to a named individual in the audit log.
- When someone leaves you disable one account; nobody else's password changes.
- Different people can hold genuinely different levels of access to the same mailbox.
Migrating without disruption
Do not start with your most critical mailbox. Pick a smaller one, establish the model, let the team become comfortable, then extend it.
And do not change the old password immediately. Allow a fortnight of overlap so that nobody is locked out mid-task.