.png?width=1600&format=webp)
Most people only ever see one kind of mailbox: their own. But Microsoft 365 offers several mailbox types, and choosing the right one affects what you pay in licences, how secure your accounts are, how well your teams work together and, most importantly, whether your email records survive when staff move on.
This guide explains each mailbox type, when to use it, what it costs, and the traps we regularly find when reviewing client environments.
The short answer
Use a user mailbox for each person, a shared mailbox for role addresses like accounts@ or reception@, a room or equipment mailbox for anything people book, and a Microsoft 365 group when a team needs a shared inbox plus files, calendar and Teams. None of these is a record-keeping system. If you need to prove what was sent and received years from now, you also need an independent archive.
| Type | Best for | Licence needed? | Signs in directly? | Records risk |
|---|---|---|---|---|
| User mailbox | An individual staff member | Yes | Yes | Email leaves with the person if not managed |
| Shared mailbox | Role or department addresses (accounts@, sales@) | No, up to 50 GB without archive or hold | No, sign-in should be blocked | Any member can delete messages |
| Room / equipment mailbox | Meeting rooms, vehicles, projectors | Not normally | No | Low |
| Microsoft 365 group | Teams that need a shared inbox, calendar, files and Teams | Members need licences | No (members access it) | Content can be deleted by members |
| Distribution list | Sending one email to many people | No | Not a mailbox | No copy is kept |
| Archive mailbox | Extra storage for a user or shared mailbox | Depends on plan | Accessed through the main mailbox | Users can still delete items |
| Inactive mailbox | Keeping a former employee's mailbox | Yes, plus a hold before deletion | No | Lost if the hold isn't in place first |
User mailboxes
The user mailbox is the one everyone knows. It belongs to one person, needs a licence, and holds the email sent to and from that person.
The problem is that email sent to a person doesn't belong to that person. It belongs to the business. Quotes, approvals, complaints and instructions all sit inside individual inboxes, and when someone leaves, that history is at risk. It's one of the biggest causes of records lost when staff leave, and we see it across every industry.
User mailboxes are the right choice for individuals. They are the wrong choice for addresses that represent a role, a department or a function.
Shared mailboxes
A shared mailbox is an address that isn't assigned to any one person, such as accounts@, reception@ or enquiries@. Several staff can be given access, and the address keeps working no matter who joins or leaves. Clients and suppliers get one consistent place to write to, and your team gets a single view of the conversation.
Shared mailboxes are one of the most useful, and most often misconfigured, parts of managed Microsoft 365 email. Key facts from Microsoft's documentation:
- Free up to 50 GB. A shared mailbox can store up to 50 GB without a licence. Above that, it needs an Exchange Online Plan 2 licence (which raises the limit to 100 GB).
- Archiving and litigation hold need a licence. To enable an archive or place a shared mailbox on litigation hold, assign Exchange Online Plan 2, or Plan 1 plus Exchange Online Archiving.
- Users need their own licence. Staff access a shared mailbox through their own licensed Exchange Online mailbox. The shared mailbox doesn't need one just for access.
- 25 users is the practical limit. Beyond that, people may see connection failures or duplicated messages. Microsoft recommends a Microsoft 365 group instead.
- Full mailboxes stop sending, then stop receiving. When the storage limit is reached, the mailbox can still receive for a while but can't send. Eventually it rejects mail and senders receive a bounce.
- Never sign in to one directly. Every shared mailbox has an underlying user account. Microsoft's guidance is to always block sign-in for that account and keep it blocked.
Microsoft now raises a service health advisory when a tenant has unlicensed shared mailboxes over 50 GB, so oversized shared mailboxes are worth checking now rather than later.
Room and equipment mailboxes
Resource mailboxes exist for booking things. Room mailboxes represent physical spaces such as meeting rooms and training rooms. Equipment mailboxes represent items that aren't tied to a location, such as a projector, laptop or pool car.
Add them to a meeting invitation and they accept or decline automatically, based on availability and the booking rules you set. Delegates can approve requests where needed. They are a small but valuable part of a well-run Microsoft 365 modern workplace, especially for multi-site organisations where staff book rooms at another location.
Microsoft 365 groups and distribution lists
These two are often confused with shared mailboxes.
A Microsoft 365 group gives a team a shared inbox, a shared calendar, a SharePoint site for files and, if you choose, a Team in Microsoft Teams. Use a group when more than about 25 people need access, or when the team collaborates on files and chat as well as email.
A distribution list isn't a mailbox at all. It simply forwards a message to everyone on the list. Nothing is stored centrally, so there is no shared record of what was received. Distribution lists are fine for announcements, such as allstaff@, but shouldn't be used for addresses that clients write to and expect a reply from.
Archive mailboxes
The Microsoft 365 archive mailbox (also called the online or in-place archive) is extra storage attached to a user or shared mailbox. It's mainly a capacity tool. It moves older mail out of the main mailbox so the mailbox stays under its limit and Outlook stays responsive. How much archive storage you get depends on your licence.
Despite the name, it isn't an archive in the record-keeping sense. Users can still delete items from it, and retention settings decide what is kept. It solves a storage problem, not a compliance one.
What to do when staff leave
Leavers are where mailbox decisions matter most. You have three main options:
- Convert the mailbox to a shared mailbox. This frees the licence and lets a manager keep reading and replying. It only works without a licence while the mailbox stays under 50 GB with no archive or hold.
- Keep it as an inactive mailbox. If a retention policy or label is applied before the account is deleted, Microsoft keeps the mailbox as an inactive mailbox for the retention period. The hold must be confirmed first, and the right licensing must be in place.
- Delete the account. Without a hold, the mailbox data can be recovered for 30 days. After that, it's permanently removed.
Getting this right is part of good user lifecycle and offboarding. That means removing access, blocking sign-in and deciding what happens to the data on the day someone leaves, not months later when a dispute arrives.
Mailbox type isn't record keeping
This is the point most businesses miss. Choosing the right mailbox types makes email easier to manage, but none of them is designed to be a permanent, unalterable record:
- Any member of a shared mailbox can delete a message.
- Retention policies can be set to delete, and are often changed over time.
- Clients, contractors and suppliers keep writing to the personal addresses of staff they know, so email sent to personal addresses bypasses the shared mailbox you set up for it.
- Backups restore systems, but they aren't built to prove what was sent, when and by whom. As we explain in our guide, retention isn't the same as archiving.
If your business needs to retain email for compliance, audits or disputes, the safest approach is an independent, immutable email archive. It captures every message as it's sent or received, across user, shared and group mailboxes, and stores it so it can't be altered or deleted. Your mailbox structure can then change as the business changes, without putting records at risk.
Mailbox security checklist
Shared and role-based mailboxes are attractive targets because they're widely trusted and often loosely controlled. At a minimum:
- Block direct sign-in for every shared and resource mailbox account.
- Review who has Full Access, Send As and Send on Behalf permissions at least quarterly, and remove leavers immediately.
- Require multi-factor authentication for every staff member who can access a shared mailbox.
- Make sure mailbox auditing is on, so you can see who read, moved or deleted messages.
- Protect role addresses with SPF, DKIM and DMARC, so they can't easily be spoofed.
- Check for shared mailboxes nearing or over 50 GB, and license or archive them before they stop sending.
- Don't use a distribution list for an address clients rely on.
Frequently asked questions
Get your mailboxes reviewed
Most Microsoft 365 tenants we review have at least one of these issues: shared mailboxes with sign-in enabled, leavers' mailboxes about to be deleted, oversized unlicensed mailboxes, or client-facing distribution lists. Each one is a cost, security or records problem waiting to happen.
Book a free mailbox and archive review and we'll check your mailbox setup, licensing and retention, and show you where your email records are at risk.
