Shared mailbox management: a process that holds

The best way to manage a shared mailbox is with a written process that fits on one page. It says who has access and with which permission. It names the folders or labels that show who owns a thread and where it stands. It lists what gets routed somewhere else, like a helpdesk. And it sets a date each quarter to check who still has access, what rules are running, and how full the mailbox is. The page keeps the habits. The quarterly check keeps the page true.

A shared mailbox rarely breaks on a single day. It drifts. Someone who left in March can still open it in June. A folder someone made for one client becomes a place nothing leaves. A forwarding rule keeps running long after anyone remembers why. This guide is the process that stops that, for Microsoft 365 and for Google Workspace. Microsoft’s and Google’s mechanics were checked against their own documentation on October 4, 2026.

If you haven’t built the address yet, team email when the team is two or three people covers the setup on both platforms. The daily habits, like claiming a thread and reply-by times, are in team email management. This page is the frame those habits sit in.

The shared mailbox management process at a glance

Here’s the whole process, by how often each part happens.

“The owner of the mailbox” is one named person. In a two- or three-person firm it’s usually a partner or the office manager. Their job isn’t to answer the mail. It’s to keep the process true.

Write the process on one page

The page is a short document everyone can find. A pinned note, a shared doc, or the first message in a folder called “How we run this” all work. Put these on it:

• The address and what it’s for. One line, such as “office@ takes client inquiries and anything without a named contact.”
• Who has access, and with which permission. A small table, with the date each person was added.
• The owner rule. How a thread gets its owner: by client, by kind of mail, or by whoever triages.
• The folder or label names. The exact names, so nobody invents a new one.
• Reply-by times. One line per kind of mail.
• What gets routed elsewhere. Which messages leave this mailbox, where they go, and who answers them there.
• The audit date. The next quarterly check, and who does it.

Here’s a filled-in example for a three-person accounting firm on Microsoft 365:

office@harperandlowe.com
Purpose: new inquiries, client questions without a named contact,
vendor mail.

Access (checked July 6, 2026)
  Dana Harper   Full Access + Send As   added Jan 2024
  Sam Lowe      Full Access + Send As   added Jan 2024
  Priya Nair    Full Access + Send As   added Mar 2026

Owner rule: by client. New clients go to whoever does the
morning triage.

Folders: 1 Dana / 1 Sam / 1 Priya / 2 Waiting on client /
3 Done 2026. Nobody adds a folder without changing this page.

Reply-by: deadline in the message, same day. New inquiry,
one business day. Routine, two business days.

Routed elsewhere: vendor invoices -> bills@ (Sam answers there).
Signs every reply with a first name.

Next audit: October 5, 2026 (Dana)

Keep it that short. A page longer than a screen stops being read.

Grant access by name with one sending permission

Every person gets in through their own account. Nobody shares a password to the shared address. On both platforms, access by name is what makes the later audit possible.

On Microsoft 365, give each member Full Access plus one sending permission, either Send As or Send on Behalf. Pick one for everyone. Full Access opens the mailbox. The sending permission decides what the client sees in the From line. The steps and what each permission shows the client are in setting up a team address on Microsoft 365.

Two things matter for the process:

• Add people one by one, not through a security group. A group hides who’s in it, and Microsoft’s automapping doesn’t work through one.
• The three permissions live in three places. Full Access, Send As and Send on Behalf are stored separately. Removing one leaves the others in place. That’s why the leaving checklist below names all three.

On Google Workspace, a Collaborative Inbox is a Google Group, and access is group membership. Google gives groups three roles. Google’s help page says managers can do most of what owners can, except delete the group, make someone else an owner, or change an owner’s settings.

• One owner. The owner of the mailbox from the table above.
• Everyone else a member or manager. Make them a manager only if they’ll change settings.
• Turn on “Who can moderate metadata” for every member. Without it, people can read conversations but can’t take, assign or mark them complete.

On plain Gmail with no Workspace, delegation is the only way to share an account. The account still belongs to one person, so the process here applies only loosely.

Build the conventions into the mailbox

The habits only hold if the mailbox shows them. Turn the owner rule and the statuses into folders or labels that everyone can see. The statuses themselves, and why four are enough, are set out in four statuses are enough. Here’s how they map onto each platform.

A number in front of each folder name keeps them in that order in Outlook’s folder list. A new folder each January keeps the Done folder from growing forever.

Three rules keep the structure from drifting:

• Folders change only through the page. If someone needs a new folder, they add it to the page first. Unlisted folders are where threads go to be forgotten.
• Filing stays inside the shared mailbox. A thread moved to someone’s personal folder disappears for everyone else.
• Rules that sort the mail run on the shared mailbox, not on one person’s Outlook. A rule in someone’s own Outlook only runs when their Outlook does, and it leaves with them.

Route what belongs somewhere else

Some mail that lands at a shared address shouldn’t be worked there. Vendor invoices belong with whoever pays the bills. Support requests may belong in a helpdesk. Routing moves them automatically, so nobody has to remember.

Write down one thing first: once a message is routed, the other place answers it. Answering from both is how a client gets two replies.

Inside Microsoft 365, routing within the firm is an Inbox rule on the shared mailbox. A member with Full Access can open the shared mailbox in Outlook on the web and add rules under its settings. An admin can do the same with PowerShell. Rules made this way belong to the mailbox, so they keep running whoever leaves.

To a helpdesk or ticketing tool outside the firm, the tool gives you an address to forward to. On Microsoft 365, an admin sets that as forwarding on the shared mailbox and keeps a copy in it. Check one setting before you do. Microsoft blocks automatic forwarding to outside addresses in many organizations. Microsoft’s page on external forwarding explains the default:

In 2021, the value changed to Off - Forwarding is disabled for new organizations and for existing organizations that weren’t actively using the Automatic - System-controlled value.

In practice, the forward fails quietly from your side. The original sender gets a bounce with the code 5.7.520. If you see that code, your admin can allow forwarding for this one mailbox with an outbound spam policy that covers only it. That keeps forwarding blocked for everyone else.

On Google Workspace, the simplest route into a helpdesk is to add the helpdesk’s forwarding address as a member of the group. Each new conversation then reaches it too. That address is outside your organization, and Google’s setting that lets group owners add outside members is off by default. An admin turns it on under the organization-wide group settings (Google, checked October 4, 2026).

Two small checks save a messy week:

• Watch for loops. If the helpdesk sends an automatic reply from an address the shared mailbox forwards, the two can answer each other. Send one test message and read what comes back.
• Keep the list short. Every routing rule goes on the page. If the list passes five or six, the mailbox is doing a job it wasn’t built for.

A weekly sweep for quiet threads

The daily triage handles new mail. The weekly sweep catches what the triage can’t see, which is mail that was claimed and then went quiet. It takes ten minutes on a Friday.

Open each folder in turn and look for:

• Threads in someone’s folder past their reply-by time. Ask the owner, don’t take it over.
• Threads in Waiting past their check-back date. These are the ones a client has quietly dropped.
• Anything still in the Inbox from before the last triage. A new thread nobody claimed is the clearest sign the triage slipped.
• Folders that aren’t on the page. Move their contents and delete them.

Note what you find in one line at the bottom of the page. A month of those lines tells you whether the process is holding.

A quarterly permission audit

Every quarter, the owner of the mailbox checks four things: who can get in, who can send, what rules are running, and how full it is. On a calendar it’s thirty minutes. Here’s how on each platform.

On Microsoft 365

In the Microsoft 365 admin center, open Teams & Groups, then Shared mailboxes, and select the mailbox. The member list there shows who has access. It’s a fair first look. PowerShell gives the full picture in a few lines. An admin connects to Exchange Online PowerShell and runs:

Get-EXOMailboxPermission -Identity office@yourfirm.com | Where-Object { $_.User -ne "NT AUTHORITY\SELF" }
Get-EXORecipientPermission -Identity office@yourfirm.com
Get-EXOMailbox -Identity office@yourfirm.com -Properties GrantSendOnBehalfTo | Select-Object GrantSendOnBehalfTo
Get-InboxRule -Mailbox office@yourfirm.com -IncludeHidden
Get-EXOMailboxStatistics -Identity office@yourfirm.com | Select-Object TotalItemSize

In order, those lines show:

1. who can open the mailbox, with Full Access
2. who can send as it
3. who can send on behalf of it
4. what rules run on it, including hidden ones
5. how full it is

Microsoft documents each of these: Get-MailboxPermission, Get-RecipientPermission and Get-InboxRule. Compare what comes back with the access table on the page. Anyone on the list who isn’t on the page comes off, or goes on the page with a reason.

Read the rules with care. A rule forwarding mail to an outside address that nobody on the page set up is the finding that matters most. Microsoft names the risk directly:

Users can configure Inbox rules to automatically forward messages to external senders (deliberately or as a result of a compromised account).

A rule like that is a reason to call whoever handles your IT that day, before you delete it.

Two more checks finish the Microsoft side:

• Sign-in is still blocked. Every shared mailbox starts with sign-in blocked. In the admin center, open the mailbox’s user account under Users and confirm it’s still blocked.
• The size has room. Microsoft says a shared mailbox holds up to 50 GB without a license. If it’s past 40 GB, plan the archive or the license now. What happens at the limit is set out in shared mailbox or regular mailbox.

The audit also tells you what the mailbox has a record of. Microsoft’s mailbox auditing page says:

Mailbox audit logging is turned on by default in all organizations.

That covers shared mailboxes. By default it logs when a member sends as or on behalf of the mailbox, deletes a message, or changes an Inbox rule. Opening and reading a message isn’t in that default set for members. On the standard plan, Microsoft keeps those records for 180 days. So “who deleted that email from March?” usually has an answer, if you look within six months. An admin searches it in the Microsoft Purview portal under Audit.

On Google Workspace

The group itself holds most of the answer. In Google Groups, open the group and go to People, then Members.

• Check each name against the page. Remove anyone who shouldn’t be there.
• Check the roles. One owner, and managers only where someone changes settings.
• Check for outside addresses. A helpdesk address you added on purpose belongs on the page. Anything else comes off.
• Check “Who can moderate metadata.” New members sometimes join without it and can’t assign anything.

If anyone reaches mail through Gmail delegation, the account holder checks the delegate list in Gmail under Settings, then Accounts. Delegation sits on one person’s account, so it’s easy to forget it’s there.

Keep a line for each audit

At the bottom of the page, add one line per audit: the date, who did it, and what changed. “October 5, 2026, Dana. Removed contractor Lee (left August). Size 31 GB.” That line is the proof, if a client or an insurer ever asks who could see their mail.

When someone joins or leaves

The quarterly audit catches drift. The same-day change stops most of it. When someone leaves, the owner of the mailbox works through this list on their last day:

1. Remove Full Access.
2. Remove Send As or Send on Behalf. It’s a separate permission, and removing Full Access doesn’t touch it.
3. On Google, remove them from the group, and from any Gmail delegation.
4. Give their open threads a new owner. Move everything in their folder to the person taking it over, then delete the folder.
5. Check the routing list. If anything was routed to them, point it somewhere else.
6. Update the page. Take their line out of the access table and note the date.

When someone joins, it runs the other way: add them by name, give them the page on their first morning, and add their line to the table.

When the process says it’s time for a dedicated tool

A good process also tells you when it has stopped being enough. The weekly sweep and the quarterly audit produce the evidence. Look at the notes at the bottom of the page.

• The sweep finds stale threads every week, even with everyone trying.
• The routing list keeps growing, because the mailbox is doing a helpdesk’s job.
• A client wants response times in writing, and the folders can’t show whether you met them.
• The mailbox passes 40 GB and the archive plan feels like a project.
• More than four or five people work it, or someone outside the firm needs in.
• The page itself goes unread.

One or two of these, now and then, is normal. Several at once, for a few months, is the point where a shared inbox tool earns its seat price. It adds assignment, status and response-time reporting on top of the address. Shared inbox software: what it is and how to choose compares the options. Many small firms never get there, and alternatives to a shared inbox tool makes that case.

If you’re still choosing how to build the address, choose once. Microsoft says it’s not possible to migrate a shared mailbox to a Microsoft 365 group, so moving later means starting a new one.

Point and the mail that never reaches the shared address

Point isn’t a shared mailbox, and it doesn’t run one. If a shared address is what your firm needs, the process above is the right home for it. Each of you links your own Gmail or Microsoft 365 account to Point, and each of you is one seat.

Most client mail at a small firm arrives at someone’s own address, and that’s where Point works. Your mail is ranked when it lands, so the thread that needs you today sits first. Each one carries a short summary. A request inside a message becomes a task with its date. A thread you’re waiting on comes back to you when it’s worth a nudge. Replies arrive as drafts written the way you write. Out of the box, nothing goes until you’ve read it and sent it yourself. Everything Point did is in an activity log you can look back through. See how it works.

How seats are counted is in per-seat billing. What a colleague can see once they have a seat is in team inbox software, and what a second seat can see.

Common questions

What is the best way to manage a shared mailbox?

Write a one-page process and keep it true. It names who has access and with which permission, the folders that show ownership and status, the reply-by times, and what gets routed elsewhere. One named person runs a ten-minute sweep each week and a thirty-minute audit of access, rules and size each quarter. Everyone signs in as themselves.

What are the five D’s of email management?

Most versions name five moves for any message: delete it, do it, delegate it, defer it, or designate it, meaning file it. In a shared mailbox, delegate becomes giving a thread an owner, and designate means filing inside the shared folders rather than your own. Team email management shows how each one changes for a team.

What are the disadvantages of using a shared mailbox?

A plain shared mailbox has no owner or status on a thread, so two people can answer the same client. It doesn’t track response times. Members can’t be stopped from deleting messages. On Microsoft 365 it holds 50 GB without a license. A written process with folders, a weekly sweep and a quarterly audit covers most of this for two or three people. The full list, with Microsoft’s wording, is in where a shared mailbox starts to strain.

What’s the difference between an Office 365 group mailbox and a shared mailbox?

A shared mailbox is one mailbox several people open, with a calendar. A Microsoft 365 group adds shared files, Planner and a connection to Teams, and it can take guests from outside the firm. For a single address like office@ that two or three people answer, the shared mailbox is the simpler fit. Microsoft says a shared mailbox can’t be migrated to a group later. The side-by-side table is in Microsoft 365 group or shared mailbox.

How often should we audit shared mailbox permissions?

Once a quarter, plus the same day anyone joins or leaves. The quarterly check covers who can open the mailbox, who can send from it, which rules run on it, and how full it is. On Microsoft 365, Full Access, Send As and Send on Behalf are stored separately, so check all three.

Can a shared mailbox forward to a helpdesk or ticketing system?

Yes. On Microsoft 365, an admin sets forwarding on the shared mailbox to the helpdesk’s address and keeps a copy. Many organizations block automatic forwarding to outside addresses by default, which shows up as a 5.7.520 bounce, so the admin may need to allow it for that one mailbox. On Google Workspace, add the helpdesk’s address as a group member, once an admin allows outside members.