The best shared inbox setup for an accounting firm of two to five people uses the email you already pay for. Make one client address. On Microsoft 365 that’s a shared mailbox. On Google Workspace it’s a Collaborative Inbox, which is a Google Group with assignment turned on. Each accountant opens it signed in as themselves, with multi-factor authentication, never with a shared password. Every client thread has one named owner. Audit logging and retention are set before tax season, not during it. That covers what the FTC expects of a tax practice, and it costs nothing extra. Every Microsoft and Google detail below comes from their own help pages, read on October 4, 2026.
The rest of this page goes in the order a firm owner usually asks: what the rules expect, who can open the mail, what record it leaves, how to split clients, and what changes when the volume triples.
The best shared inbox setup for an accounting firm
Here’s the setup in five parts. Each one has its own section below.
- One client address, built in your own platform. A shared mailbox on Microsoft 365, or a Collaborative Inbox on Google Workspace.
- Access by name. Each person is granted access with their own account. Sign-in to the shared address itself stays blocked.
- A record you can read later. Microsoft logs who sent and deleted from a shared mailbox by default. Google needs Vault for retention, which comes with Business Plus.
- One owner per client. Every client has a lead, and every thread carries that lead’s name.
- A tax-season plan. Seasonal help gets access by name with an end date, and the mailbox’s size gets checked before January.
If you haven’t built the address yet, the four kinds of team email address shows how to make each one. This page is about what’s different when the mail inside is client tax data.
What the rules expect of a small tax practice
A firm that prepares returns is a financial institution under the Gramm-Leach-Bliley Act. The IRS says so plainly in Publication 5708, its guide to writing a security plan:
Under the GLBA and Safeguards Rule, tax and accounting professionals are considered financial institutions, regardless of size. A requirement of the Safeguards Rule is implementing and maintaining a WISP.
That means the FTC’s Safeguards Rule, 16 CFR 314.4, applies to your client mailbox. Four of its requirements touch a shared inbox directly.
On access:
(i) Authenticate and permit access only to authorized users to protect against the unauthorized acquisition of customer information; and (ii) Limit authorized users’ access only to customer information that they need to perform their duties and functions
On sign-in:
Implement multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls
On logging:
Implement policies, procedures, and controls designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users.
On disposal:
Develop, implement, and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used
Together they ask for named access, a second factor, a log, and a disposal habit. A small firm still owes all four. The small-firm exception in 314.6 covers firms with fewer than 5,000 consumers. It lifts four specific paragraphs, and none of them is in section (c), where these four live.
Sharing client mail between the two of you
Two accountants reading the same client’s mail is allowed. Section 7216 limits what a preparer discloses outside the firm. Treasury Regulation 301.7216-2(c)(2) covers disclosure inside it:
an officer, employee, or member of a tax return preparer may use the tax return information, or disclose the tax return information to another officer, employee, or member of the same tax return preparer, for the purpose of performing services that assist in the preparation of, or assist in providing auxiliary services in connection with the preparation of, the taxpayer’s tax return.
So your colleague can read it without asking the client. The same paragraph requires the taxpayer’s consent before disclosure to anyone at the firm who’s outside the United States. That matters if your seasonal help works offshore.
Who can open the client mail
The Safeguards Rule’s access test comes down to one question. Could you name every person who can read this mailbox today? A shared mailbox or Collaborative Inbox makes that easy, because access is a list of named accounts.
The habit that breaks it is the shared password. When office@ is a normal account and everyone knows its password, nobody signs in as themselves. Multi-factor authentication ends up on one person’s phone, and the log can’t tell the two of you apart. Converting that account into a shared mailbox, or into a Google Group, fixes all three at once.
Here’s how the two platforms handle access:
| Microsoft 365 shared mailbox | Google Workspace Collaborative Inbox | |
|---|---|---|
| How a person gets in | An admin grants their own account Full Access | They’re added as a member of the group |
| Sending as the firm | Needs Send As or Send on Behalf as well as Full Access | Set by group posting permissions |
| Sign-in to the address itself | Blocked by default | No separate account to sign in to |
| Multi-factor | Each person’s own account | Each person’s own account |
| People outside the firm | Can’t be given access | Depends on the group’s settings |
Microsoft says a person with Full Access “can’t send email from the shared mailbox unless they also have Send As or Send on Behalf permission” (Microsoft Learn, checked October 4, 2026). For a firm, Send As is usually right, because the client sees the firm’s name. Full Access, Send As and Send on Behalf explains each one and how to grant it.
Microsoft also says “You can’t give people outside your business, such as people with a Gmail account, access to your shared mailbox” (Microsoft Learn, checked October 4, 2026). A contract preparer needs an account in your tenant before they can open it.
Gmail delegation is the other way in on Google. It hands a whole personal account to someone else, and Google says the delegate can read, send and delete mail in it (Google Gmail Help, checked October 4, 2026). That’s broader than “the customer information they need.” A Collaborative Inbox keeps the client mail in one place and leaves each person’s own inbox their own. Sharing a Gmail address covers the setup and where delegation stops.
The record of who did what
The log is where Microsoft 365 is ahead for a tax practice.
Microsoft says “Mailbox audit logging is turned on by default in all organizations,” and its table lists shared mailboxes as audited by default (Microsoft Purview, checked October 4, 2026). For a colleague working in a shared mailbox, these actions are logged out of the box:
- SendAs and SendOnBehalf, so you can see who sent a message as the firm.
- MoveToDeletedItems, SoftDelete and HardDelete, so you can see who deleted what.
- Update, when a message or its properties change.
- UpdateInboxRules, when someone adds or changes a rule.
The last one matters more than it looks. A forwarding rule nobody remembers adding to a client mailbox is worth a question the day you see it.
The log has limits worth knowing before you rely on it:
- It doesn’t last forever. Microsoft keeps Audit (Standard) records for 180 days. Going past that needs an E5-level license for the person who did the action (Microsoft Purview, checked October 4, 2026).
- It doesn’t stop a deletion. Microsoft says “You can’t prevent users from deleting messages in a shared mailbox” (Microsoft Learn). The log tells you it happened. A hold is what keeps the message.
- It records actions, not decisions. It shows who sent the reply. It doesn’t show who agreed to handle the client.
On Google Workspace, the Collaborative Inbox shows who each conversation is assigned to and whether it’s done. Retention and search for compliance come from Google Vault. Google’s Business editions page lists Vault under Business Plus only. Firms on Business Starter or Standard may be able to buy Vault licenses as an add-on. Either way, plan for it before the first time you need it.
Keeping client mail as long as you should
Retention pulls in two directions for an accounting firm. You need the history when a client asks what you told them in 2024. The Safeguards Rule also asks you to dispose of customer information within two years of last use, with exceptions for business need and legal holds.
The practical answer is to decide the period, write it in your security plan, and let the platform enforce it. On the mailbox side that means three checks:
- Size. Microsoft says a shared mailbox holds “up to 50 GB of data without assigning a license to it” (Microsoft Learn). Client documents arrive as attachments, so a firm mailbox fills faster than most. Past 50 GB it needs an Exchange Online Plan 2 license.
- Holds. For litigation hold or a bigger archive, Microsoft says the shared mailbox needs its own license: Exchange Online Plan 2, or Plan 1 plus the archiving add-on. That’s the setting that keeps a deleted message recoverable.
- Google Vault, if you’re on Google Workspace. Without it, a deleted message in the group is the group’s only copy.
How long to keep client files is a professional question as much as a technical one. Your state board, your insurer and your engagement letters may each set a period. Running the firm inbox covers the record-keeping side.
One owner for each client
Two people in one mailbox collide in one way: both see the email, and both assume the other has it. In an accounting firm the fix follows the client, not the message.
Give every client a lead. Write the list down. When a message lands, the lead owns it unless they hand it on by name. The second person reads, covers and helps, but the client hears from one voice.
The mailbox can carry that list:
- On Microsoft 365, a folder per client works for a small book of clients. A category with each person’s name marks who owns the thread.
- On Google Workspace, a Collaborative Inbox lets members with the right permission “assign responsibility for a conversation to yourself or another group member,” and mark it complete (Google Workspace Learning Center). That’s real assignment, built in.
Neither one tells you a thread has gone quiet for a week. One owner for every thread sets out the daily habits that make ownership stick, and a weekly sweep catches what slips.
Tax season with two people in one mailbox
From February to April the same mailbox can carry three times the mail. The setup above holds. A few things are worth deciding in December so it keeps holding.
- Seasonal help gets their own account. Grant access by name on the day they start. Write the end date down and remove access that day. Publication 5708’s sample plan says a departing person’s “e-mail access” is “inactivated” when they leave.
- The client lead still owns the client. A helper can draft and file. The lead sends anything that commits the firm.
- Check the mailbox size in January. A shared mailbox near 50 GB in March is a bad surprise.
- Agree when the inbox gets read. Two passes a day, each with one person driving, stops the double reply when the queue is long.
The work inside the season belongs to its own guide. Busy season covers what goes first and what waits until May.
Document requests that land in a shared mailbox
Clients will reply to a document request with a scanned W-2 attached, whatever you ask. Two things about a shared mailbox matter here.
First, the outgoing side. Microsoft says “Email sent from a shared mailbox can’t be encrypted because the mailbox doesn’t have its own security context (username and password)” (Microsoft Learn). If your security plan relies on encrypted email for sending returns, send those from a person’s own mailbox or through a portal. Publication 5708’s sample plan takes the same line:
It is Firm policy that PII will not be in any unprotected format, such as e-mailed in plain text, rich text, html, or other e-mail formats unless encryption or password protection is present.
Second, the incoming side. Documents that arrive by email sit in the shared mailbox until someone moves them. Agree where they go and who moves them, and the mailbox stays a place mail passes through rather than a second file system.
Asking well, so fewer documents arrive by email at all, is a separate skill. Managing client document requests covers the asks, the reminders and the client who’s late every year.
Gmail or Microsoft 365 for a small accounting firm
Most firms already have one, and switching for a shared inbox alone rarely pays. Here’s how the two compare for this job:
| Microsoft 365 | Google Workspace | |
|---|---|---|
| The shared address | Shared mailbox, free up to 50 GB | Google Group as a Collaborative Inbox, in your plan |
| Assigning a thread to a person | By convention, with categories or folders | Built in |
| Who-did-what log | On by default, 180 days on standard plans | Assignment and status in the group; Vault for retention |
| Holding mail after deletion | A license on the shared mailbox | Vault on Business Plus, or as an add-on |
Microsoft 365 suits a firm that wants the audit record without extra steps. Google Workspace suits a firm that wants assignment built into the shared address. Either one can meet the rules above if it’s set up on purpose.
Dedicated shared inbox software adds assignment, status and reply-by times on top of either platform. Choosing shared inbox software compares the tools and how each fits Gmail or Outlook. For a firm of two or three, you may not need one at all.
When the shared mailbox stops being enough
A plain shared mailbox is a good answer for two accountants. Its limits show up in a familiar order. Ownership lives in people’s heads, so a thread falls between you. There’s no status, so “did we answer the Harrisons?” means opening the thread. The log lasts 180 days on standard Microsoft plans. And the mailbox fills with attachments.
If one of those keeps costing you a client conversation, it’s time to look at a tool. The disadvantages of a plain shared mailbox walks through each one and when it justifies the move. What it’s like to actually work one inbox as two people, week to week, is told in running a two-person firm from one inbox.
Point beside the firm mailbox
If one client address is what your firm needs, build the shared mailbox or Collaborative Inbox above. It’s already in your plan.
Point connects each accountant’s own Gmail or Microsoft 365 mailbox, so each of you is a seat. It reads your own mail as it lands. In the morning, the client thread that needs you today sits at the top, already summarized in a line or two. When the client needs an answer, Point writes one in your voice. By default it stays a draft until you’ve checked the figures and sent it yourself. A log shows everything Point did for you. See how it works.
For a second accountant, per-seat billing explains how seats are counted.
Common questions
What is the best shared inbox setup for an accounting firm?
For two to five people, use the platform you already pay for. Make a shared mailbox on Microsoft 365 or a Collaborative Inbox on Google Workspace. Grant each accountant access with their own account and multi-factor authentication, give every client a named lead, and set audit logging and retention before tax season. Add dedicated shared inbox software only when ownership or status keeps slipping.
Do small accounting firms have to follow the FTC Safeguards Rule?
Yes. IRS Publication 5708 says tax and accounting professionals are financial institutions under the Safeguards Rule “regardless of size.” Firms with fewer than 5,000 consumers are exempt from four paragraphs under 16 CFR 314.6. Access controls, multi-factor authentication, encryption, disposal and activity logging in 314.4(c) still apply.
Can two accountants at the same firm share client tax information by email?
Yes. Treasury Regulation 301.7216-2(c)(2) lets an employee or member of a preparer in the United States disclose tax return information to another employee or member of the same firm for return preparation, without the client’s consent. Consent is required before disclosure to anyone at the firm located outside the United States.
Does a Microsoft 365 shared mailbox keep an audit trail?
Yes. Microsoft turns mailbox auditing on by default, shared mailboxes included. Send As, Send on Behalf, deletions and inbox-rule changes by people working in the mailbox are logged. Standard plans keep those records for 180 days, and longer retention needs an E5-level license.
Can a seasonal tax preparer get access to the shared mailbox just for tax season?
Yes, if they have an account in your organization. Grant their own account access when they start and remove it on a set end date. Microsoft doesn’t allow outside accounts, such as a personal Gmail address, into a shared mailbox.
Should an accounting firm use Gmail or Outlook for a shared inbox?
Use whichever the firm already runs. Microsoft 365 logs who sent and deleted from a shared mailbox by default. Google Workspace has assignment built into a Collaborative Inbox and uses Vault for retention, which is included in Business Plus. Both can meet the Safeguards Rule if they’re set up with named access and multi-factor authentication.