Shared logins and shared inboxes without shared passwords
A shared email account does not need a shared password. Microsoft 365 offers shared mailboxes that nobody signs in to directly, and Google Workspace offers delegation, collaborative inboxes, and a shared inbox feature. For logins that truly must be shared, the UK’s NCSC advises the smallest possible group, a password manager, and a new password whenever someone loses access.
How to share an email account without sharing the password
Give each person their own account, then give those accounts access to the shared address. Both Microsoft 365 and Google Workspace are built for this, and the UK’s NCSC, in its guidance on passwords, says delegation should replace shared accounts wherever possible. This page covers the shared logins part of protecting a small team’s logins.
A shared password causes two problems. Anyone who learns it keeps access until it changes, including people who left months ago. And nobody can tell who sent a message or changed a setting: Google gives that reason for never sharing an administrator account. NIST’s security controls add the obvious rule for the accounts that stay shared: change their credentials whenever someone leaves the group.
Your options at a glance
| Need | Microsoft 365 | Google Workspace |
|---|---|---|
| One address answered by several people (info@, support@) | Shared mailbox | Shared inbox (Business editions, rolling out), or delegation |
| A team that takes, assigns, and closes conversations | — | Collaborative inbox in Google Groups |
| An assistant who manages someone’s mailbox | Mailbox permissions | Gmail delegation |
| More than 25 people on one address | Microsoft 365 group | Delegation, up to 1,000 delegates |
In Microsoft 365: the shared mailbox
A shared mailbox is an address that members open from their own mailbox. To create one, go to the Microsoft 365 admin center, Teams & Groups, Shared mailboxes, Add a shared mailbox, then add the members. The rules, as of November 2026:
- it stores up to 50 GB without a license of its own, or 100 GB with an Exchange Online Plan 2 license;
- each member needs their own licensed mailbox, inside your organization;
- direct sign-in is blocked by default, and Microsoft says to keep it blocked; its system-generated password is not meant to be used;
- it supports up to 25 users; beyond that, Microsoft points to a Microsoft 365 group;
- members get Full Access to read it, and Send As or Send on Behalf rights to answer from it.
Two limits to know: you cannot stop a member from deleting messages, and messages sent from a shared mailbox cannot be encrypted.
In Google Workspace: three ways
- Shared inbox. An administrator feature of Business Starter, Standard, and Plus, released in phases. From the Admin console home page, under Users, choose Set up a shared email address. Delegates read, send, and delete; each message shows the inbox as sender and the delegate as “Sent by.”
- Gmail delegation. The administrator allows it under Menu, Apps, Google Workspace, Gmail, User settings, Mail delegation. The account owner then adds delegates from a computer, in Settings, See all settings, Accounts and Import, Grant access to your account. A delegate can read, send, and delete, but cannot change the password.
- Collaborative inbox. A Google Group whose owner turns on the feature in the group settings; members can take, assign, and close conversations.
Aliases are a different tool: up to 30 extra addresses per user, at no extra cost, but each belongs to a single person. For an address several people use, Google recommends delegation.
The logins that cannot be delegated
Some accounts still have a single login: a supplier portal, an older banking tool, a domain registrar. For those, the NCSC’s rules are:
- share it with the smallest possible group of people you know;
- keep the password out of sight, in a password manager that records who has access and syncs changes;
- change it as soon as someone is no longer allowed access;
- store any MFA tokens securely too, separately from written-down passwords.
Password managers handle this in two ways. 1Password uses shared vaults for lasting access, and a link to a copy of an item, with an expiry date, for one-off sharing. Bitwarden uses organization collections, where the item then belongs to the organization, and Send links that expire. These are examples, not endorsements.
For social media, use the roles the platform provides rather than one shared login, as Canada’s Get Cyber Safe guide advises for small businesses, and keep a list of the shared accounts that remain and who uses them, as Australia’s ASD recommends.
Microsoft 365 settings
Shared mailboxes are one part of a wider setup. See how security defaults protect Microsoft 365 accounts.
Google Workspace settings
Delegation works best once 2-Step Verification is enforced. Our page on securing Google Workspace for a small team starts there.
When a member leaves
Removing someone from a shared mailbox is quick; changing the passwords they knew is the step people forget. See closing every access when someone leaves.