CIS.M365.1.2.2: Ensure sign-in to shared mailboxes is blocked

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.1.2.2
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Microsoft 365
Related products	Exchange Online
Feature	Teams and groups
Security area	Access control
Resource type	Mailbox
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 1.2.2 (L1, E3 Level 1)
Framework controls	cis-m365:1.2.2 nist-800-53-r5:AC-2 Account Management
MITRE ATT&CK	T1078.004
Reads from	Exchange Online, Microsoft Graph

What this checks and how to fix it

1.2.2 (L1) Ensure sign-in to shared mailboxes is blocked

Shared mailboxes are used when multiple people need access to the same mailbox, such as a company information or support email address, reception desk, or other function that might be shared by multiple people. Users with permissions to the group mailbox can send as or send on behalf of the mailbox email address if the administrator has given that user permissions to do that. This is particularly useful for help and support mailboxes because users can send emails from “Contoso Support” or “Building A Reception Desk.” Shared mailboxes are created with a corresponding user account using a system generated password that is unknown at the time of creation. The recommended state is Sign in blocked for Shared mailboxes.

Rationale

The intent of the shared mailbox is the only allow delegated access from other mailboxes. An admin could reset the password, or an attacker could potentially gain access to the shared mailbox allowing the direct sign-in to the shared mailbox and subsequently the sending of email from a sender that does not have a unique identity. To prevent this, block sign-in for the account that is associated with the shared mailbox

Remediation action

Block sign-in to shared mailboxes in the UI:

1. Navigate to Microsoft 365 admin center https://admin.microsoft.com.
2. Click to expand Teams & groups and select Shared mailboxes.
3. Take note of all shared mailboxes.
4. Click to expand Users and select Active users.
5. Select a shared mailbox account to open its properties pane and then select Block sign-in.
6. Check the box for Block this user from signing in.
7. Repeat for any additional shared mailboxes.

PowerShell

1. Connect to Microsoft Graph using Connect-MgGraph -Scopes "User.ReadWrite.All"
2. Connect to Exchange Online using Connect-ExchangeOnline.
3. To disable sign-in for a single account:

$MBX = Get-EXOMailbox -Identity TestUser@example.com
Update-MgUser -UserId $MBX.ExternalDirectoryObjectId -AccountEnabled:$false

3. The following will block sign-in to all Shared Mailboxes.

$MBX = Get-EXOMailbox -RecipientTypeDetails SharedMailbox
$MBX | ForEach-Object { Update-MgUser -UserId $_.ExternalDirectoryObjectId -AccountEnabled:$false }

Related links

• Microsoft 365 Admin Center
• About shared mailboxes in Microsoft 365
• Create a shared mailbox
• Block Microsoft 365 user accounts with PowerShell
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 42

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: NZLostboy; contributors: HenrikPiecha, thomas-s-schmidt, ricmestre, Mynster9361. Open-source licences.