Addresses such as info@ or billing@ can quietly come to depend on one person. One test message shows whether anyone else can find, check and answer what arrives.

Know what kind of address you have

Ask whoever manages your email how each shared address is set up, because the test and the fix both depend on it. In Microsoft 365, the usual tool for an address such as info@ that several people answer is a shared mailbox. Microsoft's guidance lists company information addresses, support addresses and front-desk mailboxes as typical uses.

Google Workspace can share an address through a Google Group set up as a Collaborative Inbox, or through Gmail delegation, where one account owner lets other people open that account.

Google is also releasing, in phases, a shared inbox that administrators create with Set up a shared email address on the Admin console Home page, for Business Starter, Business Standard and Business Plus. Until the option appears in your account, delegation or a group is the route to use.

Retire aliases and shared passwords

An alias fails this test by design. It forwards mail to one person's inbox, so nobody else can see what arrived or what was answered. Google notes that an alias cannot be delegated, because it is not a Google Account, and delegating the account behind it would open that person's whole mailbox. Move the address to one of the shared options before you test.

Sharing the password to an account is not a substitute. In Microsoft 365, every shared mailbox has a user account whose system-generated password is not meant to be known or used, a new shared mailbox has sign-in blocked, and Microsoft says to keep it blocked. Each member opens the shared mailbox through their own licensed mailbox instead.

If info@ is an ordinary user mailbox, an administrator can convert it while it still has its license, using Convert to shared mailbox on the Mail tab of its entry on the Active users page. If the mailbox is under 50 GB, the license can then be removed. Microsoft says not to delete the old user account, because it anchors the shared mailbox.

Microsoft also warns that if you do not reset the old password, the original username and password continue to work on the shared mailbox after conversion. So reset the password, and make sure sign-in is blocked for the account.

Choose the setup that fits

The vendors' documentation points to these choices:

  • A Microsoft 365 shared mailbox suits up to 25 people inside the business who all reply as the shared address, because Microsoft says more users can cause connection failures or duplicated messages.
  • A Microsoft 365 group is Microsoft's suggestion when more than 25 people need access, when people outside the business need access, or when you must restrict deletion.
  • A Google Collaborative Inbox suits a team that needs to see who has taken each conversation and which are still open.
  • Gmail delegation suits a team that wants one full mailbox, with up to 1,000 delegates per work account and about 40 at once in typical use, by Google's count.

Run the test

Pick a backup who has an account in your organization, since Microsoft does not allow outsiders into a shared mailbox. Give them access a day ahead, because both Microsoft and Google describe delays before new access works.

Run the test while the usual owner is still in, so problems can be fixed on the spot. Send one internal test message to the shared address from an approved account, then ask the backup to do the following without the owner's help:

  • Find the message in the shared mailbox, group or delegated inbox.
  • Check whether someone already answered or claimed it.
  • Reply using the shared address, not their personal one.
  • Confirm the reply is visible to the rest of the team.
  • Note every point where they got stuck.

In new Outlook, Microsoft says the From field of the reply should show the name of the shared mailbox. If it does not, the backup should stop and report it rather than send from a personal address.

What to check in Microsoft 365

Microsoft lists three permissions for a shared mailbox. Full Access lets a member open it and read, change or delete messages, but not send from it. Send As makes a reply look like it came from the shared mailbox, with no indication of who sent it. Send on Behalf shows the member sending on behalf of the mailbox, and replies go to the mailbox.

Microsoft's setup guide says Full Access and Send As are both required for a shared mailbox to work as intended. If someone has both send permissions, Send As is always the one used. Send on Behalf is not available in the Exchange admin center for shared mailboxes, so it is set with PowerShell.

An administrator can review the grants in the Exchange admin center under Recipients, then Mailboxes, by selecting the shared mailbox and choosing Manage mailbox delegation. The Get-MailboxPermission and Get-RecipientPermission cmdlets in Exchange Online PowerShell list the same grants.

If the mailbox is missing from the backup's Outlook, have them close and restart Outlook, which is when automapping adds it. Microsoft says automapping works only for permissions granted to individuals, not through any kind of group, so assign them directly. In new Outlook the mailbox appears under Shared with me, or the backup can right-click their account name and choose Add shared folder or mailbox.

If the first reply fails with an error saying the sender lacks permission to send on behalf of the specified user, Microsoft attributes it to replication delay after a new shared mailbox or member is added and says it goes away in about an hour.

Once replies go out, Outlook normally saves each one in the sender's own Sent Items, because the member is signed in to their own mailbox. The team will not find it in the shared mailbox. An administrator can keep a copy there by running Set-Mailbox with MessageCopyForSentAsEnabled set to True for replies sent as the mailbox, or MessageCopyForSendOnBehalfEnabled set to True for replies sent on behalf. Microsoft says this is the only workaround that applies to new Outlook.

Check how the backup will hear about new mail. Microsoft says Outlook on the web notifies a member of new mail in a shared mailbox's Inbox only when the mailbox is open in its own browser window, which the backup gets with Open another mailbox from their name in the navigation bar.

What to check in Google Workspace

A Collaborative Inbox needs Groups for Business and conversation history turned on. A group owner or manager turns it on in the group's settings under Enable additional Google Groups features, then uses Posting policies to choose who has the Who can moderate metadata permission. Members with it can use Take, Assign, Mark as complete and Drop on each conversation. Drop is Google's button for unassigning.

Members can then search by Assigned to and choose Assigned to me, which gives each person a view of what they are holding. Seeing conversations also depends on the Who can view conversations setting, so confirm the backup can see the test message at all.

Check each member's subscription too, since a backup set to No email gets no group messages in their inbox. Members change their own subscription settings.

The Who can post as group setting controls who can post from the group's address instead of their own. Google describes the Default sender option Group address as best for groups where many people respond on behalf of the group, such as a support group.

An internal test cannot show whether customers can reach the group. If the group holds no recent outside messages, ask your administrator to check the group's sharing and posting settings, and send a test from a personal address outside the organization.

With Gmail delegation, the account owner adds the backup in Gmail on a computer. The backup has a week to accept the emailed invitation, and access can take up to 24 hours, so add them at least a day ahead. They open the account from their own Gmail by choosing the account marked Delegated, which opens in a new tab that Google advises against bookmarking.

Google also says several features are missing from the Gmail apps for delegated accounts, so test on a computer first. Messages sent from Google's shared inbox show the shared address in From and the delegate in Sent by, unless hidden with the Sender information option.

Common mistakes and how to spot them

Watch for these, each with the sign that gives it away:

  • An alias in place of a shared address, which shows when the test lands in one person's inbox and nowhere else.
  • A shared password, which shows when someone signs in to info@ directly instead of opening it from their own mailbox.
  • A converted mailbox whose old password still works, caught by checking each converted account for a password reset and blocked sign-in.
  • Send on Behalf where you meant Send As, which shows when the recipient sees the member's name followed by on behalf of.
  • Two copies of every reply in the shared Sent Items, which Microsoft traces to the classic Outlook registry value DelegateSentItemsStyle set to 1 combined with MessageCopyForSentAsEnabled set to True.
  • A shared mailbox hidden from address lists, which Microsoft says breaks Send As and Send on Behalf in the Outlook desktop client and can keep a Full Access delegate from opening it.
  • A shared mailbox at its 50 GB limit, which Microsoft says first stops sending, and after some time stops receiving, with senders getting a non-delivery receipt.
  • A delegated Google account still set to Require user to change password at next sign-in, which Google says causes delegate errors until the setting is disabled.

Record the result

Write down what the test showed, somewhere the backup can find it when the owner is away:

  • Who owns the address and approves changes to it.
  • Who can send from it, and whether replies show the shared address.
  • Who can triage, claim or assign messages.
  • Where unresolved messages are noted.
  • Who is notified when new mail arrives.
  • When the test ran and what had to be fixed.

If only one person receives notifications, add an approved backup and repeat the test. Run it again after any staff change.

A worked example

Imagine a six-person property management office whose Microsoft 365 shared mailbox, info@, has one member, the office manager. An administrator adds the bookkeeper with Full Access and Send As, assigned to her directly rather than through a group, and the office manager sends a test message to info@ from her own account.

The bookkeeper restarts Outlook and finds info@ in her folder list. She cannot tell whether a similar question last week was answered, because the office manager's earlier replies were saved in her personal Sent Items rather than in info@. She answers the test as info@, and the reply fails with the send permissions error Microsoft describes.

An hour later the second attempt goes out. The office manager sees it arrive from info@ with nothing to show who sent it, but the reply sits only in the bookkeeper's Sent Items, so the administrator turns on MessageCopyForSentAsEnabled.

The third test passes, with a copy in the shared mailbox's Sent Items. The office records the bookkeeper as the approved backup, agrees that answered messages move to a folder named Done while open ones stay in the inbox, and plans to retest after the next staff change.

Now imagine a nine-person landscaping company on Google Workspace whose billing@ address is a Collaborative Inbox group. The backup, a crew scheduler, never sees the test in Gmail because her subscription is set to No email, so she changes it, opens the conversation in Google Groups and clicks Take.

Her reply goes out from her own address, because the group's default sender is still the author. The group owner changes Default sender to Group address and confirms the scheduler is covered by Who can post as group. The retest reply carries billing@, and the scheduler marks the conversation complete.

Confirm the fix held

After any fix, look for this evidence:

  • The permission list in Manage mailbox delegation, the group's settings or the delegation settings matches the record.
  • The reply as received shows the shared address alone, or the member's name with on behalf of if you chose Send on Behalf.
  • A copy of the reply sits in the shared Sent Items, the group conversation or the delegated mailbox.
  • The backup received a notification or a group email for the test.

What to do this week

  • List every shared address your business uses, such as info@, billing@ and orders@, and how each is set up.
  • Replace any alias or shared password with a shared mailbox, group or delegation.
  • Choose an approved backup for each address and grant access directly, at least a day before testing.
  • Run the test while the owner is in, fix what breaks and run it again.
  • Write down the result and put the next test on the calendar.

Short answers to common questions

A shared mailbox usually needs no license of its own. Microsoft requires an Exchange Online Plan 2 license for more than 50 GB, for in-place archiving or for litigation hold, but every member needs their own licensed Exchange Online mailbox.

Automatic replies from a shared mailbox need an administrator. Microsoft says only a Microsoft 365 admin can set them up, so request one in advance if you want it.

Anyone with Full Access can delete messages in a shared mailbox, and Microsoft says that cannot be prevented. It suggests a Microsoft 365 group when deletion must be restricted.

A backup can answer from a phone. The Outlook apps for iOS and Android can add a shared mailbox, while Google says some delegation features are missing from the Gmail apps.

Removing a backup reverses the setup. An administrator removes their permissions in Manage mailbox delegation, or a group owner removes them from the group, or the account owner removes them from the Gmail delegation list.

Where ALCO can help

ALCO USA Inc is an IT services company headquartered in Caldwell, Idaho, with technicians serving businesses across Idaho. Its services include Microsoft 365, Google Workspace, email security and help desk support. If the test turns up a permission problem you would rather not fix yourself, the ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources