Shared Mailboxes Nobody Can Access
The question it answers: Which shared mailboxes have no active Full Access or Send As holder, or received no mail for 180 days?
A shared mailbox that nobody can open still receives mail - customer enquiries, invoices, password resets - and nobody reads it. This scan lists shared mailboxes with no Full Access or Send As holder, or only disabled holders, and those that received nothing for 180 days (clean-up and retention candidates). LeaverCleanup covers leavers’ own mailboxes.
At a glance
Section titled “At a glance”| Where in the app | Exchange Online › Mail Security & Hygiene › Shared Mailboxes Nobody Can Access |
| Workload | Exchange Online |
| Kind | Findings list · dashboard tile |
| Data | A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report. |
| Licence | No extra licence needed. |
| Report id (API and MCP) | exchange.hygiene.orphaned-shared-mailboxes |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| State | Category | Text |
| Shared mailbox | Subject | Link |
| Check | Setting | Text |
| Delegates | Value | Text |
| Finding | Finding | Text |
| Detail | Detail | Text |
| Newest mail | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: No extra licence needed.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Exchange.ManageAsApp | Office 365 Exchange Online | Manage Exchange As Application | + View-Only Recipients |
User.Read.All | Microsoft Graph | Read all users’ full profiles | holder account state |
User-LifeCycleInfo.Read.All | Microsoft Graph | Read all users’ lifecycle information | with |
User.Read.All | Microsoft Graph | Read all users’ full profiles | with |
Data sources it reads
Get-EXOMailbox -RecipientTypeDetails SharedMailboxGet-EXOMailboxPermission (Full Access)Get-EXORecipientPermission (Send As)Get-EXOMailboxFolderStatistics -FolderScope Inbox (newest item)Get-EXOMailboxStatistics
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/exchange.hygiene.orphaned-shared-mailboxes?size=100POST /ir-api/v1/reports/exchange.hygiene.orphaned-shared-mailboxes/scanAn AI assistant reads it with the MCP tool get_report and the id exchange.hygiene.orphaned-shared-mailboxes. The client needs the Run scan grant for Exchange Online. See Using the API.