Shared Mailboxes Needing a Licence
The question it answers: Which shared mailboxes need an Exchange Online licence they do not have, and which hold one they no longer need?
Shared mailboxes are free - until they grow past 50 GB, get an archive, or are placed on litigation or retention hold. Then they need an Exchange Online licence. Unlicensed ones out of those limits are a compliance gap; licensed ones that no longer need it are money to reclaim.
At a glance
Section titled “At a glance”| Where in the app | Exchange Online › Mail Security Posture › Shared Mailboxes Needing a Licence |
| Workload | Exchange Online |
| Kind | Table · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report. |
| Licence | Exchange Online. |
| Report id (API and MCP) | exchange.posture.shared-mailbox-licensing |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Mailbox | DisplayName | Text |
| Address | PrimarySmtpAddress | Text |
| Status | Severity | Status |
| Needs a licence because | NeedsLicenceBecause | Text |
| Size (GB) | SizeGb | Text |
| Archive | Archive | Text |
| Holds | Holds | Text |
| Exchange licence | HasExchangeLicence | YesNo |
Filters
Section titled “Filters”| Filter | Key (API) | On when the page opens |
|---|---|---|
| Only mailboxes with a licensing mismatch | mismatch | Yes |
What it needs
Section titled “What it needs”Licence: Exchange Online.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Exchange.ManageAsApp | Office 365 Exchange Online | Manage Exchange As Application | |
User.Read.All | Microsoft Graph | Read all users’ full profiles | |
User-LifeCycleInfo.Read.All | Microsoft Graph | Read all users’ lifecycle information | |
Organization.Read.All | Microsoft Graph | Read organization information |
Data sources it reads
Get-EXOMailbox -RecipientTypeDetails SharedMailboxGet-EXOMailboxStatistics (per shared mailbox)GET /v1.0/users (assignedLicenses)GET /v1.0/subscribedSkus
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/exchange.posture.shared-mailbox-licensing?size=100GET /ir-api/v1/reports/exchange.posture.shared-mailbox-licensing?filter=mismatchAn AI assistant reads it with the MCP tool get_report and the id exchange.posture.shared-mailbox-licensing. The client needs the Read grant for Exchange Online. See Using the API.