Shared & Resource Mailboxes With Sign-in Enabled

The question it answers: Which shared, room and equipment mailboxes have an account that can sign in, and was it used recently?

Every shared, room and equipment mailbox has a user account behind it. If that account can sign in, it is a password-based, usually MFA-less login to a mailbox several people read - a favourite foothold for attackers. Microsoft recommends blocking sign-in on all of them; people reach a shared mailbox through their own account.

Note

Mailboxes come from Exchange Online PowerShell (Exchange.ManageAsApp + an Exchange admin role on the app), the same connection the existing mailbox reports use.

At a glance

Where in the app	Exchange Online › Security › Shared Mailboxes With Sign-in
Workload	Exchange Online
Kind	Table · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Microsoft Entra ID P1 for the ‘last sign-in’ column. The rest works without it.
Report id (API and MCP)	exchange.security.shared-mailbox-sign-in

Columns

Column	Key	Type
Mailbox	DisplayName	Link
Address	PrimarySmtpAddress	Text
Type	MailboxType	Text
Sign-in	SignInDisplay	Status
Finding	Finding	Text
Last interactive sign-in	LastSignInDateTime	Date
Licences	LicenceCount	Text
Synced	IsSynced	YesNo

Filters

Filter	Key (API)	On when the page opens
Only mailboxes that can sign in	can-sign-in	Yes

What it needs

Licence: Microsoft Entra ID P1 for the ‘last sign-in’ column. The rest works without it.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
AuditLog.Read.All	Microsoft Graph	Read all audit log data
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application

Data sources it reads

• Get-EXOMailbox -RecipientTypeDetails SharedMailbox,RoomMailbox,EquipmentMailbox
• GET /v1.0/users
• GET /v1.0/users?$select=signInActivity

Through the API and MCP

GET /ir-api/v1/reports/exchange.security.shared-mailbox-sign-in?size=100
GET /ir-api/v1/reports/exchange.security.shared-mailbox-sign-in?filter=can-sign-in

An AI assistant reads it with the MCP tool get_report and the id exchange.security.shared-mailbox-sign-in. The client needs the Read grant for Exchange Online. See Using the API.