CIS.M365.1.2.2 - (L1) Ensure sign-in to shared mailboxes is blocked

Overview

1.2.2 (L1) Ensure sign-in to shared mailboxes is blocked

Shared mailboxes are used when multiple people need access to the same mailbox, such as a company information or support email address, reception desk, or other function that might be shared by multiple people. Users with permissions to the group mailbox can send as or send on behalf of the mailbox email address if the administrator has given that user permissions to do that. This is particularly useful for help and support mailboxes because users can send emails from "Contoso Support" or "Building A Reception Desk." Shared mailboxes are created with a corresponding user account using a system generated password that is unknown at the time of creation. The recommended state is Sign in blocked for Shared mailboxes.

Rationale

The intent of the shared mailbox is the only allow delegated access from other mailboxes. An admin could reset the password, or an attacker could potentially gain access to the shared mailbox allowing the direct sign-in to the shared mailbox and subsequently the sending of email from a sender that does not have a unique identity. To prevent this, block sign-in for the account that is associated with the shared mailbox

Remediation action:

Block sign-in to shared mailboxes in the UI:

1. Navigate to Microsoft 365 admin center https://admin.microsoft.com.
2. Click to expand Teams & groups and select Shared mailboxes.
3. Take note of all shared mailboxes.
4. Click to expand Users and select Active users.
5. Select a shared mailbox account to open its properties pane and then select Block sign-in.
6. Check the box for Block this user from signing in.
7. Repeat for any additional shared mailboxes.

PowerShell

1. Connect to Microsoft Graph using Connect-MgGraph -Scopes "User.ReadWrite.All"
2. Connect to Exchange Online using Connect-ExchangeOnline.
3. To disable sign-in for a single account:

$MBX = Get-EXOMailbox -Identity TestUser@example.com
Update-MgUser -UserId $MBX.ExternalDirectoryObjectId -AccountEnabled:$false

3. The following will block sign-in to all Shared Mailboxes.

$MBX = Get-EXOMailbox -RecipientTypeDetails SharedMailbox
$MBX | ForEach-Object { Update-MgUser -UserId $_.ExternalDirectoryObjectId -AccountEnabled:$false }

Related links

• Microsoft 365 Admin Center
• About shared mailboxes in Microsoft 365
• Create a shared mailbox
• Block Microsoft 365 user accounts with PowerShell
• CIS Microsoft 365 Foundations Benchmark v6.0.1 - Page 39

Test Metadata

Field	Value
Test ID	CIS.M365.1.2.2
Severity	High
Suite	CIS
Category	CIS E3 Level 1
PowerShell test	Test-MtCisSharedMailboxSignIn
Tags	CIS, CIS E3, CIS E3 Level 1, CIS M365 v6.0.1, CIS.M365.1.2.2, L1

Source

• Pester test: tests/cis/Test-MtCisSharedMailboxSignIn.Tests.ps1
• PowerShell source: powershell/public/cis/Test-MtCisSharedMailboxSignIn.ps1