Shared mailboxes are not a reason to skip MFA
info@ and ar@ without MFA are a BEC starter kit. Convert, licence, or stop using them for money.
ITSIGN Administrator · October 1, 2025 · 2 min read
Either convert to a shared mailbox with no sign-in and grant access to people who have MFA, or licence the account and enrol it. Do not share a password in a chat.
If that mailbox talks to customers about invoices, treat it as privileged.
We clean this up in cloud and Microsoft 365 engagements.
Related reading
Email retention, PIPEDA, and the mailbox you never deleted
Keeping everything forever is not a strategy. It is a larger breach waiting for a number.
2 min read
When the phish comes from a vendor you trust
Their tenant, your payment. Callback still wins. So does knowing who is allowed to change details.
2 min read
Turn off IMAP and POP before someone else uses them
Legacy protocols skip modern MFA. They are still on in tenants that were migrated in a hurry.
2 min read
Want this applied to your environment?
A short conversation, an honest assessment of your current setup, and a clear proposal. No obligation and no pressure.