When does a shared mailbox actually need a licence?

"Shared mailboxes are free" is the one piece of Microsoft 365 licensing folklore everybody gets right. It is also incomplete in a way that costs nothing for years and then breaks a support queue on a Tuesday. Free is not a property of the mailbox — it's a quota, and there are exactly three ways to walk past it.

Free is a quota, and it fails in three steps

Microsoft's own wording is precise: a shared mailbox can store up to 50 GB of data without assigning a license to it. Not "a shared mailbox is free" — a storage allowance with a number on it. And the mailbox doesn't stop dead at that number. It degrades through the same three quota thresholds every Exchange Online mailbox has, which for the unlicensed tier sit at 49 GB, 49.5 GB and 50 GB.

Read the middle two columns again, because that is the whole failure mode. A person with a full mailbox gets a warning in Outlook and clears some attachments. A shared mailbox has no such person: Microsoft is explicit that the account isn't intended for direct sign-in and should always be blocked. Nobody is logged into invoices@ to see the warning. The first signal that reaches a human is an external sender saying "your address bounced my email".

The three cases that need a licence

Everything else about a shared mailbox stays free. These are the three scenarios where Microsoft names a SKU, and the SKU is the same one twice:

The third one is the expensive misunderstanding. "Put every mailbox on litigation hold" is a normal instruction from legal, and it quietly excludes the shared mailboxes unless each one carries a licence. A hold that was never applied looks identical to a hold that was — until someone asks for the data. And a hold changes the storage picture too: the Recoverable Items folder has its own quota, so it doesn't count towards the mailbox limit, and that quota goes from 30 GB to 100 GB the moment a hold lands. Two independent things are now filling up, and only one of them shows in the number everyone looks at.

What the usage report will and won't tell you

The tenant-wide view comes from getMailboxUsageDetail, one row per mailbox, no PowerShell session required. It carries Storage Used (Byte), Item Count, Has Archive, and — the useful part — all three thresholds as real columns: Issue Warning Quota, Prohibit Send Quota and Prohibit Send/Receive Quota.

What the report does not have is a column saying "this one is shared". There is no recipient type in it, which is exactly where the abstraction leaks: the mailbox that will bounce mail without warning is the one the report is least able to identify for you. In practice the 50 GB quota value plus an account with sign-in blocked is a reliable enough marker, and it's cheap to compute because both facts are already in data you pull for other reasons. One more wrinkle worth knowing before you trust a low number: any unlicensed shared mailbox created before July 2018 has a 100 GB size, so an old tenant will legitimately show both values with nothing attached to either.

The leaver flow, and the trap in it

Most shared mailboxes aren't created as shared mailboxes. They start as a person, and the person leaves. The standard move — convert the mailbox, drop the licence, keep the address alive — is documented and correct, but it has an ordering constraint people meet the hard way: the mailbox needs a licence assigned before you convert it, or the conversion option isn't offered at all. Remove the licence first and you have to add it back to proceed.

Then the size check. If the departed employee's mailbox is over 50 GB — common enough for anyone with ten years and a habit of large attachments — dropping the licence isn't an option until you delete enough to shrink it. Microsoft says so plainly, and it is the moment the free plan stops being free: you either spend an hour purging attachments or you pay for Plan 2 forever on a mailbox nobody reads.

Two more from the same page, both easy to skip. Don't delete the old user account — it anchors the shared mailbox. And if you don't reset the password, the original username and password keep working on the shared mailbox after conversion, which means the leaver's old credentials still open the leaver's old mail. That belongs in the same review pass as the licensed accounts nobody signs into.

None of this is hard. It's just invisible: three thresholds nobody can see, a hold that silently doesn't apply, and a conversion whose failure mode is a credential that still works. GraphPaaS reads mailbox usage per tenant on a schedule and keeps the history, so "which mailboxes are approaching their own quota" is a number you watch move rather than a question you answer after the bounces start — the same reason licence waste is a trend and not a spreadsheet.