Untangling shared mailboxes for a community care charity

Why they called us back

We already knew this charity’s systems. Our team had previously worked through an external security audit with them, closing out more than twenty findings — that job is written up as passing a security audit for a community care charity. This time the trouble was email, and it arrived as a short list of things that had been quietly going wrong.

Four addresses, one Sent Items folder

The charity keeps a separate mailbox for each part of what it does: care, careline, accounts and a general address. All four were being worked from one member of staff’s account. That arrangement is ordinary in a small team, and it holds up right until somebody replies to something.

Every reply sent from a service address was filing itself into that one person’s Sent Items. Nobody else could see what had been answered on behalf of their own service, and one individual’s sent mail had become four services stirred together. Underneath that sat a second problem: a rule was deleting messages after thirty days. Nobody had authorised it and nobody could say how long it had been running. Items were also missing from mailboxes and folders, with no record of when they went. Their fourth ask was about files rather than mail: staff wanted the same documents whether they opened the office laptop or the one at home, which is what OneDrive is supposed to do without being asked twice.

There was one more line with the list. Weekdays were impossible for the person whose account it all ran through. Could we come on a Saturday? We went in on the Saturday.

Two hours, on site

• Sent items put back where they belong. We changed how the shared mailboxes attach to the account, so a reply sent from a service address files into that service’s own Sent Items rather than one person’s.
• Every rule read. We audited the Outlook rules and found the thirty-day auto-delete. It had no authorisation behind it, so it came off. The remaining rules were checked and the approved ones left alone.
• The missing items chased. We went after them through the retention areas in OneDrive and Outlook, which is where deleted material sits for a while before it is genuinely beyond reach.
• Tested before we left. We sent test messages from two of the shared addresses and confirmed each landed and filed correctly.

Where it left them

Four service mailboxes now behave like four mailboxes. A rule that had been removing mail on a timer is gone, and what remains in the rules list is there because somebody chose it. Missing material was pursued as far as retention allows, which is the honest limit once something has been deleted.

About this write-up

This work was delivered by our team, in one two-hour visit on a Saturday because that was the day the client could give us. We’ve anonymised the charity and everyone in it — but the list, the visit and the fixes are real. Shared mailboxes going sideways is one of the most common things we untangle for charities and care organisations, and it usually comes down to how the mailboxes were set up in Microsoft 365 rather than anything anyone did since.