How to Configure a Mail Flow Rule in Exchange Online
Step-by-step guide to creating Exchange Online mail flow (transport) rules — conditions, actions, exceptions, common patterns, and PowerShell.
TL;DR: In the Microsoft 365 admin center, go to Teams & Groups > Shared mailboxes > + Add a shared mailbox. Give it a name and email address, save, then add members with Full Access and Send As permissions. No license is required as long as the mailbox stays under 50 GB.
Shared mailboxes are how teams handle a common email address like info@, support@, or sales@. Multiple people can read and send from a single inbox without sharing credentials. This guide creates one in the admin center and PowerShell, then walks through the permissions model that trips most admins up.
A shared mailbox is a regular Exchange Online mailbox attached to a disabled user account (sign-in is blocked by default). Members access it as a delegate from their own Outlook session — there’s no separate password, no license consumption (under 50 GB), and no extra cost.
The mailbox shows up automatically in members’ Outlook profiles via auto-mapping if you grant Full Access through the standard tools. Replies sent from the mailbox appear to come from the shared address, not the individual user, when Send As is also granted.
info@, support@, sales@, careers@When you’d want a Microsoft 365 Group instead: if collaboration is broader than email — files, Planner, Teams chat, etc. Shared mailboxes are for email-only.
The simplest path. The admin center handles the disabled user account, mailbox creation, and permission grants in a single workflow.
Useful when you’re already in the EAC for other recipient work.
For scripting or bulk creation, use the Exchange Online PowerShell module:
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline
# Create the shared mailbox
New-Mailbox `
-Shared `
-Name "Support" `
-DisplayName "Support Team" `
-PrimarySmtpAddress "support@contoso.com" `
-Alias "support"
# Grant Full Access to a security group
Add-MailboxPermission `
-Identity "support@contoso.com" `
-User "support-team@contoso.com" `
-AccessRights FullAccess `
-InheritanceType All `
-AutoMapping $true
# Grant Send As to the same group
Add-RecipientPermission `
-Identity "support@contoso.com" `
-Trustee "support-team@contoso.com" `
-AccessRights SendAs `
-Confirm:$false
Granting permissions to a mail-enabled security group (rather than individual users) is the maintainable pattern — add and remove people from the group instead of touching the mailbox.
Three flavors, often confused:
| Permission | What it does | When to grant |
|---|---|---|
| Full Access (Read and manage) | Open the mailbox, read mail, create and modify items, manage folders. Auto-maps the mailbox in Outlook. | Always — anyone who needs to use the shared mailbox needs this. |
| Send As | Send messages that appear to come from the shared mailbox address. | Always — without this, replies appear to come from the individual user’s address. |
| Send on Behalf | Send messages that appear as “User on behalf of Shared Mailbox”. | Rarely — use Send As unless you specifically want the “on behalf of” attribution. |
Grant Full Access + Send As to anyone using the mailbox. Don’t mix Send As and Send on Behalf for the same user; the behavior is unpredictable.
When you create a shared mailbox in the Microsoft 365 admin center, the underlying user account already has sign-in blocked. When you create one through PowerShell with New-Mailbox -Shared, double-check this:
Update-MgUser -UserId "support@contoso.com" -AccountEnabled:$false
Or via the admin center: Users > Active users > [select the user] > Block sign-in.
A shared mailbox account that can sign in is a security hole — there’s no individual owner to set up MFA on it, so it’s a soft target.
-AutoMapping $false) for high-volume admins.Step-by-step guide to creating Exchange Online mail flow (transport) rules — conditions, actions, exceptions, common patterns, and PowerShell.