The Inbox Everyone Can Open and Nobody Can Explain

Every small organisation has one. The info@ inbox that everybody can open, nobody quite owns, and the password for which has been passed around like a spare door key. Sometimes it is taped inside a cupboard. Sometimes it is in a WhatsApp message from 2026 that says: do not share this. Sometimes it is simply known by everyone and changed by no one.

The shared inbox itself is not the villain. A team address like info@, admin@, or referrals@ is genuinely useful. It gives the outside world one front door. The problem is the shared login behind it. When five or twelve people sign in as the same account, you lose the two things small teams need most: a clear record of who did what, and a sensible way to add a second factor without handing the whole team the same one-time code.

This is not about buying enterprise software. It is about separating the mailbox from the human. The mailbox stays shared. The login becomes personal.

Why the habit survives

Shared logins survive because they are convenient and because nobody has had a quiet hour to fix them. A volunteers-run charity needs the enquiries inbox covered on a Tuesday morning. A small agency wants everyone to see the sales pipeline. A clinic manager wants the admin team to pick up patient admin without a licence for each person.

Then someone leaves, and the password does not. Or a phishing email arrives and three people click it from the same account. Or the insurer asks who has access to the finance inbox and the honest answer is: probably everybody, including the person who left in March.

The 2026 version of the taped password is often a note in a team chat. Same risk, better lighting.

What good looks like without an IT department

You do not need a complicated setup. You need a clean split between identity and mailbox.

Each person gets their own named account. That account has multi-factor authentication or, where supported, a passkey. The info@ address becomes a shared mailbox or a collaborative inbox. People are given delegated access to it from their own accounts. They do not know its password because there is no password to know.

A shared mailbox is a resource. A shared login is a single identity used by many humans. One of those scales. The other quietly becomes an audit problem.

You also need two named owners for the mailbox. Not a committee. Two people who can add or remove access. Write their names down. Put a review date in the calendar. Keep the old address working so customers are not disrupted.

The 45-minute migration plan

Pick a quiet period, not the busiest hour of the week. Have two people on the call or in the room: one to click and one to check. You will need admin access to Microsoft 365 or Google Workspace, a list of staff and volunteers, and a test email from an outside address. Do not delete anything until you have tested.

Minutes 0 to 10: inventory the humans

List everyone who currently uses the shared login. For each person, note whether they need to read, reply, send as the team address, or manage the calendar. Mark anyone who has left or is about to leave. Decide who will be a mailbox owner. This is a spreadsheet job, not a memory job.

Minutes 10 to 20: create or confirm named accounts

If people already have named accounts, good. If not, create them. In Microsoft 365, a shared mailbox can be used by licensed and unlicensed people depending on the setup, but each human still needs their own sign-in. In Google Workspace, you can use delegated access, a collaborative inbox, or a dedicated mailbox account with delegation, depending on your edition and how much control you want.

The point is not the brand name. The point is that no human signs in as info@.

Minutes 20 to 30: delegate, do not share

Convert the old shared login into a proper shared mailbox or collaborative inbox. Block direct sign-in to it. Give each named person the access they need: read and manage, send as, or send on behalf of. Use the least access that still lets them do the job. If someone only covers the inbox on Fridays, they do not need to send as the finance director.

Keep the public address the same. Customers should not notice the change. That is the whole trick.

Minutes 30 to 38: add second factors without locking out the team

Now protect the named accounts. Start with two people, test it, then roll it out. Use an authenticator app or a passkey where your provider supports it. Save the backup codes somewhere sensible, not in the same inbox. Set a recovery method that does not depend on one person's mobile phone.

This is the bit that answers the old objection: everyone needs in. Everyone still gets in. They get in as themselves, with their own second factor. The shared mailbox does not need its own code because nobody signs in as the shared mailbox.

If someone genuinely cannot use a smartphone, use a hardware security key or a different role that does not require mailbox access. Do not turn off MFA for the whole organisation because one person finds it awkward.

Minutes 38 to 45: test and write it down

Send a test email from outside. Check that it arrives. Reply from the shared address and confirm the sent item appears where you expect. Check the calendar if you use one. Remove access for anyone who has left. Write a one-page note: who owns the mailbox, who has access, how to add someone, how to remove someone, and when you will review it.

That note is the difference between a fix and a future mess.

Who reads what

A proper shared mailbox gives you a record. Microsoft 365 and Google Workspace both keep audit logs, though the detail depends on your plan. You do not need to become a forensic analyst. You need to be able to answer basic questions: who has access, when was it last reviewed, and who sent that reply.

Be transparent with staff. In the UK, monitoring must be proportionate and clearly explained. A shared inbox is a work resource, not a private diary, but that does not mean you can quietly watch people without telling them. A short line in your handbook or volunteer agreement is better than an awkward surprise.

The underdog advantage

Small teams can fix this faster than large ones. You do not need a project board. You need one quiet hour, two named owners, and the willingness to stop treating a mailbox password as a team secret.

Start with info@. Then do admin@. Keep the addresses. Retire the shared login. Give people their own keys, and give the mailbox a proper front door.