Created by Claude - please verify

Shared / resource mailboxes with sign-in enabled - confirm nobody depends on signing in to a mailbox before blocking it.

Required Microsoft Graph permissions

User.Read.All AuditLog.Read.All Exchange.ManageAsApp — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1 for the 'last sign-in' column. The rest works without it.

Endpoints: Get-EXOMailbox -RecipientTypeDetails SharedMailbox,RoomMailbox,EquipmentMailbox · GET /v1.0/users · GET /v1.0/users?$select=signInActivity

Mailboxes come from Exchange Online PowerShell (Exchange.ManageAsApp + an Exchange admin role on the app), the same connection the existing mailbox reports use.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Shared & Resource Mailboxes With Sign-in Enabled

Every shared, room and equipment mailbox has a user account behind it. If that account can sign in, it is a password-based, usually MFA-less login to a mailbox several people read - a favourite foothold for attackers. Microsoft recommends blocking sign-in on all of them; people reach a shared mailbox through their own account.