Microsoft 365 Shared Mailbox Cold Email Sending Guide For 2026
By Puzzle Inbox Team · May 22, 2026 · 8 min read read
Microsoft 365 shared mailbox cold email sending: licensing rules, send-as permissions, throttle limits, and why shared mailboxes still break most outbound stacks.
Microsoft 365 Shared Mailbox Cold Email Sending Has Hard Limits
Microsoft 365 shared mailbox cold email sending sounds attractive because shared mailboxes are free (up to 50GB) and don't require a license to receive mail. Operators see the $0 line item and try to scale cold outbound through them. The catch: Microsoft explicitly throttles shared mailbox sending, requires a license on the sender, and applies the same recipient rate limit (10,000/day) as a regular mailbox, but with additional EXO Send Connector inspection that slows API-driven sequences.
Licensing Reality For Shared Mailboxes
To send from a shared mailbox via Send As or Send On Behalf, the user account performing the send needs a Microsoft 365 Business Basic ($6/user/month) license minimum. The shared mailbox itself does NOT need a license under 50GB. This means a 10-mailbox operation requires 10 licensed user accounts plus 10 shared mailboxes, total cost: $60/month versus $120 for 10 standard mailboxes. The savings are real but smaller than you think.
Throttle Limits You Will Hit
- Recipient rate limit: 10,000 recipients/day (same as standard mailbox)
- Message rate limit: 30 messages/minute via SMTP AUTH
- Maximum recipients per message: 500
- Send Connector inspection adds 200-400ms latency per send
- Outbound spam policy: 400 external recipients/hour default
For cold email, the practical ceiling is 30-40 sends/day per shared mailbox to maintain reputation, well below the technical throttle.
Send-As Permission Configuration
In Exchange admin center, navigate to Recipients → Mailboxes → select shared mailbox → Delegation. Grant "Send As" permission to your sending user. "Send on Behalf" creates the unsightly "via" header in Gmail and torches reply rates, always use Send As. Wait 60 minutes for permission propagation; Microsoft caches these aggressively.
SMTP AUTH And Modern Authentication
Microsoft disabled SMTP AUTH by default in 2023. To send cold email from a shared mailbox via Smartlead or similar, you must re-enable SMTP AUTH per-mailbox in the Exchange admin UI. Better: use OAuth2 via Microsoft Graph API if your sending tool supports it. OAuth bypasses several deprecation timers Microsoft has scheduled for 2026-2027.
DNS And Authentication
Shared mailboxes inherit the parent domain's SPF, DKIM, and DMARC. There's no separate authentication layer. Make sure your sending domain is fully configured per the SPF DKIM DMARC setup guide. If your shared mailbox lives on your primary domain, you're sending cold from your main brand, this is the deliverability mistake we see most often.
The Reputation Problem
Shared mailboxes share IP reputation pools with all other M365 tenants in your datacenter region. If neighbors get blocklisted, you absorb partial damage. Combined with the inability to truly isolate (no OU equivalent in M365 for shared mailboxes), this makes shared mailboxes a poor primary sending choice. Use them for reply handling or team aliases, not bulk cold outbound.
When Shared Mailboxes Make Sense
The legitimate use case: a centralized reply inbox where multiple SDRs handle responses from sequences sent via standard mailboxes. The shared mailbox becomes the hello@ or sales@ destination, not the outbound sender. This pattern works cleanly with most modern sequencers including Maildoso.
Puzzle Inbox Verification
Run a Puzzle Inbox seed test from the shared mailbox before scaling. You're verifying that Send As doesn't inject the "on behalf of" header and that DKIM signs correctly with your tenant's selector. Both fail silently in roughly 8% of M365 tenants we audit.
Warmup Considerations
Run warmup on the licensed sending user, not the shared mailbox. The shared mailbox is just a delivery target for warmup replies. Throttle warmup to 15-20 sends/day for the first 14 days to avoid M365's outbound spam policy triggers.