By default a shared mailbox creates a user object in Azure AD that is active. It is possible to reset the password for this user object and login directly into a shared mailbox. This is a potential security issue because they will not get Azure MFA or will be hit by any conditional access rule. […]