Symptom
When sending email via WinMan using a shared mailbox as the “From” address, the request fails with:
403 Forbidden
Error: Access is denied. Check credentials and try again.This typically happens even though:
- The integration has previously worked for regular (licensed) user mailboxes
- Send As (or Send on Behalf) permissions have been correctly granted on the shared mailbox
- The email account appears valid and the correct user is authenticated
Most Common Cause: Missing License on the Shared Mailbox
Shared mailboxes in Microsoft 365 do not require a license for basic use through Outlook or Outlook on the Web (OWA) — Microsoft provides free storage for shared mailboxes up to a certain size. However, programmatic access via Microsoft Graph (or EWS) enforces stricter licensing requirements than the Outlook client does.
Result: an unlicensed shared mailbox can send/receive fine through Outlook, but will fail with a 403 error when accessed via the Graph API — even with correct Send As permissions in place.
This is a documented Microsoft behavior, not a bug in your integration.
How to Confirm This Is the Cause
Ask your Exchange/Microsoft 365 admin to test the following:
- Test in Outlook/OWA: Log in as the user who has Send As rights, and manually send an email with “From” set to the shared mailbox address.
- ✅ Succeeds in Outlook, fails via Graph API → strongly indicates a licensing issue (this document)
- ❌ Fails in Outlook too → this is a permissions issue, not licensing — see “Other Causes” below
Fix: Assign a License to the Shared Mailbox
What license is needed
- Exchange Online Plan 1 or Plan 2 is sufficient
- A full Microsoft 365 Business or E-series license is not required just for this purpose
Option A: Microsoft 365 Admin Center (recommended — easiest)
- Sign in to admin.microsoft.com as a Global or License admin
- Navigate to Billing → Licenses
- Select an available license (e.g. Exchange Online Plan 1)
- Click Assign licenses
- Search for the shared mailbox by name — shared mailboxes appear as assignable targets even though they aren’t standard user accounts
- Assign the license and save
Note: If the shared mailbox doesn’t appear in the assignment picker, or no licenses are available, the tenant will need to purchase an additional Exchange Online Plan 1 license before this step can be completed. This is a paid add-on if no spare seats exist.
Option B: PowerShell (alternative, useful for scripted setups)
powershell
# Connect to Microsoft Graph PowerShell
Connect-MgGraph -Scopes "User.ReadWrite.All"
# Find the correct SKU ID for Exchange Online Plan 1
Get-MgSubscribedSku | Select SkuPartNumber, SkuId
# Look for SkuPartNumber: EXCHANGESTANDARD (Plan 1) or EXCHANGEENTERPRISE (Plan 2)
# Assign the license to the shared mailbox
Set-MgUserLicense -UserId "sharedmailbox@customerdomain.com" `
-AddLicenses @{SkuId = "<SkuId-from-above>"} `
-RemoveLicenses @()Important: Don’t Remove the License After Testing
Some admins assign a “spare” or “utility” license temporarily just to confirm the fix works, then remove it afterward to reclaim the seat. This will break Graph API access again.
If the shared mailbox needs to keep working with the integration long-term, the license assignment must be permanent, and the tenant should budget for a dedicated seat rather than rotating a shared one.
Permission Propagation Note
After assigning a license, allow up to 15–60 minutes for the change to propagate. If testing immediately after assignment, a fresh token/sign-in may be required — a previously issued access token will not reflect the new license state.
Other Causes (If Licensing Is Not the Issue)
If the Outlook/OWA test in step “How to Confirm” also fails, check the following instead:
| Cause | How to check |
|---|---|
| Send As not actually granted, or granted to wrong identity | Get-RecipientPermission "sharedmailbox@domain.com" | fl Trustee,AccessRights |
| Full Access granted instead of Send As | Full Access alone does not grant SendMail rights via Graph |
| Conditional Access policy blocking the app | Check Entra ID sign-in logs for CA failures scoped to the app or Exchange Online |
| UPN / primary SMTP address mismatch | Ensure the “from” address used in the email account from address call matches the mailbox’s primary SMTP address exactly |