Shared Mailbox or Distribution List? A Plain-English Guide for SA Businesses

Walk into any law firm, accounting practice or healthcare reception in South Africa and you'll find the same quiet chaos: an inbox called info@ that everyone is supposed to watch, but nobody owns. Client emails sit unanswered for two days. Someone replies from their personal address by mistake. A POPIA-sensitive document gets forwarded to the wrong person. And when the new receptionist starts on Monday, nobody knows how to give her access without sharing a password.

This isn't a people problem. It's a setup problem. And the fix is usually one of two free tools you already have in Microsoft 365: a shared mailbox or a distribution list (also called a distribution group). They sound similar. They aren't. Picking the wrong one is why your team keeps dropping the ball on client communication.

Here's how to tell them apart, when to use each, and how to set them up properly.

What a Distribution List Actually Does

A distribution list is essentially a forwarding address. You email partners@yourfirm.co.za and the message lands in each individual partner's personal inbox. That's it. There's no central inbox to log into. No shared sent items. No record of who replied or whether anyone did.

Distribution lists are excellent for one-way announcements. Think:

• all-staff@ for HR notices and the office WiFi password change
• directors@ when reception needs to flag a walk-in client to the partners
• accounts@ if you only ever receive supplier statements and forward them on

The big weakness: if everyone receives a copy, everyone assumes someone else is handling it. And when somebody does reply, they reply from their own address — so the next email from that client comes back to one person, not the group. The thread fragments. Information gets lost.

What a Shared Mailbox Actually Does

A shared mailbox is a real inbox that multiple people can open inside Outlook, alongside their own. Everyone who has access sees the same emails, the same folders, the same sent items. When Thandi replies to a client query from info@yourfirm.co.za, the reply shows in the shared sent folder so Sipho can see it was handled — and the client's response comes back to the shared inbox, not to Thandi personally.

Shared mailboxes are the right tool when:

• More than one person needs to respond to emails sent to a common address
• You need a paper trail of who said what to which client (critical for regulated firms)
• Staff change, but the inbox history needs to stay with the business
• You want to assign, flag, or categorise emails as a team

For most professional services firms, info@, reception@, accounts@, bookings@ and support@ should all be shared mailboxes — not distribution lists.

And here's the part most SA business owners don't know: in Microsoft 365, shared mailboxes are free. You don't need to buy a licence as long as the mailbox stays under 50GB and isn't a person's primary mailbox. You're probably already paying for the capability.

A Simple Decision Test

Before you set anything up, ask one question: Does someone need to reply on behalf of the business from this address?

• Yes → Shared mailbox.
• No, it's just an internal broadcast → Distribution list.

That's the whole rule. If you find yourself wanting both — say, accounts@ needs to receive supplier emails AND send statements to clients — the shared mailbox wins. A shared mailbox can do everything a distribution list does, but a distribution list can't reply.

Setting Them Up Without Breaking Anything

A few practical points the average IT setup gets wrong:

1. Don't convert a personal mailbox into a shared one without a plan. When a staff member leaves, the temptation is to convert their mailbox to shared so the team can keep handling their clients. That's fine for a handover period, but it shouldn't be permanent. Long-running shared mailboxes should live on a generic address (info@, accounts@) — not jane@.

2. Decide who has access, and document it. Every shared mailbox should have an owner (usually a manager) and a defined list of users. This matters for POPIA: if a client complains that the wrong person saw their information, you need to be able to show who had access and when. This is exactly the kind of thing a proper Microsoft 365 management setup documents from day one.

3. Turn on "Send As" properly. Without this permission, replies from a shared mailbox can accidentally go out from the user's personal address. Clients then reply to the wrong place. Check this for every user you grant access to.

4. Don't nest distribution lists three levels deep. We've seen all-staff@ contain gauteng-team@ which contains jhb-office@ which contains reception@. When someone leaves, removing them from one list doesn't remove them from the others. Keep it flat.

5. Review access quarterly. Staff move between teams. People leave. If you haven't audited who's in your shared mailboxes and distribution groups in the last six months, somebody who shouldn't be reading client emails probably is.

Where This Quietly Becomes a Security Issue

For regulated firms — legal, financial advisory, healthcare, audit — your email setup is part of your compliance posture. A shared mailbox with five ex-employees still on the access list is a POPIA finding waiting to happen. A distribution list that quietly forwards client correspondence to a personal Gmail address (yes, we've found this) is a data leak.

This is the unglamorous side of cyber security services: not just firewalls and endpoint protection, but the boring permissions inside Microsoft 365 that decide who reads which emails. Tightening these up costs nothing and closes a real gap.

The Bottom Line

Shared mailboxes are for teams that need to reply together. Distribution lists are for one-way announcements. Mix them up and you'll keep dropping client emails, confusing your staff, and creating quiet compliance risks.

If your info@ inbox is currently a black hole, or you're not sure who has access to what, it's worth getting someone to look under the bonnet. The MiBOT Support team helps SA professional services firms tidy up their Microsoft 365 setup as part of our managed IT support — usually in less time than you'd expect. If you'd like a hand sorting yours out, book a free consultation and we'll take a look.