Migrating a shared mailbox to a distribution group, or back

The request arrives as "can you just convert it?" — a shared mailbox that nobody opens any more and that should simply fan out to five people, or a distribution list where the team now wants to see what has been replied to. Exchange Online has a convert button for user-to-shared and shared-to-user. It has nothing between a mailbox and a distribution group, because they are different kinds of object: one stores mail, the other routes it. The migration is a controlled swap of the address, and the whole job is making sure the address is never in two places or in no place.

If you have not read shared mailboxes explained and distribution lists vs Microsoft 365 groups, the choice below will make more sense with them.

First, check whether either is the right answer

Both directions have a third option. A Microsoft 365 group gives you a shared inbox and fan-out delivery (members can subscribe to receive copies in their own inbox), plus a SharePoint site and a Teams option nobody has to use. If the reason for the change is "we want both to see history and get it in our inboxes", stop and consider the group instead; there is a supported one-click upgrade from a distribution list to a Microsoft 365 group, and no upgrade path from a shared mailbox — which is itself a reason to think about it before the swap.

Reasons a group is not the answer: the address must send as a plain mailbox with delegates (shared mailbox), the members are external or nested groups (distribution list), or compliance requirements rule out the SharePoint site.

Shared mailbox to distribution group

The address support@contoso.com currently belongs to the mailbox. You want it to deliver to a group of people.

1. Inventory what depends on the mailbox. Send As and Send on Behalf permissions (Get-RecipientPermission, Get-Mailbox | Select GrantSendOnBehalfTo), Full Access users, inbox rules that forward or auto-reply, any Power Automate flow polling it, any device or application using it via SMTP or IMAP, and calendar bookings if it has any. A distribution group has none of these, so every one is a decision.

2. Preserve the history. Options in ascending effort: keep the mailbox under a new address indefinitely (simplest, costs nothing if it stays under 50 GB and unlicensed); export to PST via eDiscovery or Outlook; or apply a retention policy and let an inactive mailbox hold it. Do not delete the mailbox until this is done; a deleted shared mailbox is recoverable for 30 days and then gone.

3. Rename the mailbox's addresses. Change the primary SMTP to something like support-archive@contoso.com and remove support@contoso.com from its proxy addresses:

   Set-Mailbox support -EmailAddresses @{remove="support@contoso.com"} -WindowsEmailAddress support-archive@contoso.com
   

   The Set-Mailbox cmdlet accepts the hash-table syntax for adding and removing individual proxy addresses; check the current list with Get-Mailbox support | Select-Object -ExpandProperty EmailAddresses before and after.

4. Create the distribution group with the freed address as its primary SMTP, add members, set who may send to it (external senders are blocked by default on a new distribution group — decide deliberately), and set an owner.

5. Test with a message from outside and from inside. Then re-point the flows, devices and mail-enabled things from step 1.

Between steps 3 and 4 there is a gap of however many seconds it takes you to run two commands, during which mail to the address bounces. Script both together and the gap is under a minute; or create the group first with a temporary address and swap addresses in one script run. Directory propagation in Exchange Online is generally quick, but allow a few minutes before the test.

Mail that was in the mailbox stays there. Mail that arrives after the swap goes to members' inboxes and is stored nowhere central — which is the property people asked for, and the one they will complain about in three months. Say so now.

Distribution group to shared mailbox

The reverse: sales@contoso.com fans out to eight people and they want a shared inbox with a single view.

1. Inventory the group: members, owners, whether external senders are allowed, moderation, any nesting in other groups, and whether it is used as a security principal anywhere (mail-enabled security groups sometimes are). A shared mailbox cannot be a member of another group in the way a DL can, and it cannot carry nested membership.
2. Create the shared mailbox with a temporary address. Grant Full Access and Send As to the former members (Add-MailboxPermission, Add-RecipientPermission). Enable automapping or not depending on whether you want it to appear in Outlook automatically. Consider message copy settings so sent items land in the shared mailbox's Sent Items rather than the sender's.
3. Swap the address: remove it from the group (or delete the group), then set it as the shared mailbox's primary. If the group must remain for other reasons, rename it.
4. Decide on fan-out. Members used to get mail in their own inboxes. If some still want that, the shared mailbox can forward with DeliverToMailboxAndForward to a new distribution group of those people — but be honest that this recreates the mess you were removing. The cleaner answer is Outlook's shared-folder notifications or a Teams channel email address.
5. Test from external and internal senders; external senders that were previously blocked at the group will now reach the mailbox, which is usually the point.

No history exists on the group side to preserve, since a distribution group stores nothing. Members' own inboxes hold whatever they received.

Things that go wrong

• Address caching. Outlook's autocomplete and offline address book cache the old object's LegacyExchangeDN. After a swap, internal senders can get IMCEAEX bounces when replying to old messages. Fix by adding the old object's LegacyExchangeDN as an X500: proxy address on the new object — copy it from the old object before you change anything.
• The address is a UPN. If support@contoso.com was also someone's sign-in name, the mailbox cannot simply lose it. Check Get-Recipient and the user's UPN first.
• Licensing. A shared mailbox is free under 50 GB with no archive or hold. Add litigation hold or an archive and it needs an Exchange Online Plan licence. A distribution group never needs one.
• Hybrid. If the object is synced from on-prem AD, every change happens on-prem and syncs up; cloud-side edits are blocked. The swap is the same, one directory to the left.

What needs support or downtime

Nothing needs Microsoft support. Downtime is the address swap window — seconds if scripted, a few minutes if done by hand — and the risk is not lost mail but bounced mail, which senders will retry only if their systems do. Do it outside the hours the address is busiest, with the two commands ready in one script.