Shared Mailbox Rules in Outlook: How Far Rules and Categories Carry a Support Queue

Shared mailbox rules in Outlook are server-side, running with nobody logged in, only when they were built inside that mailbox through Outlook on the web with actions Exchange can carry out on its own. A rule built in classic Outlook that assigns a category, sets a flag or marks a mail as read runs on one person’s computer, and only while their Outlook is open. All the enabled rules together get 256 KB. No more than that.

That is the page in a paragraph. The rest of it is Microsoft’s own documentation on each part of it, pulled on 21 September 2026 with the dates on, so you can go and check the whole of it your own self.

The people writing this work at Maxdesk, which is a help desk, and a help desk is what a desk goes and buys on the day the rules below stop carrying it, so we are not a neutral party here, plainly said. Mind you, a good half of what follows is about making the rules carry further than they do today, on account of most desks reading this being nowhere near the point where they need us. Fair is fair about that.

What a rule on a shared mailbox actually is, and where it lives

A rule is a small record kept inside the mailbox its self, a condition and an action and a name. The thing that decides the rest of it is which machine reads that record when a mail comes in. There are two, and Microsoft describes both in plain enough words on its page about broken rules, funnily enough. Server-side rules use conditions and actions handled by the Exchange server, and those rules run whether or not you log in to Outlook on your computer. Client-side rules have at least one condition or action that uses an Outlook feature, and they do not run until you log into classic Outlook for Windows with the account that you used to create the rule.

Read the second one again with a shared mailbox in mind. A shared mailbox has no person. Its account sits disabled behind it with a password nobody knows, which is by design, so the mailbox its self never logs in anywhere and never will. A client-side rule on it is therefore not a rule that runs sometimes. It is a rule waiting for one specific colleague, the one who made it, to open her laptop. It runs then and only then, on her own machine, against whatever went and arrived since she last had it open.

The other kind, the server kind, is the one you want on a support address, and the reliable way to get one onto a shared mailbox is to be inside that mailbox when you build it. Outlook on the web, your own sign-in, then Open another mailbox, then the shared address, and the rules you make from there belong to the shared mailbox rather than to you. That needs Full Access on the mailbox, which anybody answering from it should have anyway, truth be told. The rules made that way are Exchange inbox rules, the very same thing an admin makes with a line of PowerShell or a call to the Graph API, and they run at half nine on a Sunday with the whole of the team asleep.

We went through what a shared mailbox is and where it stops in the piece on the Outlook shared mailbox, and that page has a paragraph on categories and folders and flags being conventions rather than rules. This page is what sits underneath that paragraph, the machinery of it, and none of the argument gets restated here.

What Microsoft documents about rules, categories and the mailbox they sit in

Every figure in this table came off nine Microsoft pages on 21 September 2026, and the pages are named at the end of it. Two rows do the deciding for a support queue, the third and the fourth. The sections after the table are mostly those two written out at length.

The temptation is to read down to the 256 KB row and reckon the ceiling is size. It is not, for nearly every desk. The ceiling is the fourth row, the one about who has to be sat at a desk for the rule to do anything at all, and most of it from here on is one mail on a Monday morning going and meeting that row.

Why a rule that colours a mail only works while one person is at their desk

Say the four of you share support@ and one of you, the organised one, went and built the triage. In classic Outlook, in Rules and Alerts, a rule that catches anything with invoice or refund in the subject and assigns it to the category Billing, coloured green. Then a second that catches the three biggest customers by address and flags them for follow up. Both rules work, mind you. She tested them on the Tuesday she built them and green mails appeared, and everybody said grand.

Here is what actually happens to a mail at 7:40 on the Monday after. It arrives in the shared mailbox on Exchange, over SMTP like anything else, and Exchange reads the rules it holds for that mailbox and finds nothing it can do. Both rules are marked client-only, which is the label classic Outlook puts on any rule whose action needs Outlook its self. Microsoft’s own list of the actions that do that, on its page about the twenty-people error, starts with Assign it to the category and goes on through flag for follow up, clear the flag, mark as read, permanently delete, print, play a sound, and display a desktop alert. So the mail sits there uncoloured. At 9:12 she opens her laptop, classic Outlook starts, the rules run against what has arrived, and the mail goes green. Anybody who looked in the shared mailbox between 7:40 and 9:12 saw a plain mail. On her day off nothing goes green at all. The following morning the whole of the previous day turns green at once, in a lump, which is the thing that makes people say the rule is flaky when it is nothing of the sort. It is doing exactly what Microsoft says it does, no two ways about it. A rule with a custom action runs only on the computer where it is installed and only when Outlook is running.

There is a quieter version of the same failure waiting in the new Outlook. Microsoft says some rules created in classic Outlook cannot be processed by the new one because they are client-side rules. What you see when the organised one moves over is her rule with a note on it saying it cannot be edited or viewed. The colours stop on the day she switches. Nothing announces it, and the desk notices a week later when somebody asks why the Billing folder went and emptied its self.

The fix is not a different action. It is a different builder. The very same rule, subject contains invoice, assign the category Billing, made in Outlook on the web while you are inside the shared mailbox, is an Exchange inbox rule. Exchange has had a category action of its own for years, the one an admin would spell as ApplyCategory. Made that way it runs at 7:40 with nobody in the building. The same words and the same colour, behaving the opposite way, and the whole of the difference is which window you typed it into.

Where the categories are kept, which is not where anyone would look

The colour green in the story above has to come from somewhere. Where it comes from is the part that catches desks out a good long while after the rules are sorted, and it catches the ones on Office 365 plans from years back the very same as the new ones.

Microsoft’s page on delegates and categories says it in one line. The list of colour categories in a mailbox is stored in a hidden message in the Calendar folder of a mailbox. The calendar, of all places. Not the Inbox, not a setting on the account, a hidden item in the calendar of the mailbox in question, and every mailbox has its own. The PowerShell reference says the same thing from the other side, that the categories you apply with a rule are defined in the mailbox and are not shared between mailboxes. So the Billing you made in the shared mailbox and the Billing in your own mailbox are two records in two calendars that happen to share a name. Give one of them a different colour and nothing complains. Open the mailbox over IMAP from a phone and you see neither of them, since IMAP carries no categories at all, which is the part of it that surprises the person on the road.

Permissions follow the calendar too, funnily enough, and this is why a new person on the desk can see a mail labelled Billing and see it grey. To apply or remove a category on somebody else’s items you need Editor or higher on their Calendar folder. To create a new category or delete one you need Owner on it. To rename one you have to be the mailbox owner, and the owner of a shared mailbox is a disabled account that nobody can sign in as, so in practice renaming is an admin job or it does not happen. A desk that got everybody Full Access on the mailbox will mostly be fine, since Full Access covers the calendar as well. A desk that went and shared the Inbox folder by hand, which happens more than you would think in a small firm, has people who can read every mail and cannot colour one. They can see the whole of it and touch none of it.

Then there is the ordinary human drift, which the parent page covers and this one will not re-run beyond a sentence. Two of the four of you make a category called Waiting and the third makes one called Waiting on customer. By the spring the mailbox’s hidden calendar item holds eleven categories, three of them retired, one of them a typo, and the rule that assigns Billing is still assigning it to the one that was spelt right. That is not a Microsoft limit. It is just what a list does when six hands are in it and no hand is in charge of it, truth be told.

How the 256 KB fills up, and what you are told when it does

Numbers now, and they are smaller than they sound.

Microsoft’s page on the rules quota says inbox rules in Outlook on the web and the desktop apps are limited to 256 KB total for all rules, that there is no maximum number of rules, and that the quota applies only to enabled rules. How much each rule takes is not published as a figure. The page says the actual amount of space a rule uses depends on several factors, such as how long the name is and how many conditions you have applied. Which is Microsoft’s way of saying a rule with a short name and one condition is cheap, and a rule called “Route all invoices and refunds and chargebacks from EU customers to Billing (v3 March)” with 40 addresses in it is not.

So here is the shape of it rather than a sum. A support desk that has been on a shared mailbox for two years and has been diligent about it tends to have somewhere between fifteen and forty rules, most of them small, a few of them large, and the large ones are always the same two kinds. The rule with a long list of customer domains in the From condition, which grows by one line every time sales goes and signs somebody. And the rule with a long list of words in the subject condition, which grows every time somebody thinks of another way a customer says refund. Those two eat the quota. The others hardly touch it. When you reach the limit, in Microsoft’s words, you will be warned that you cannot create any more rules or that you cannot update a rule, and that second warning is the one that lands on a Friday when somebody is adding the forty-first domain and gets told no.

Two things to know before that Friday. You cannot increase the amount of space, Microsoft says so plainly, and an admin can only decrease it, down to 32 KB, for people who should not be building rules at all. And a mailbox that was migrated into Exchange Online may have come across with a quota below 256, in which case the admin can put it back up to 256 and no further. That is the whole of the headroom. Disabled rules cost nothing against it, mind you, so a rule you might want in December is better switched off than gone and deleted.

There is one more ceiling on the client side that has nothing to do with kilobytes and catches the top-accounts rule. A client-only rule that names 20 or more people picked from the address list fails to save. The error says the rules on this computer do not match the rules on Microsoft Exchange and only one set can be kept, which is an alarming thing to read on a Tuesday, and the plain meaning of it is that Outlook could not upload the rule. Microsoft’s workaround is 19 or fewer per rule, or put the people in a distribution group and name the group instead. Nineteen is the number, then. That is how many important customers one classic Outlook rule can know about, and your CRM knows about a good many more than that.

Which rule runs out first, and it is the one that forwards

Of all the rules a desk builds, the forwarding one is the one Microsoft has fenced in from three sides, and none of the three fences is visible from the window you build the rule in. Funnily enough the rule saves fine in every case.

Start with the count. A rule with a redirect or forward action can name 10 recipients, and the Exchange limits page says that if it is configured for more than that the rule cannot be applied at all, so the mail goes to none of them rather than the first ten. A desk that wanted every incoming mail sent on to all twelve people, so they would see it in their own inbox, gets nothing. The rule sits there enabled with no error on it.

Then there is the hop, which is the one nobody has heard of. A message is allowed 1 redirection. Microsoft’s own example is worth the shape of it: User A has a rule that redirects to User B, User B has a rule that forwards to User C, and a message that satisfies both is sent to User B only and is not forwarded to User C. Here is the line that matters. The message is dropped without sending a non-delivery report. So the support mailbox forwards billing questions to the finance mailbox, and finance has a tidy rule of its own that sends anything with invoice in it on to the bookkeeper, and the bookkeeper never gets it and no bounce tells anybody. The chain worked for the first link and went quiet on the second. Exchange tracks the hops with a header called X-MS-Exchange-Inbox-Rules-Loop, and the header survives across organisations, so the second hop is lost even when the bookkeeper is at a different company altogether.

And the newest one, which is the one most desks meet first. Forwarding to an address outside your organisation by rule is governed by the outbound spam policy, and the default there goes by the name of Automatic, System-controlled, which Microsoft’s own page now tells you not to rely on because it means different things for different tenants. In 2021 the value changed to Off for new organisations, and for older ones that were not actively using it. So for most desks set up in the last five years a rule that forwards support mail to somebody’s Gmail, or to a contractor, or to the inbound address of a CRM, comes back to the sender with 5.7.520 Access denied, your organization does not allow external forwarding. Microsoft’s note under the setting is the one to remember. Disabling automatic forwarding disables any inbox rules that redirect messages to external addresses. It just bounces, and the bounce goes to the customer who wrote in, not to you. The admin who turned it off had good reason, mind you, since a rule quietly forwarding customer mail to a personal address is the very thing a GDPR or HIPAA review goes looking for first.

Forwarding between people inside the organisation is not touched by any of that, to be honest with you, and that is the version most desks actually need. Inside, the fences are the 10 and the 1. Outside, it is an admin conversation before it is a rule, and you will meet that conversation again further down, since it is the very same fence that stands between a shared mailbox and us, and between the mailbox and a Teams channel for that matter.

The rules a shared mailbox actually needs, and the order they sit in

After all of that you would think the answer was fewer rules, and it is. It is also a particular four, in a particular order, the lot of them built in Outlook on the web from inside the shared mailbox so they run on Exchange.

The top rule is the noise rule, and it goes first because rules run from top to bottom and this one ends with stop processing more rules. Anything from an address beginning no-reply or noreply, anything from your own monitoring tool, the newsletter the founder signed support@ up for, moves to a folder called Not support and stops there. If that rule sits anywhere but the top, the rule below it colours the newsletter green, on account of it mentioning invoices, and the desk spends the morning un-greening things. Put it first and go and forget it.

Second is the big-accounts rule, which marks importance high and applies a category called Contract, with no stop on it, so the rules below still see the mail. From, the customer domains you have promised something to in writing. Keep the list as domains, not people, so it does not grow by one line per new contact and so the 20-person error never comes near it. Third, the subject rule, invoice or refund or chargeback or receipt, apply the category Billing, no stop. Fourth, the bounce and out-of-office rule, subject begins Automatic reply or Undeliverable, move to a folder called Auto, stop processing. That is the lot. Four rules, three categories at most, and the whole set weighs next to nothing against 256 KB, and none of it needs a person in.

What is deliberately not on the list is a rule that assigns a mail to a person, on account of there being no such action. Exchange can move a mail to a folder called Priya and it can forward a mail to Priya. The first is a folder and the second is a copy, and neither one is an owner. The mailbox has no idea what an owner is. That gap is the reason the page on a shared inbox exists, and it is the gap the rest of this page is walking toward, but it is not a rule you can write your own self, so it does not belong in this section.

When rules and categories are genuinely enough

Fair is fair. For a good many desks the four rules above are the end of the story and the right end.

Two or three of you, thirty or forty mails a day, one time zone, customers who mostly write once and are answered once. The noise rule keeps the inbox honest. The Contract colour tells you who to open first, Billing tells you which ones to hand to whoever does the money, and a category called Waiting that a human sets by hand does the rest of it. The whole of it costs nothing beyond the licences you already hold. It runs at night because it was built in the right window, and it does not care who is off sick. A desk like that does not need a help desk, and we would be telling you a story if we said otherwise.

It stays enough for a good long while. The thing that ends it is not a limit in the table, it is a question, and the question is usually asked by whoever pays the bills, somewhere around month eight. How long did people wait last week. Not how many mails, the folders can be counted, but how long between a customer writing and a person answering, and whether the answer went out inside whatever you told the customer on your website. The mailbox has no clock. A category is a colour and a folder is a place, and neither one knows what time it is. The first time somebody goes and tries to answer that question by hand, from Sent Items, sorting by date and squinting, is the afternoon the four rules stop being enough. Where that line sits is written up under when a shared inbox becomes a ticketing system, and it is not being re-argued here.

What to set up on day one, if the mailbox is yours to fix

Six things, most of them a few minutes each, and every one of them is the difference between a rule that runs and a rule that runs when somebody is in.

1. Open the shared mailbox in Outlook on the web through Open another mailbox, not through your own mailbox, and build every rule from there so it belongs to the shared address and runs on Exchange.
2. In classic Outlook, open Rules and Alerts and look for the words client-only on any rule that touches the shared mailbox. Each one is a rule that only runs while its author is signed in. Rebuild it in the web window and switch the old one off.
3. Put the noise rule at the top of the list with stop processing on it, and check the order again any time somebody adds a rule, since a new rule lands wherever the builder was looking.
4. Agree the category names once, make them in the shared mailbox’s own list rather than in anybody’s personal one, keep it to about 5, and give one named person the job of adding or renaming, because renaming needs the mailbox owner and the owner is a disabled account.
5. Before any rule forwards outside the company, ask your admin what the outbound spam policy says about automatic forwarding, and if the answer is Off, do not build the rule until that changes for the one address you need.
6. Keep every From list as domains rather than people, and keep the whole set well under 256 KB by switching off rather than deleting the rules you are not using, since disabled rules are free.

The second one is the one to do today. A client-only rule on a shared mailbox is the commonest reason a desk says its rules are unreliable, and it is not unreliable at all, it is exact. It runs when she is in, and the rest of the time it does not, and that is the whole of it.

Where the scheme comes apart, which is never at 256 KB

By Friday the mail from Monday has been through everything above and it has a colour on it, it is in the right folder, it was answered, and there are still four things about it nobody can say.

Nobody can say who answered it, beyond opening Sent Items and reading the signature, since a reply from a shared mailbox goes out as the address and the address is everybody. How long it waited is a second mystery, since the mailbox keeps the time it arrived and the time the reply left and holds them in two different folders with nothing joining them. Who set the category to Waiting, or when, or whether the customer has since written back and the category is now wrong, is a third, on account of a category being a label with no history and no clock, and the mail it is on having moved twice. And at the end of the month there is no saying how many of the Contract-coloured mails were answered inside a working day, because there is no report anywhere in a mailbox and never has been, not even a CSV you could go and squint at. The rules did their job, mind you. Sorting was what they were for. What the month-eight questions want is a record, and a mailbox has never kept one, not for anybody.

The honest edge of it sits there. A rule can carry a mail to the right place. It cannot carry an owner, a status the customer’s reply would change, a first response time measured against a promise, or a priority that came from a ticket priority matrix rather than from a colour somebody picked on a Tuesday. Over on Google Workspace the same four questions go unanswered the very same way, with Google Groups in place of the group and its own set of documented ceilings, which we went through under Gmail sending limits.

The thing we make, and what it costs

Maxdesk is the thing we make, and what it holds is the four things the mailbox could not say. The shared mailbox stays where it is. Support@ forwards into a workspace, and each mail that lands there is a ticket with an owner, a status, a priority and a clock on it, and the clock answers to an SLA policy that ships with a 1-hour first-reply target and an 8-hour resolve on it, and you set those to whatever you actually promised. The four rules from earlier become automation rules that run in the workspace rather than in Exchange. They run for everybody, there is no client-only version of them, they can hand a mail to a person rather than to a folder, and they do it at 7:40 on a Monday with nobody in. The reply goes back out under the support address the customer wrote to, which is the one part of the mailbox worth keeping and the one we kept.

The bill is per workspace. A free tier that does not count agents or tickets beyond fair usage, two paid tiers above it, and none of the three cares whether there are three of you or thirty. What the free tier does carry is ads in the workspace, our name on outgoing mail, a 3-month rolling history, and a cap on how many automations can be switched on at once. That last one is the trade to read twice on a page about rules, no two ways about it. A desk with 40 Outlook rules is not going to fit all 40 into a capped free tier and should know that before it starts.

The parts of this we would argue with ourselves

We do not read your Outlook rules. There is no import, nothing that looks at the shared mailbox’s rule list and rebuilds it as automations, and the four rules and the category scheme get typed in again by a person on your side, which for 4 rules is about 20 minutes and for 40 is an afternoon. Nor is there an Outlook add-in, or any two-way sync. Whatever you keep in Outlook stays in Outlook, and if a client-only rule is still colouring things there, it will go on doing so, in its own time, on its own laptop, entirely unaware of us. Fair is fair, that is a gap.

The forwarding fence from earlier stands between your mailbox and us the very same as it stands between your mailbox and an accountant’s Gmail. Getting mail from a shared mailbox into a workspace means the mailbox forwards it to an address of ours, which is external to your organisation, and on a tenant where automatic forwarding is Off that forward bounces 5.7.520 like any other. Your admin has to allow it, for that one address, before a single mail arrives. The same fence stands in front of the other two rooms Microsoft offers, which we set side by side under Microsoft 365 group against the shared mailbox and the Teams channel. We would rather you read that in this paragraph than met it on the setup screen. It is a change of about 10 minutes on their side and a real one, and a desk without an admin it can ask is a desk that should plan for that conversation before it plans for the rest of it.

Then the figures. The nine Microsoft pages behind this one were read on 21 September 2026 and carry dates between June 2018 and August 2026, and the forwarding page in particular was revised the month before we read it, so these lines move. Our own product claims were checked against the live site that afternoon, and a re-check of the whole lot is in the diary for March 2027. Where a number here decides something for you, go to the Microsoft page and read the line your own self first. And if the replies are going out fine and landing in spam, that is a separate problem again, covered under keeping support@ deliverable.

Where to start, if the mailbox already has rules on it

Do not build anything yet, read first.

Open the shared mailbox in Outlook on the web, through Open another mailbox, and go to the rules. What you see there is the list Exchange actually runs, in the order it runs it, and for most desks it is shorter than anybody expected, on account of the rules people remember building having been built in the other window. Then open classic Outlook, Rules and Alerts, and count the ones with client-only against their names. That number is how many of your rules only work when somebody in particular is at work. Write it down. Rebuild the ones that matter in the web window, top rule first. Switch the old ones off rather than deleting them until the new ones have gone and run through a full week including a weekend.

If, after that, the rules run and the colours hold and nobody has asked how long anybody waited, stay where you are and spend the money on something else. Should somebody have asked, that question is the one we sell the answer to, and the free tier is a fair way to find out whether we are right about that before it costs you anything at all.

Common questions about shared mailbox rules and categories in Outlook

Why do my Outlook rules on a shared mailbox only run when I am logged in?
Because they are client-side rules. Microsoft documents that client-side rules do not run until you log into classic Outlook for Windows with the account that created them, and any rule that assigns a category, sets or clears a flag, marks as read, prints, plays a sound or shows an alert is client-side when built in classic Outlook. Rebuild the rule in Outlook on the web from inside the shared mailbox and it becomes a server-side rule that runs whether or not anybody is logged in.

How do I create a rule that runs on a shared mailbox without me?
Sign in to Outlook on the web with your own account, choose Open another mailbox, open the shared address, and create the rule from that mailbox’s settings. Rules made that way are Exchange inbox rules and run on the server. You need Full Access to the shared mailbox to do it.

How many rules can a shared mailbox have?
Microsoft sets no maximum number of rules. The limit is 256 KB of space for all enabled rules together, per mailbox, and it cannot be increased. How much each rule uses depends on the length of its name and the number of conditions. Disabled rules do not count toward the 256 KB.

Why can I not see or apply categories in a shared mailbox?
The list of colour categories is stored in a hidden message in the mailbox’s Calendar folder, so applying a category to shared items needs Editor or higher permission on that mailbox’s Calendar, and creating or deleting one needs Owner. Categories are defined per mailbox and are not shared between mailboxes, so a category from your own mailbox is a different record from one with the same name in the shared mailbox.

Why does my Outlook rule forwarding to an external address not work?
Three documented reasons. Automatic external forwarding is Off by default for Microsoft 365 organisations set up since 2021, and a forwarding rule then bounces with 5.7.520. A rule can forward to at most 10 recipients, and if more are configured the rule is not applied at all. And a message is allowed 1 redirection, so a forward of a forwarded message is dropped without a non-delivery report.

Can an Outlook rule assign an email to a specific person on the team?
No. Exchange inbox rules can move a message to a folder, copy it, forward or redirect it, categorise it, flag importance or mark it read, but there is no action that records an owner. A folder named after a person is a place, not an assignment, and a forward is a copy. Assignment with an owner and a status is what a help desk adds on top of the mailbox.