Corporate setting, multiple people have access to the same email account (it is a functional not a personal account). Order of events:

  1. User A opens Outlook, connects to the shared email account, Outlook stays open
  2. User B opens Outlook, connects to the shared email account, and changes the password of the email account
  3. An email gets sent to the email account
  4. User A can see the email in the inbox

Testing showed that if user A terminates Outlook and restarts they indeed can't reconnect to the account without the new password as one would expect.

But it seems that if user A just keeps their Outlook open they can continue to receive and presumably also send emails from the account without the new password. So if the change in password was made to exclude user A from the account user A also needs to restart their Outlook or computer to make the exclusion effective. Is that indeed how Outlook works or is supposed to work? Security-wise this looks like a big flaw to me.

  • 1
    Changing passwords is not supposed to kick off other sessions. Kicking off other sessions is a separate step.
    – schroeder
    Commented Jun 8, 2023 at 8:53

1 Answer 1


That is not only how Outlook of designed to work, but how most authentication schemes are designed to work. Authenticating at some time is valid for as long as your session exists. Changing a password does not inherently invalidate existing sessions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .