diff --git a/README.rst b/README.rst
index cff1fd4a..3dec40c0 100644
--- a/README.rst
+++ b/README.rst
@@ -237,6 +237,7 @@ The full set of configuration options are:
         If you are using the `ClientSecret` auth method, you need to grant the ``Mail.ReadWrite`` (application) permission to the app.
         You must also restrict the application's access to a specific mailbox since it allows all mailboxes by default.
         Use the ``New-ApplicationAccessPolicy`` command in the Exchange PowerShell module.
+        If you need to scope the policy to shared mailboxes, you can add them to a mail enabled security group and use that as the group id.
 
         ``New-ApplicationAccessPolicy -AccessRight RestrictAccess -AppId "<CLIENT_ID>" -PolicyScopeGroupId "<MAILBOX>" -Description "Restrict access to dmarc reports mailbox."``
 
diff --git a/docs/index.rst b/docs/index.rst
index f59d9d62..95619827 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -232,6 +232,7 @@ The full set of configuration options are:
         If you are using the `ClientSecret` auth method, you need to grant the ``Mail.ReadWrite`` (application) permission to the app.
         You must also restrict the application's access to a specific mailbox since it allows all mailboxes by default.
         Use the ``New-ApplicationAccessPolicy`` command in the Exchange PowerShell module.
+        If you need to scope the policy to shared mailboxes, you can add them to a mail enabled security group and use that as the group id.
 
         ``New-ApplicationAccessPolicy -AccessRight RestrictAccess -AppId "<CLIENT_ID>" -PolicyScopeGroupId "<MAILBOX>" -Description "Restrict access to dmarc reports mailbox."``
 
diff --git a/parsedmarc/__init__.py b/parsedmarc/__init__.py
index c03794b7..3ecb0c26 100644
--- a/parsedmarc/__init__.py
+++ b/parsedmarc/__init__.py
@@ -230,8 +230,9 @@ def parse_aggregate_report_xml(xml, ip_db_path=None, offline=False,
         xmltodict.parse(xml)["feedback"]
     except Exception as e:
         errors.append("Invalid XML: {0}".format(e.__str__()))
-        tree = etree.parse(BytesIO(xml.encode('utf-8')),
-                           etree.XMLParser(recover=True))
+        tree = etree.parse(
+            BytesIO(xml.encode('utf-8')),
+            etree.XMLParser(recover=True, resolve_entities=False))
         s = etree.tostring(tree)
         xml = '' if s is None else s.decode('utf-8')