Office 365 - msExchHideFromAddressLists does not synchronize with Office 365

By Przemyslaw Klys Azure AD Office 365 PowerShell March 24, 2020

In my life I've deployed multiple Office 365 tenants connected with Active Directory and I've been synchronizing msExchHideFromAddressLists field from Active Directory to HiddenFromAddressListsEnabled in Azure AD without any issues. Recently I was notified that msExchHideFromAddressLists is not getting properly synchronized and surely enough the issue was that Exchange hybrid deployment was not checked.

So you tick the checkbox do Initial sync and you're done.

Start-ADSyncSyncCycle -PolicyType Initial

Except that it doesn't work.

get-mailbox -Identity 'bartosz.klys@evotec.ooo' | Format-List *HiddenFromAddressListsEnabled*

Command above would still show FALSE for HiddenFromAddressListsEnabled. Quick check AD side and msExchangeHideFromAddressLists is Enabled.

Get-ADUser -filter { userprincipalname -eq 'bartosz.klys@evotec.ooo' } -Properties msExchHideFromAddressLists

So what to do?

How to make sure HiddenFromAddressListsEnabled works as expected?

To make sure hidding mailboxes from Global Address List (GAL) works correctly you should verify few things

Active Directory has Exchange Extended Schema – this can be done by downloading Exchange 2016 CU15 or similar and executing Setup.exe /IAcceptExchangeServerLicenseTerms /PrepareSchema command

Exchange hybrid deployment is selected in Azure AD Connect

Run Initial Synchronization after any change of configuration

Start-ADSyncSyncCycle -PolicyType Initial

Update msExchHideFromAddressLists for each user that you want to hide from GAL (set TRUE as value)
Refresh directory schema with any change to AD Schema

All the steps above I've done and shown that it's not working. The final and often omitted step is what also needs to be set for each user

Update mailNickName attribute to proper, non-empty value

Not so obvious right? Of course, if you have local Exchange, it would be done automatically, but most small Clients don't have resources to run an additional machine. While it's technically not a supported scenario, it's how most SMB Clients are working. Now we just need to fix all our users that have Mail field set, and are missing MailNickName.

$WhatIf = $true
$Forest = Get-ADForest
foreach ($Domain in $Forest.Domains) {
    $Users = Get-ADUser -Filter { Mail -like '*' -and MailNickName -notlike '*' } -Properties mailNickName, mail,msExchHideFromAddressLists -Server $Domain
    $Users | Format-Table -AutoSize Name, SamAccountName, DisplayName, Mail,mailNickName, Enabled, msExchHideFromAddressLists,DistinguishedName
    foreach ($_ in $Users) {
        Set-ADUser -Identity $_ -Replace @{mailNickname = $_.SamAccountName } -Server $Domain -WhatIf:$WhatIf
    }
}

Przemyslaw Klys / About Author

System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.

Office 365 – msExchHideFromAddressLists does not synchronize with Office 365

Related Posts