Share via

Mail enabled Security Group members dont receive e-mails

Michail 26 Reputation points
2022-12-05T14:10:27.627+00:00

Hi,

So our company recently migrated to Azure. We have a Hybrid AD setup. We use security groups so that members can access certain network folders via SMB. This all works. We also would like to use these security groups as a distribution group for e-mails so in Users & Computers I added an e-mail address and synced this with azure. In Azure it shows that the security group is "mail enabled" however, none of the members of the group is receiving an e-mail when in their personal mailbox when I send an e-mail to the security group. I expected the group to act like Google groups where if you send an e-mail to the group that every member is receiving a copy. Am I doing something wrong. We are still getting used to Azure and Outlook.

Edit:
It seems like only e-mails from internal addresses are not received by the group members. When I send an email from for example a Gmail account, everyone does receive it.

Thanks in advance!

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Michail 26 Reputation points
    2022-12-07T12:14:09.237+00:00

    So in the end I went through all solutions provided here and on the internet and couldn't make it work. I remade the groups in exchange online as a cloud group and now they work. This solution is good enough since we are planning to go full cloud in the near future.

    1 person found this answer helpful.
  2. Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
    2022-12-05T15:19:48.277+00:00

    Mail-Enable the groups on-prem using the Exchange mgmt tools then sync again
    https://learn.microsoft.com/en-us/powershell/module/exchange/enable-distributiongroup?view=exchange-ps

  3. Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
    2022-12-06T14:05:33.347+00:00

    Ok, If you are syncing with AADConnect its required that you have at least one Exchange Server on-prem for mgmt to be supported. Unless you are at the latest Exch 2019 CU and can follow these steps:
    https://learn.microsoft.com/en-us/exchange/decommission-on-premises-exchange

    If that is not possible, then you would need to update the attributes of these groups on-prem using ADUC or ADSIEDIT for example and add all the necessary data.
    Can you look at another on-prem mail-enabled security group on-prem that is working and note the Exchange attributes that are set and update the security groups that arent working to match?

    Examples:
    https://learn.microsoft.com/en-us/exchange/troubleshoot/groups-and-distribution-lists/mail-enabled-groups-not-synchronized

    https://medium.com/gitbit/office-365-ad-connect-manage-groups-afe539ca017f

  4. Jiri Hrabovsky 0 Reputation points
    2025-06-19T12:20:25.3133333+00:00

    Hi, we have similar experience with mail enabled security (and distribution) groups in Exchange online. Some members can receive the mail sent to the group (internal users/members, contacts and some guests), while others don't (other guests).

    I have identified that these other guests were created this way:

    • A contact has been created in Exchange online.
    • Then, because of access rights in SharePoint or Teams, an invited guest account has been created in Entra ID with the same email address.
    • Next, a mail enabled security group (or distribution group) has been created with the guest as a member. Or guest has been added to an existing one.
    • However, mail sent to this group has not been delivered to the guest. While other members have received the mail. Access rights assigned to the group worked fine.

    Root cause: the guest account, which has been created while a contact exists, is corrupted - the attribute PrimarySmtpAddress is blank.

    Solution: Delete the Contact and add the PrimarySmtpAddress.

    Connect-ExchangeOnline

    Set-MailUser -Identity prefix_suffix.com#EXT#@YourTenantName.onmicrosoft.com -PrimarySmtpAddress ******@suffix.com

    Yes, as an alternative, you can delete both contact and corrupted guest account, also from deleted users in Entra ID, and create/invite a fresh guest account.

    Repaired or fresh guest accounts can now receive mails as members of mail-enabled security groups.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.