autodiscover causing onprem mailbox to appear in Outlook even after permissions have been removed in hybrid Exchange 2016/365 environment

Question

autodiscover causing onprem mailbox to appear in Outlook even after permissions have been removed in hybrid Exchange 2016/365 environment

SB Admin 46

I have an issue where for certain onprem mailboxes, even after a user (whose mailbox is on Exchange Online) has had their access removed, the mailbox still appears in Outlook (new profiles and different computers don't help). When looking at the msExchDelegateListLink attribute for the onprem mailbox, I see that the user is no longer listed however when running Outlook's test e-mail autoconfiguration, the autodiscover service still returns that mailbox in the <alternativeMailbox> section which seems to be the issue. Looking at the Sychronization Service Manager shows the correct information for the msExchDelegateListLink however I noticed another attribute called cloudMSExchDelegateListLink (which does not exist in our AD and I can't find documentation online about it) that still lists the old user. I've tried re-adding the user, synching to Azure AD then removing the user however that hasn't helped. I've also removed the mailbox from syncing so that it no longer shows up as a contact in Exchange Online then synching it again but the problem still persists. Our onprem environment is Exchange 2016 with CU22 and the Azure AD connect service is 2.1.1.0. Any potential solutions for this issue? Thanks.

-Lance

Accepted answer

5 additional answers

Your answer

Answer 1

We had this issue, and have managed to fix it like this:

1 - Add the user who previously had permissions to the mailbox to the msExchDelegateListLink attribute on the on-premises shared mailbox manually using Set-ADUser (based on this support article, Scenario 2)

Set-ADUser -Identity "distinguishedName of on-premises shared mailbox" -Add @{msExchDelegateListLink="<distinguishedName of user where mailbox is still appearing"}

2 - Perform an Azure AD Connect sync

3 - Wait 15-20 minutes for the change to replicate from Azure AD to Exchange Online

4 - Remove the user from msExchDelegateListLink once more

Set-ADUser -Identity "distinguishedName of on-premises shared mailbox" -Remove @{msExchDelegateListLink="<distinguishedName of user where mailbox is still appearing"}

5 - Perform an Azure AD Connect Sync

It seems that according to the support article above, on-premises Exchange does not set or remove msExchDelegateListLink when adding/removing permissions for in-cloud mailboxes, so you have to do it manually, instead of the usual fix of adding & removing the permissions. I found that after an third Azure AD Connect sync beyond those above, the user's entry in the cloudMSExchDelegateListLink attribute was cleared as required, the user's AutoDiscover XML no longer returned the mailbox, and the extra mailbox disappeared from the user's Outlook.

SB Admin 46 Reputation points

2023-06-29T19:34:59.3866667+00:00

Thank you very much as that worked for one of my team members during test.

Answer 2

Hi @SB Admin

I would like to confirm: do you mean automapping still works, the mailbox still show in the outlook of the user who used to have full access permission for it? And are you able to access the mailbox after removing the permission?

If that's the case, the scenario is just like the discussion in this link: Mailbox still visible in Outlook after removing permission
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

We will still need to remove the automapping for the mailbox to resolve this issue:

Add-MailboxPermission -Identity "******@exoip.com" -User "******@exoip.com" -AccessRights FullAccess -AutoMapping $false  
Remove-MailboxPermission -Identity "******@exoip.com" -User "******@exoip.com" -AccessRights FullAccess

After you performing the steps above, wait up to an hour for it to take effect

And if I have any misunderstanding about your question, please correct me.

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

SB Admin 46

Thanks for the information, I tried the steops but unfortunately that did not resolve the issue. When looking at the shared mailbox onprem, I don't see the user listed when looking at the msExchDelegateListLink attribute and the user is not listed when running Get-MailboxPermission -Identity sharedmailbox. The user cannot open the mailbox however when doing "Test E-mail AutoConfiguration", the XML tab still lists the shared mailbox under the AlternativeMailbox tag. The only clue I have is that the user is still listed when viewing the cloudMSExchDelegateListLink attribute that I can only seem to view when looking at the Metaverse Object Properties for the shared mailbox under the Synchronization Service Manager. Let me know if there is something else that I can try. In addition, is there any way to directly modify the cloudMSExchDelegateListLink attribute in Azure AD? Thanks.

-Lance

Joyce Shen - MSFT 16,701 Reputation points

2022-06-09T06:14:50.117+00:00
Hi,

According to my research, I found the description about this attribute cloudMSExchDelegateListLink in this link, you may need to translate this article to English.
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Check if the ACLableSyncedObjectEnabled is enabled in your Organization Config

Set-OrganizationConfig -ACLableSyncedObjectEnabled $true

And I also see that the msExchDelegateListLink attribute is list in Attributes to synchronize

You could also take a look at the steps here: Removing Orphaned Populated msExchangeDelegateLinkList and msExchangeDelegateLinkListBL Automapping Attributes, check the msexchDelegateLinkListBL attribute as well.
SB Admin 46 Reputation points

2022-06-09T22:09:20.217+00:00

ACLableSyncedObjectEnabled is already enabled in our Organization Config. I see msExchDelegateListLink listed as an attribute to sync and when I remove the user's full access to the onprem mailbox, I see the changes reflected when looking at the details in Synchronization Service Manager however the problem still persists. Is there any powershell command I can run against the onprem mailbox object in Azure AD (which appears as contact since the mailbox is still onprem) to double check the values in the msExchDelegateListLink attribute? Regarding msexchDelegateLinkListBL I don't see that attribute when looking at the object in our onprem AD using adsiedit.
Joyce Shen - MSFT 16,701 Reputation points

2022-06-14T06:31:32.903+00:00

Hi,

Have you checked if any error or information recorded in AAD connect for this attribute synchoronization?
SB Admin 46 Reputation points

2022-06-21T20:59:17.263+00:00

Many of the shared mailboxes that were previously having issues with the automapping are now functioning normally without any changes being made however we still have an issue with at least one mailbox. For the problematic mailbox, there aren't any sync errors and I see the correct entries for the msExchDelegateListLink when looking at the Metaverse Object Properties however there is still the discrepancy between the msExchDelegateListLink and the CloudMSExchDelegateListLink (which retains obsolete entries).

Answer 4

Kossert, Jörn 1

I can confirm the behavior. We have exactly the same behavior at one of our customers. Autodiscover returns the mailbox as an alternate mailbox for a mailbox even though the user no longer has access to that mailbox.
msexchDelegateLinkList and msexchDelegateLinkListBL are clean but in cloudMSExchDelegateListLink the incorrect mailbox is still there.

Answer 5

SB Admin 46

Any other ideas since we still see some objects were the cloudMSExchDelegateListLink is holding outdated values (no sync errors and other attributes sync just fine) which is causing automapping issues?

-Lance

Share via

autodiscover causing onprem mailbox to appear in Outlook even after permissions have been removed in hybrid Exchange 2016/365 environment

5 additional answers

Your answer