msexchhidefromaddresslist attribute missing

Question

Environment is having 2 on premise AD. One AADconnect server. Then Azure AD and Office 365. We do not have exchange on premise. But all the users are still created in on premise. So terminated or disabled users in AD is still showing up in exchange online address list. As we do not have msexchhidefromaddresslist and mailnickname attributes present in AD, we cannot hide those disabled users from address list.

Custom rule created in AADconnect to sync from custom attribute to hidefromaddresslist in Azure AD. Still does not work.

Name: Hide user from GAL Description: If msDS-CloudExtensionAttribute1 attribute is set to HideFromGAL, hide from Exchange Online GAL Connected System: Your Active Directory Domain Name Connected System Object Type: user Metaverse Object Type: person Link Type: Join Precedence: 50

Click Next > on Scoping filter and Join rules, those can remain blank

Enter the following Transformation page, click the Add transformation button, fill out the form with the values below, and then click Add FlowType: Expression Target Attribute: msExchHideFromAddressLists Source:

IIF(IsPresent([msDS-cloudExtensionAttribute1]),IIF([msDS-cloudExtensionAttribute1]="HideFromGAL",True,False),NULL)

Now perform an initial sync

Start-ADSyncSyncCycle -PolicyType Initial

Hide the user from AD by setting the attribute

Select the Attributes Editor tab, find msDS-cloudExtensionAttribute1, and enter the value HideFromGAL  (Note: The valude must be exactly the same as defined in the AD Connect Rule, case sensitive), click OK and OK to close out of the editor. 

Continue with a AD Connect DELTA Sync:

Start-ADSyncSycnCycle -PolicyType Delta

Still it does not sync and this msDS-cloudExtensionAttribute1 is a sync enabled attribute.

I would like to know any other method is there.

I think the next option is to run prepareschema and preparead using exchange server setup. I do not know which exchange version set up to download and run, also if we want to remove those attribute in future, how do I do that?

Answer 1

Hi @MasTer,

Thank you for posting your question in the Microsoft Q&A forum.

Based on your description, your question is how to synchronize information about disabled or departed users to Azure AD by configuring AD Connect to hide these users in the GAL of Exchange Online.

In your Active Directory (AD) environment, only the default properties from the AD installation currently exist and do not yet contain Exchange-related properties, so it is normal to not be able to find specific Exchange parameters.

In fact, it is possible to add the required Exchange attributes without installing an Exchange server, but by performing a schema extension. It is important to note that the schema extension itself is safe, but it must be performed by an administrator with appropriate privileges. It is important to note that once the schema extension has been completed, it cannot be fully rolled back, however, you can choose to stop using the newly added attributes at a later date.

To resolve this issue, you will need to run PrepareSchema and PrepareAD, and once you have done so, your AD environment will have the appropriate Exchange properties (see below). Detailed information on preparing AD and domains can be found in the documentation: Prepare Active Directory and domains for Exchange Server, Active Directory Exchange Server, Exchange Server Active Directory. Exchange 2019 Active Directory | Microsoft Learn

After you have successfully added the attributes, you can set them with the help of the ADSI editing tool, or by using PowerShell commands. Subsequently, synchronize these settings to Azure AD via the AD Connect tool, thus achieving the goal of hiding users in the address list.

If the answer is helpful, please click on “Accept answer” as it could help other members of the Microsoft Q&A community who have similar questions and are looking for solutions.

Thank you for your support and understanding.