Restricting senders to distribution lists using AD and AAD Connect with Office 365

Question

Restricting senders to distribution lists using AD and AAD Connect with Office 365

Darren Brown 1

We are trying to restrict who can send emails to specific distribution lists, this has been completed on a identical distribution list about 2 years ago and we are experiencing the following issues when trying to change the distribution.

When making the changes via the Exchange Admin Centre, we are advised that the DL is managed by on premise active directory and therefore cannot make the changes in O365, this is expected and how we would like to keep it.
When trying to change the attribute of the DL in AD dLMemSubbmitPerms, the error tells us that there is no editor registered to amend the attribute. However the change can be made on another DL.

We have an identical DL that was setup 2 years ago, both are Universal Distribution groups and other than the above attribute nothing is different.

Has anyone been able to make this change without making removing it from the synch process and making it available in O365 only for editing?

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2021-03-22T18:38:42.17+00:00

If you are using DirSync, you can use these attributes to restrict who can send to DLs:

· AuthOrig (Authorized Originators: Only these Users can send to the DL)

· UnauthOrig (Unauthorized Originators: Anyone BUT these users can send to the DL)

· dLMemRejectPerms (Unauthorized DLs: Anyone but members of these DLs can send to this DL)

· dLMemSubmitPerms (Authorized DLs: No one but members of these DLs can send to this DL)

· msExchRequireAuthToSendTo (Only Authenticated Senders can send to the DL, blocks External senderS)

Are you able to provide a screenshot or verbatim of the error you receive when you try to make the change?
Klaus Krönert 31 Reputation points

2023-06-05T11:13:43.23+00:00

Please let us know, what tool i required to make the changes on Local AD, but ADS will send a Error, that "Tool required" to edit the fields.
Jesse 5 Reputation points

2023-10-03T05:24:44.18+00:00

@Klaus Krönert You can use PowerShell to make the required changes to these attributes.

You need to get the DN of the DL you want to modify the attributes on. Then use that information to run the command below.

For example, to allow specific groups to email specific distribution lists.

Set-ADObject "CN=yourDL,DC=contoso,DC=com" -Add @{dLMemSubmitPerms="CN=allowedgroup,DC=contoso,DC=com"}

For allowing specific people to email specific distribution lists

Set-ADObject "CN=yourDL,DC=contoso,DC=com" -Add @{authOrig="CN=alloweduser,DC=contoso,DC=com"}

Once you add a value to either of these attributes via PowerShell, I found that I could then add and remove values through the Active Directory Users and Computers GUI as well.

Your answer

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2021-03-22T18:38:42.17+00:00

If you are using DirSync, you can use these attributes to restrict who can send to DLs:

· AuthOrig (Authorized Originators: Only these Users can send to the DL)

· UnauthOrig (Unauthorized Originators: Anyone BUT these users can send to the DL)

· dLMemRejectPerms (Unauthorized DLs: Anyone but members of these DLs can send to this DL)

· dLMemSubmitPerms (Authorized DLs: No one but members of these DLs can send to this DL)

· msExchRequireAuthToSendTo (Only Authenticated Senders can send to the DL, blocks External senderS)

Are you able to provide a screenshot or verbatim of the error you receive when you try to make the change?
Klaus Krönert 31 Reputation points

2023-06-05T11:13:43.23+00:00

Please let us know, what tool i required to make the changes on Local AD, but ADS will send a Error, that "Tool required" to edit the fields.
Jesse 5 Reputation points

2023-10-03T05:24:44.18+00:00

@Klaus Krönert You can use PowerShell to make the required changes to these attributes.

You need to get the DN of the DL you want to modify the attributes on. Then use that information to run the command below.

For example, to allow specific groups to email specific distribution lists.

Set-ADObject "CN=yourDL,DC=contoso,DC=com" -Add @{dLMemSubmitPerms="CN=allowedgroup,DC=contoso,DC=com"}

For allowing specific people to email specific distribution lists

Set-ADObject "CN=yourDL,DC=contoso,DC=com" -Add @{authOrig="CN=alloweduser,DC=contoso,DC=com"}

Once you add a value to either of these attributes via PowerShell, I found that I could then add and remove values through the Active Directory Users and Computers GUI as well.

Share via

Restricting senders to distribution lists using AD and AAD Connect with Office 365

Your answer