Hide from GAL - not synchronizing

Question

Hi there,

We have Azure AD synchronization enabled and users in office365 are sourcing from on-prem AD. Schema is extended and "msExchHideFromAddressLists" attribute is accessible from AD. however the settings are not synchronizing with AzureAD and Office365, e.g. setting this attribute to "True", force AADsync, I can't see that attribute being updated (the changes are not even captured when looking at Connector operations logs in Azure AD sync server) and emails are appearing in GAL. Could you please help.

Answer 1

Hi Jason,

no win. I created two new users and still no win with hiding from GAL.

do we need to change Inbound and outbound rules to match on-premises attributes with AzureAD attributes at all?

Answer 2

Hi ElhamKarshenas,

Thanks for the information, it seems all the settings are correct.

To help us further troubleshoot the issue, could you please try add a new account in local AD and enable the HideFromAddressList to see the result?

Best Regards,

Jason Jiang

Answer 3

screen shots:

1. change "hidefromaddresslist" attribute in on-premises ad: 
2. delta import (local ad):


3. delta import: azure ad - no changes
4. delta synchronization: local ad

inbound connector


outbound connector


5. export and the rest of profiles does not show any changes (all 0 in export statistics)
6. user still visible in gal

Answer 4

Hi Ran,

"Please note kindly note that syncing Exchange related attributes without on-premises Exchange servers installed is not officially supported as many potential issues could occur in this situation. That’s why we always recommend customers keep at least one Exchange on-premises server in local AD."

this is a bit scary and disappointing.  Could you please provide me with the references on what you mentioned above? anywhere in Microsoft tech articles I found they've been talking about extending schema not necessarily installing Exchange! please see these "Microsoft" articles for "hiding users from GAL when having Azure AD Directory synchronization", you will get the answer "extend the schema" even if you don't have any Exchange server on-prem installed:

community.office365.com/.../189366

community.office365.com/.../64662

to answer your question:

1. I will upload the images shortly.
2. No we don't have exchange server on-prem and we don't want to have any. referring to those articles above from Microsoft, we had to extend the schema to be able to hide users from GAL. because there seems to be no way for us to do so.

Answer 5

Hi Elham,

To troubleshoot this issue, I would like to confirm some information below:

1. Can you share the detailed information with screenshots in connector operation logs here for further investigation? To upload images, please click Use rich formatting and then select the Insert/Edit Media button.

2. Regarding “Schema is extended”, do you mean you have an Exchange server on-premises which makes the “msExchHideFromAddressLists” available or you don’t have Exchange servers but have extend AD Schema with Exchange attributes?

Please note kindly note that syncing Exchange related attributes without on-premises Exchange servers installed is not officially supported as many potential issues could occur in this situation. That’s why we always recommend customers keep at least one Exchange on-premises server in local AD.

Thanks for your time.

Best regards,

Ran