Manage mail users in standalone EOP

In standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, mail users are the fundamental type of user account. A mail user has account credentials in your standalone EOP organization, and can access resources (have permissions assigned). A mail user's email address is external (for example, in your on-premises email environment).

Note

When you create a mail user, the corresponding user account is available in the Microsoft 365 admin center. When you create a user account in the Microsoft 365 admin center, you can't use that account to create a mail user.

The recommended method to create and manage mail users in standalone EOP is to use directory synchronization as described in the Use directory synchronization to manage mail users section later in this article.

For standalone EOP organizations with a small number of users, you can add and manage mail users in the Exchange admin center (EAC) or in standalone EOP PowerShell as described in this article.

What do you need to know before you begin?

• To open the Exchange admin center (EAC), see Exchange admin center in standalone EOP.

• To connect to standalone EOP PowerShell, see Connect to Exchange Online Protection PowerShell.

• When you create mail users in EOP PowerShell, you might encounter throttling. Also, the EOP PowerShell cmdlets use a batch processing method that results in a propagation delay of a few minutes before the results of the commands are visible.

• You need to be assigned permissions in Exchange Online Protection before you can do the procedures in this article. Specifically, you need the Mail Recipient Creation (create) and Mail Recipients (modify) roles, which are assigned to the Organization Management (global admins) and Recipient Management role groups by default. For more information, see Permissions in standalone EOP and Use the EAC modify the list of members in role groups.

• For information about keyboard shortcuts that may apply to the procedures in this article, see Keyboard shortcuts for the Exchange admin center in Exchange Online.

Tip

Having problems? Ask for help in the Exchange forums. Visit the Exchange Online Protection forum.

Use the Exchange admin center to manage mail users

Use the EAC to create mail users

1. In the EAC at https://admin.exchange.microsoft.com, go to Recipients > Contacts. Or to go directly to the Contacts page, use https://admin.exchange.microsoft.com/#/contacts.

2. On the Contacts page, click Add a mail user. The new mail user wizard opens.

3. On the Basic information page, configure the following settings. Settings marked with an ^* are required.

   • First name
   • Last name
   • Initials: The person's middle initial.
   • Display name^*
   • External email address: Enter the user's email address. The domain should be external to your cloud-based organization.
   • Alias^*
   • User ID^* and Domain^*: Enter the account that the person will use to sign in to the service.
   • Password^* and Confirm password^*: Enter and reenter the account password. Verify that the password complies with the password length, complexity, and history requirements of your organization

   When you're finished, click Next.

4. On the Review mail user page, review the details. Click Back to make changes.

   When you're finished, click Create.

Use the EAC to modify mail users

1. In the EAC at https://admin.exchange.microsoft.com, go to Recipients > Contacts. Or to go directly to the Contacts page, use https://admin.exchange.microsoft.com/#/contacts.

2. On the Contacts page, find the mail user that you want to modify (the Contact type value is MailUser). You can use the Search or Filter to help you find the mail user.

3. To select the mail user, click the Display name value (don't select the checkbox).

4. In the details flyout that opens, select one of the following tags to view or change properties.

5. On the mail user properties page that opens, click one of the following tabs to view or change properties:

   • General tab:

     • General information section: Click Manage general information to change the following properties:

       • First name

       • Last name

       • Display name: This name appears in your organization's address book, on the To: and From: lines in email, and in the list of contacts in the EAC. This name can't contain empty spaces before or after the display name.

       • initials

         When you're finished, click Save.

     • Hide from global address list (GAL) section: Click Manage hide from GAL to show (Off) or hide (On) the mail user in the GAL.

       When you're finished, click Save.

     • MailTip section: Click Manage MailTip. In the flyout that opens, enter the text in the MailTip text box.

       When you're finished, click Save.

   • Contact tab:

     • Contact information section: Click Contact information to change the following properties:

       • Web site
       • Fax phone
       • Home phone
       • Mobile phone
       • Work phone
       • Office
       • Street
       • City
       • State/Province
       • ZIP/Postal code
       • Country/Region
       • Notes

       When you're finished, click Save.

     • Organization information section: Click Edit organization to change the following properties:

       • Title
       • Department
       • Company
       • Manager

       When you're finished, click Save.

   • Others tab:

     • Custom attributes section: Click Manage custom attributes to add text values to the Custom 1 through Custom 15 attributes.

       When you're finished, click Save.

     • Member of (group membership) section: Click Manage member of to remove the mail user from existing groups.

     • Email addresses section: Click Manage email address types to manage the proxy addresses for the mail user.

     • Message delivery restrictions section: Click Manage message delivery restrictions to change the following properties:

       • Accept messages from section:
         • Select All senders or Selected senders
         • Require senders to be authenticated
       • Block messages from section: Select None or Selected senders.

       When you're finished, click Save.

Use the EAC to remove mail users

1. In the EAC at https://admin.exchange.microsoft.com, go to Recipients > Contacts. Or to go directly to the Contacts page, use https://admin.exchange.microsoft.com/#/contacts.

2. On the Contacts page, find the mail user that you want to remove (the Contact type value is MailUser). You can use the Search or Filter to help you find the mail user.

3. Do one of the following steps to delete the mail user:

   • Select the mail user from the list by selecting the check box, and then click Delete.
   • Select the mail user from the list by clicking on the Display name (not the check box). In the details flyout that appears, click Delete contact.

Use PowerShell to manage mail users

Use standalone EOP PowerShell to view mail users

To return a summary list of all mail users in standalone EOP PowerShell, run the following command:

Get-Recipient -RecipientType MailUser -ResultSize unlimited

To view detailed information about a specific mail user, replace <MailUserIdentity> with the name, alias, or account name of the mail user, and run the following commands:

Get-Recipient -Identity <MailUserIdentity> | Format-List

Get-User -Identity <MailUserIdentity> | Format-List

For detailed syntax and parameter information, see Get-Recipient and Get-User.

Use standalone EOP PowerShell to create mail users

To create mail users in standalone EOP PowerShell, use the following syntax:

New-MailUser -Name "<UniqueName>" -MicrosoftOnlineServicesID <Account> -Password (Get-Credential).password [-Alias <AliasValue>] [-DisplayName "<Display Name>"] [-ExternalEmailAddress <ExternalEmailAddress>] [-FirstName <Text>] [-Initials <Text>] [-LastName <Text>]

Notes:

• The Name parameter is required, has a maximum length of 64 characters, and must be unique. If you don't use the DisplayName parameter, the value of the Name parameter is used for the display name.
• If you don't use the Alias parameter, the left side of the MicrosoftOnlineServicesID parameter is used for the alias.
• If you don't use the ExternalEmailAddress parameter, the MicrosoftOnlineServicesID value is used for the external email address.

This example creates a mail user with the following settings:

• The name is JeffreyZeng and the display name is Jeffrey Zeng.
• The first name is Jeffrey and the last name is Zeng.
• The alias is jeffreyz.
• The external email address is jzeng@tailspintoys.com.
• The account name is jeffreyz@contoso.onmicrosoft.com.

New-MailUser -Name JeffreyZeng -MicrosoftOnlineServicesID jeffreyz@contoso.onmicrosoft.com -Password (Get-Credential).password -ExternalEmailAddress jeffreyz@tailspintoys.com -DisplayName "Jeffrey Zeng" -Alias jeffreyz -FirstName Jeffrey -LastName Zeng

For detailed syntax and parameter information, see New-MailUser.

Use standalone EOP PowerShell to modify mail users

To modify existing mail users in standalone EOP PowerShell, use the following syntax:

Set-MailUser -Identity <MailUserIdentity> [-Alias <Text>] [-DisplayName <Text>] [-EmailAddresses <ProxyAddressCollection>] [-MicrosoftOnlineServicesID <SmtpAddress>]

Set-User -Identity <MailUserIdentity> [-City <Text>] [-Company <Text>] [-CountryOrRegion <CountryInfo>] [-Department <Text>] [-Fax <PhoneNumber>] [-FirstName <Text>] [-HomePhone <PhoneNumber>] [-Initials <Text>] [-LastName <Text>] [-MobilePhone <PhoneNumber>] [-Notes <Text>] [-Office <Text>] [-Phone <PhoneNumber>] [-PostalCode <String>] [-StateOrProvince <String>] [-StreetAddress <Tet>] [-Title <Text>] [-WebPage <Text>]

This example sets the external email address for Pilar Pinilla.

Set-MailUser -Identity "Pilar Pinilla" -EmailAddresses pilarp@tailspintoys.com

This example sets the Company property for all mail users to Contoso.

$Recip = Get-Recipient -RecipientType MailUser -ResultSize unlimited
$Recip | foreach {Set-User -Identity $_.Alias -Company Contoso}

For detailed syntax and parameter information, see Set-MailUser.

Use standalone EOP PowerShell to remove mail users

To remove mail users in standalone EOP PowerShell, replace <MailUserIdentity> with the name, alias, or account name of the mail user, and run the following command:

Remove-MailUser -Identity <MailUserIdentity\>

This example removes the mail user for Jeffrey Zeng.

Remove-MailUser -Identity "Jeffrey Zeng"

For detailed syntax and parameter information, see Remove-MailUser.

How do you know these procedures worked?

To verify that you've successfully created, modified, or removed mail users in standalone EOP, use any of the following procedures:

• In the EAC, go to Recipients > Contacts. Verify that the mail user is listed (or isn't listed). Select the mail user and view the information in the details flyout.

• In standalone EOP PowerShell, run the following command to verify the mail user is listed (or isn't listed):

  Get-Recipient -RecipientType MailUser -ResultSize unlimited
  

• Replace <MailUserIdentity> with the name, alias, or account name of the mail user, and run the following commands to verify the settings:

  Get-Recipient -Identity <MailUserIdentity> | Format-List
  

  Get-User -Identity <MailUserIdentity> | Format-List
  

Use directory synchronization to manage mail users

In standalone EOP, directory synchronization is available for customers with on-premises Active Directory. You can synchronize those accounts to Azure Active Directory (Azure AD), where copies of the accounts are stored in the cloud. When you synchronize your existing user accounts to Azure Active Directory, you can view those users in the Recipients pane of the Exchange admin center (EAC) or in standalone EOP PowerShell.

Notes:

• If you use directory synchronization to manage your recipients, you can still add and manage users in the Microsoft 365 admin center, but they will not be synchronized with your on-premises Active Directory. This is because directory synchronization only syncs recipients from your on-premises Active Directory to the cloud.

• Using directory synchronization is recommended for use with the following features:

  • Outlook Safe Sender lists and Blocked Sender lists: When synchronized to the service, these lists will take precedence over spam filtering in the service. This lets users manage their own Safe Sender list and Blocked Sender list with individual sender and domain entries. For more information, see Configure junk email settings on Exchange Online mailboxes.

  • Directory Based Edge Blocking (DBEB): For more information about DBEB, see Use Directory Based Edge Blocking to reject messages sent to invalid recipients.

  • End user access to quarantine: To access their quarantined messages, recipients must have a valid user ID and password in the service. For more information about quarantine, see Find and release quarantined messages as a user.

  • Mail flow rules (also known as transport rules): When you use directory synchronization, your existing Active Directory users and groups are automatically uploaded to the cloud, and you can then create mail flow rules that target specific users and/or groups without having to manually add them in the service. Note that dynamic distribution groups can't be synchronized via directory synchronization.

Get the necessary permissions and prepare for directory synchronization, as described in What is hybrid identity with Azure Active Directory?.

Synchronize directories with Azure Active Directory Connect (AAD Connect)

1. Activate directory synchronization as described in Azure AD Connect sync: Understand and customize synchronization.

2. Install and configure an on-premises computer to run AAD Connect as described in Prerequisites for Azure AD Connect.

3. Select which installation type to use for Azure AD Connect:

   • Express

   • Custom

   • Pass-through authentication

Important

When you finish the Azure Active Directory Sync Tool Configuration Wizard, the MSOL_AD_SYNC account is created in your Active Directory forest. This account is used to read and synchronize your on-premises Active Directory information. In order for directory synchronization to work correctly, make sure that TCP 443 on your local directory synchronization server is open.

After configuring your sync, be sure to verify that AAD Connect is synchronizing correctly. In the EAC, go to Recipients > Contacts and view that the list of users was correctly synchronized from your on-premises environment.