Forum Discussion
How to update the proxyAddresses of a Cloud-only Entra ID user
Even though the Graph API allows you to read the proxyAddresses property via GET, modifying it with PATCH often fails for cloud-only users without Exchange Online. This is because:
- The proxyAddresses attribute is tightly coupled with Exchange Online.
- Without a mailbox, the backend doesn’t expose full write access to that attribute, even via Graph
Option 1: Provision an Exchange Online License
Assign the user an Exchange Online license, which will provision a mailbox. Once that's done, you'll be able to manage proxyAddresses using Exchange Online PowerShell or Graph API. This gives you full control over mail-related attributes, but it does come with licensing costs and setup time.
Option 2: Recreate the User
Delete and recreate the user with the correct proxyAddresses values from the start. This ensures a clean configuration, but it can be risky, you might lose group memberships, app assignments, and audit history unless you carefully reassign everything.
Can confirm this worked for me on a cloud-only Entra ID user (no Exchange Online license, RecipientType: User, no mailbox).
Update-MgUser -ProxyAddresses via the Microsoft.Graph PowerShell SDK fails with the documented read-only error:
Property 'proxyAddresses' is read-only and cannot be set.
But issuing a raw PATCH against the beta endpoint succeeds where the v1.0 SDK cmdlet does not:
$body = @{
proxyAddresses = @("SMTP:email address removed for privacy reasons")
} | ConvertTo-Json
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/beta/users/{userId}" -Body $body -ContentType "application/json"
A follow-up GET confirmed the full proxyAddresses array was replaced as requested.
Worth noting for anyone relying on this: the official docs for proxyAddresses still list it as read-only in both v1.0 and beta, so this is undocumented behavior on Microsoft's part, not a supported write path. I'd treat it as something that could be locked down or changed without notice