Hello, I'm trying to create a mail contact for an external user so we can add the user to an address list. Unfortunately, I can't create the contact because the primary smtp address is taken by a guest mail user. The guest mail user has access to our SharePoint site. 1. How do I add a guest mail user to an address list? 2. If I delete a guest mail user will the person lose access to SharePoint? 3. If a user has a mail contact in Exchange Online, can the user still receive and accept access to our SharePoint site?

To be honest, it's a bit of a mess as you can actually have the same address added twice: [10:36:59][Login script]# Get-Recipient tempxxx@abv.bg | Ft Name,RecipientType* Name RecipientType RecipientTypeDetails ---- ------------- -------------------- temp MailContact MailContact tempxxx_abv.bg#EXT# MailUser GuestMailUser The "trick" is to have the contact first, then provision the Guest account. Doesn't really make much sense to me, but TonyRedmond seems to see the logic in all this and perhaps can explain it better :)

How do I add a guest mail user to adress lists or create a mail contact using the same email address

32 Replies

squirrelassassin650
Copper Contributor
Jan 03, 2020
Guest Users are already in exchange as a mailuser. You cannot add them from the GUI, at least not the legacy (I personally dislike the new exchange interface, and they change the UI so fast … just forget it and use PowerShell so you don't look silly to clients fumbling around to find something M$ decided to move for no reason).

From PowerShell you can do the following:
# list your mailusers get-mailuser | Sort-Object -Property name # add your mailuser to a distro group $user = get-mailuser | where name -eq 'joe.blow_domain.com#EXT#' $group = Get-DistributionGroup 'testsecuritydistributiongroup' Add-DistributionGroupMember -Identity $group.Identity -Member $user.UserPrincipalName

Done.

John Gruber
- Marc Vanderstraeten
  Brass Contributor
  Jan 20, 2021
  squirrelassassin650 When I create a guest user via invitation, and I perform Get-MailUser, it is NOT in the list. Even if I change using Set-AzureADUser the flag to show it ???
  - squirrelassassin650
    Copper Contributor
    Mar 12, 2021
    Did the guest user accept the invitation yet? Under contact in azure ad is the email set? Does the proxyaddress area show both their actual email & your tenant routing domain?
LennyK_108
Copper Contributor
Aug 27, 2019
Hi everyone

If you created guest users first and want to add them to a distribution list, use the Microsoft 365 Admin app on Google Play Store / Apple App store to add the users. Create a blank distribution list first and then add them as members. I found that it's the only way to add them to the list if you've added them as guests first.

Otherwise yes, you had to create a mail contact first and THEN add them as guest users to a site/team.

Hope this helps.
- ChrisAtMaf
  Steel Contributor
  Aug 25, 2020
  LennyK_108 malfaro It is also possible to add 'Guest Mail Users' to Distribution Groups via a web browser without using PowerShell. Go to the Microsoft 365 Admin Portal - find the Guest Mail User under Users/Guest Users, select them, and click 'Manage groups' on the left hand side.
  
  It takes a while for the group list to be updated in that console, but the changes are visible in the Exchange Admin Centre immediately.
  
  https://admin.microsoft.com/AdminPortal/Home#/GuestUsers
  - axyrium
    Copper Contributor
    Oct 29, 2024
    Thanks for posting this! By far the easiest solution.
- malfaro
  Copper Contributor
  Apr 24, 2020
  LennyK_108 This worked and is soooo much easier than anything else I've read, thanks!!!!
AndrewC580
Copper Contributor
May 20, 2019
John Gruber

I know this is late but people are still trying to find a solution, so another option is to null the proxyaddresses attribute for the mail user. (Set-MailUser -Identity <Identityofmailuser> -EmailAddresses $Null). This is essentially what happens if you create the contact first anyway. Then you should be able to create your contact.
Tyler_Park
Copper Contributor
Jan 17, 2019
I was able to resolve this problem with the help of Microsoft Support. I had this same issue, where we already had an external user that has a lot of access to SharePoint resources, and I was trying to add them to a Distribution List. This user was in the list of Guest Users, and I could not add them to the Contacts list because of the same email address.

Microsoft support reps were able to instruct me how to run some PowerShell scripts that manually added the guest user to the distribution list. I do not have the exact scripts I ran, sorry for that, but just know that this can be done without having to remove the Guest account, and without having to have them added as a Contact first. However, after encountering this, I will be trying to add new external team members as Contacts first, to avoid having to do this again.
- J_Weikert-1995
  Copper Contributor
  Jan 18, 2019
  You have to get Access to Office 365 Exchange
  
  $LiveCred = Get-Credential
  $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection
  Import-PSSession $Session
  
  And this is the command to add the Guest User to the list
  Add-DistributionGroupMember -identity [GroupName] -Member [UserMailAdress]
  - TonyRedmond
    MVP
    Jan 18, 2019
    The important thing is to add the same email address used for the guest account to the distribution list. This example is from Chapter 12 of the Office 365 for IT Pros eBook. Azure AD is looked up to retrieve the address to make sure that we use the right one:
    
    Add-DistributionGroupMember -Identity DL1 -Member (Get-AzureADUser -ObjectId stale.hansen_cloudway.no#EXT#@office365itpros.onmicrosoft.com).Mail
Elham Karshenas
Copper Contributor
Jan 16, 2019
I know it might be a little late but I share the solution here just in case :)

By default external Azure AD guest accounts are hidden from Global Address List.
External azure AD gues account cannot be added to distribution lists but it can be added to O365 groups, SharePolint and MS Teams
An email contact can be added to distribution lists but it cannot be added to O365 groups, sharepoint or MS teams.

There are two ways to show external Azure AD guest accounts in Address lists. Depending on the usage you may follow one of these steps:

If you are using an email contact: The email address MUST be added to office 365 as a mail contact before adding that user as a guest to Azure AD. The opposite is not possible.
If you are not using an email contact: Using this PowerShell command you can show guest emails in GAL, without adding them as email contact:

Set-AzureADUser -ObjectId [of guest account] -ShowInAddressList $true

Using the PowerShell command you don't need to delete guest account to add it first as email contact. Not sure why, but Mictosoft likes to make simple things a tiny bit more complicated ;)
- SudarshanWaikos
  Copper Contributor
  Oct 10, 2022
  Elham Karshenas Set-MailUser -Identity "guestuseemailaddress" -HiddenFromAddressListsEnabled $false command will help to show the guest mail user in GAL.
- Jeff Shelp
  Copper Contributor
  Aug 23, 2022
  This was the way to go for us, easy. One thing though, I had to include the additional values if the user didn't already have them, seems they are required.
  
  Set-AzureADUser -ObjectId cfcbd1a0-ed18-4210-9b9d-cf0ba93cf6b2 -ShowInAddressList $true -GivenName 'Megan' -Surname 'Bowen' -DisplayName 'Megan Bowen' -TelephoneNumber '555-555-5555'
  
  For details, see "Add guests to the global address list" in the Microsoft 365 per-group guest access article. https://docs.microsoft.com/en-us/microsoft-365/solutions/per-group-guest-access
- MWinckle_Amey
  Copper Contributor
  Apr 18, 2019
  Elham KarshenasThanks a lot for this, solved the issue for us.
Afghan Salon
Brass Contributor
Jul 12, 2018
Please inspect my post there
- Afghan Salon
  Brass Contributor
  Jul 12, 2018
  That is odd - my post has been marked as spam and removed :(. I post it here instead.
  
  As regarding access for external users issues in both Office365 Groups and Teams - this looks by my tenant as follows:
  
  SCENARIO I - external user (ex. @outlook.com or @gmail.com etc.) hasn't been present in my Azure Active Directory (AAD) before
  
  When I add an external user, that is not present in my AAD (complete absence), as a guest to the group (I do it from within my Group site), then that user appears both:
  
  1) in Exchange Admin Center (EAC) as "guest mail-user"
  
  This category of recipient can not be created independently from within EAC as there is only possibility to create "mail-contact" or "mail-user". Therefore I assume that is another type of recipient that is being pulled into EAC from AAD, but can not be created or modified (ex. change of name) in EAC. Some data may be modified from Office 365 Admin>Users.
  
  2)and in AAD as "guest".
  
  That user gets not an inviation, but rather declaration: "You've joined the AAA group".
  
  There are two icons "Email with ease"" and "Read group files". As I click "Email with ease" am instantly redirected to new mail creation within my mail client. As I click "Read group files" am redirected to Office365 group site.
  
  I can not enter "conversations tab" as pop up appears - informing that I should refer to my mailbox to get mails from the group. In case I lost my invitation mail - I would have no idea as what is the mail of the group, because it does not appear anywhere on group site.
  
  This user has no problems to start Teams, but is not present in my Global Address List (GAL) within Outlook.
  
  There are some errors as sometimes I am able to assign licenses to those "guest mail users". Certainly these are errors.
  
  SCENARIO II - external user (ex. @outlook.com or @gmail.com etc.) that is already present in my AAD directory as mail-user.
  
  I add new user as "mail-user" in EAC (as I wanted to have these users be already authenticated for sharing ppurposes). At that time this user is being registered in AAS as "Member".
  
  That user gets not an inviation, but rather declaration: "XXX XXX added you to the AAA group".
  
  There are two icons "Share notes" and "Check out the team site". As I click "Share notes" am redirected to the Notebook of the group - works fine. As I click "Check out the team site" am redirected to Office365 group site.
  
  I can not enter "conversations tab" as pop up appears - stateing I have no mailbox license. In case I lost my invitation mail - I would have no idea as what is the mail of the group, because it does not appear anywhere on group site. What is more - I am unable to send any mails to that group - as I get postmaster reply stating: " The group AAA isn't set up to receive messages from BBB" ).
  
  This user has problems to start Teams - pop up appears stating that the administrator should turn team for my domain on.
  
  This user is present in my Global Address List (GAL) within Outlook.
  
  This "mail-user" may be assigned license for Office365 without any problems.
John Gruber
Brass Contributor
Dec 07, 2017
Thanks guys. I'll explain our options and let the users decide how they want to proceed.

If anyone else is having this issue you can vote and share more information with Microsoft using the Office 365 user voice website: https://office365.uservoice.com/forums/273493-office-365-admin/suggestions/19966537-allow-a-guest-user-to-be-converted-to-a-differen

Thanks again. Happy Holidays!
VasilMichev
MVP
Dec 07, 2017
To be honest, it's a bit of a mess as you can actually have the same address added twice:

[10:36:59][Login script]# Get-Recipient tempxxx@abv.bg | Ft Name,RecipientType* Name RecipientType RecipientTypeDetails ---- ------------- -------------------- temp MailContact MailContact tempxxx_abv.bg#EXT# MailUser GuestMailUser

The "trick" is to have the contact first, then provision the Guest account. Doesn't really make much sense to me, but TonyRedmond seems to see the logic in all this and perhaps can explain it better :)
- John Gruber
  Brass Contributor
  Dec 07, 2017
  What's the best thing to do if I already have the guest user? If I delete the guest user's will they lose access to SharePoint?
  - TonyRedmond
    MVP
    Dec 07, 2017
    If you remove the guest user object, that user loses all access to resources in your tenant. You could do that, then create the mail contact, recreate the guest user, and restablish sharing. I don’t have a better suggestion for now as I am on the road.
- TonyRedmond
  MVP
  Dec 07, 2017
  Re. Address Lists - Guest users are deliberately excluded from address lists like the GAL. Guest users are restricted to whatever information they are granted access to (in SharePoint for Groups, or to chats and other content for Teams).
  
  Mail contacts are there if you want someone external to show up in an address list, and you can have a mail contact with the same SMTP address as a guest. That's by design to enable both scenarios because Exchange Online uses mail contacts in a number of different ways, including in hybrid configurations where guests users don't exist.
  
  Eventually, when everyone is in the cloud and guest user objects are supported across all Office 365 apps, we might see a rationalization of the situation.

# list your mailusers\nget-mailuser | Sort-Object -Property name\n# add your mailuser to a distro group\n$user = get-mailuser | where name -eq 'joe.blow_domain.com#EXT#'\n$group = Get-DistributionGroup 'testsecuritydistributiongroup'\nAdd-DistributionGroupMember -Identity $group.Identity -Member $user.UserPrincipalName

[10:36:59][Login script]# Get-Recipient tempxxx@abv.bg | Ft Name,RecipientType*\n\nName RecipientType RecipientTypeDetails\n---- ------------- --------------------\ntemp MailContact MailContact\ntempxxx_abv.bg#EXT# MailUser GuestMailUser

Forum Discussion

How do I add a guest mail user to adress lists or create a mail contact using the same email address

32 Replies

Resources