SOLVED
Home

Cannot add a "contact" in Exchange Online to an Office 365 Group as a Guest

George Khalil
Senior Member

Looks like this is an issue - I have successfully been able to add external recipients as guests in an Office 365 Group if they are not listed in the GAL, however when I come to add a contact listed in the GAL as a guest, I receive the below warning;

 

"You are trying to add a contact created by your admin. Contact your admin to add the user as a guest to this group"

 

Help please.

 

Thanks

31 Replies
Solution

Thanks @George Khalil for reaching out! Currently adding of mail contacts as guest is not supported, however there is way you can add mail contacts for which you would need the administrator to remove the other mail-enabled object, after which the guest user object can be added by the group owner or by an administrator running cmdlet with mSExchHideFromAddressLists property as $false, this property would ensure that the contact is visible in GAL.

You can refer tenant admin documentation https://support.office.com/en-us/article/Guest-access-to-Office-365-groups-Admin-Help-7c713d74-a144-...

 

Alternatively there is a very good and informative article written by @Tony Redmond https://www.petri.com/external-access-office-365-groups about guests in Groups, which includes details about Guests in Groups.

By the way, if you remove a mail-enabled contact so that you can add a new guest user for the same SMTP address, you might wonder whether that guest user object can be used in Exchange distribution lists. The official answer might be no, because the picker control used in EAC to select objects to add to DLs won't include guest users. However, PowerShell comes to the rescue (once again) as you can use the Add-DistributionGroupMember to add a guest user to a DL.


@Tony Redmond wrote:

By the way, if you remove a mail-enabled contact so that you can add a new guest user for the same SMTP address, you might wonder whether that guest user object can be used in Exchange distribution lists. The official answer might be no, because the picker control used in EAC to select objects to add to DLs won't include guest users. However, PowerShell comes to the rescue (once again) as you can use the Add-DistributionGroupMember to add a guest user to a DL.


This information has been very helpful to me.  So has Tony's article.  The question I have is...Can a guest user be added to a dynamic distribution list?

 

Thanks

 

Conceptually I don't see a problem as AAD will simply select the objects that you identify through the query. But I have not tried it and I do not have AAD premium enabled on a tenant right now so I can't test. Try it and let us know.

Thanks for your response.  I really appreciate it!

 

I usually setup dynamic groups by querying the custom attributes of mail recipients.  I don't know where to setup the custom attributes on a guest user.  However, I hadn't considered the idea of changing the query to just include certain users.  If you have any ideas about the custom attributes let me know.  Otherwise I'll try a different query.

 

Thanks again.

A guest user is an AAD object and can be edited as such. I found that the AAD console didn't support editing because it didn't like the form of address used (#EXT#), but the Office 365 Admin Console absolutely allows you to edit guest user details.

We are setup in a Hybrid environement. We have a ton of mail-contacts on our on-prem Exchange environment as they are members of distribution groups. Because of that, group owners are running into the error stated in this thread.

 

Removing the mail-contact will allow the group owner to add the user as a guest but removing the contact removes DL membership. Our distribution groups are on-prem and don't see the guest users that are in-cloud as expected. Running an add-distribtiongroupmember in the Office 365 PowerShell fails as the DL's are on-prem.

 

Seems to me that we need to re-create the distribtion groups in the cloud in order for guests to be added?

 

The problem with that is we integrate our ERP system with Exchange via PowerShell scripts to build/update these lists nightly based on roles. The PowerShell is expecting to see the lists on-prem which won't work because of the guest in-cloud accounts.

 

The only workaround I've come up with is to delete the on-prem mail-contact, have the group owner add the user as a guest (in-cloud), then re-create the mail-contact (on-prem). This all works but we get dirsync errors about a dupe.

 

 Any cleaner way of doing this?

Thanks Todd for reaching out! I have sent you a private message. I will follow-up with you there.

Why don't you exclude the on-premises from being synchronized with AAD? That way you can have on-prem mail contacts that don't interfere with the creation of guest user accounts. It might be messy, but it would avoid the duplicate errors you are seeing now.

That's actually what we have been discussing internally but as you said, may get really messy.

 

 

I'm at a conference with Michael Van Hybrid today and asked him what he would do... He's contemplating the issue right now and might come up with a better solution. I shall let you know what he says.

I work at a large university and we sync all contacts campus wide (multiple email tenants). Simply hiding these external contacts just isn't an option for my organization. We really want to roll out groups, but without this functionality we simply can't move forward. Any ideas on when this feature may be available?

We have the same issue in our organization.  I hope they come up with a better solution.

We have a similar issue. 

 

My customers organisation want contacts in the GAL and distribution lists loaded from our CRM nightly. 

 

Yet we need to give access to people at those email addresses access to Sharepoint / OneDrive etc using Guest accounts. 

 

Currently we are still maintaining an on prem instance of Sharepoint for these external users to access. We are under pressure to decomission this farm due to a datacenter move. 

 

The only other option we have is to license our external users sync their existing extranet AD accounts to Azure AD. Which we already tried once and failed due to the contacts being duplicate and accounts taking precident. Which then removed the contacts from the distribution lists!

 

The guest accounts and mail enabled contact need to either co-exist or be merged as a single object which retains the DL membership. 

 

 

 

 

 

 

 

 

 

 

 

 

 

I cound't agree more!  The guest access to groups is basically useless for my orgainization until it can coexist with exchange contacts.  We have a ton of distribution lists and forwarding accounts.  

 

This push that Microsoft has to move distribution groups to Office 365 groups isn't going to work for us.  It's kind of anoying to tell the truth.  I don't see distribution groups or forwarding accounts going away anytime soon so this needs to be supported.  

Thanks folks for the feedback! This is something that we are actively working on for first half of 2017. We will keep you posted with updates.

Thanks for the update Sahil most appreciated. 

 

 

Highlighted

Wow this is a really big limitation. This afternoon I put aside time to move a bunch of our groups from Linux MailMan to 365 Groups and fell at the first hurdle. It is very probable that the sort of "guest" users you will want to add to such a group would already reside in the GAL as a contact. Especially an organisation that is membership based like we are.

 

Shame.

 

Be good when thius is fixed.

 

I have a client that is experiencing similar issue as described by other folks on this thread: external user emails are in a dist list and we cannot add them to groups, which is a critical requirement.

 

Thank you for this response regarding this issue.  I see that it's been a couple months since this reply.  Are there any noteworthy updates?  Is there a site or page we can use to track progress?

 

Cheers!

Microsoft now has an Office 365 Roadmap item to allow a mail contact to be added as an external guest to an Office 365 group. It's coming... (like Christmas!)

Hi Tony, Thanks for the reply and great to know!  Any ideas on garnering a soft target date of 'rolling out' status on this?  I believe 'first half of 2017' was mentioned earlier in the thread.

 

Cheers!

It is "under development" so could be revealed to First Release tenants at any time. I think this is a reasonably simple change, so I would expect it in the short term.

My customer has had the situation for over a year. Where they had all business partners as mail contact objects in AD. Which means we cannot use them as guests in 365 at all. So for the moment they are paying K1 licenses and managing separate accounts for those we need access to SPO on 365. Very costly since externals do not need access that often.

Is there an update to the timeline for this? It's now mid-April and this feature still isn't available!


@Pat Woods wrote:

Is there an update to the timeline for this? It's now mid-April and this feature still isn't available!


"Add Mail Contact as guest to Office 365 Group" is still listed as 'In Development'.  I haven't seen an actual timeline associated with that status.

 

https://products.office.com/en-us/business/office-365-roadmap#abc

 

So, where is this now. I followed your link to the road map and cannot find a reference to this. I have this issue as well and would like to know when it will be a reality.

Hi Casey, This feature got released this summer. Its functional in Outlook end-points. You should try it out. Let me know if you have any questions! 

 

It is also updated in documentation; here is one article by one of Exchange MVPs https://www.petri.com/office-365-groups-mail-contacts

Sahil,

 

I've looked at this avenue and it simply isn't feasible to manage large groups of contacts this way. Adding a user level feature is not a solution for most any company.

 

I called o365 support and was pointed in the direction of the PowerShell Add-UnifiedGroupLinks cmdlet as this doesn't appear to be something that I can solve using the Admin Center or the Exchange Admin Center since contacts simply are not visible when working with Office 365 Groups.. The bad thing is that after support suggested this solution they tucked their tail between their legs and ended the call.

 

Still, i cannot get the CMDLET to work. I am attempting to sort this out with community support on this post.This is really something that needs to be addressed and a good article written about,

 

https://social.technet.microsoft.com/Forums/office/en-US/f080f8ae-9ca3-436e-9d78-6d64a777ed5c/powers...

 

Thanks for your response. It is appreciated even if it didn't solve the larger problem.

 

If I understand the problem correctly, you have some mail contacts that appear in your GAL that you want to programatically add to Office 365 Groups. If this is the case, support was correct to point you to the Add-UnifiedGroupLinks cmdlet. Here's what you need to do.

 

[PS] C:\> Add-UnifiedGroupLinks -Id GroupName -LinkType Members -Links (Get-MailContact -id MailContact).WindowsEmailAddress

 

Basically, you take the email address registered in the mail contact and use it to create a new member of the group. Because the email address already exists for a mail contact in the tenant, Office 365 recognizes that it must create a new guest user object and goes ahead to do this before adding that object as a group member.

 

Isn't PowerShell wonderful...  All explained in Chapter 15 of "Office 365 for IT Pros"... No article necessary.

For inviting guests we would need to call AAD cmdlet, Inviting guest doesn't work with O365 or exchange cmdlets, whether the guest exist as mail contact or not. 

This article includes AAD B2B sample for that: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-b2b-code-samples

 

for example you can invite any email address through 

New-AzureADMSInvitation -InvitedUserDisplayName "Test User" -InvitedUserEmailAddress Test.User@Outlook.com -SendInvitationMessage $True -InviteRedirectUrl https://teamsite.com

 

And once this user is added you can add this user to Group

$NewUser = (Get-AzureADUser -ObjectId Test.User_outlook.com#EXT#@office365itpros.onmicrosoft.com).ObjectId

$Grp = (Get-AzureADGroup -SearchString "GroupName").id

Add-AzureADGroupMember -ObjectId $Grp -RefObjectId $NewUser

 

Please note there will some delay for this new user to be replicated into Group. You should also include error handling case when ObjectId is null.