Blog Post

Exchange Team Blog
1 MIN READ

Tell us how you use ObjectGuid, SamAccountName, and DistinguishedName in Exchange Online

The_Exchange_Team's avatar
The_Exchange_Team
Platinum Contributor
Aug 27, 2026

As Exchange Online continues its multi-year directory modernization, we are evaluating the future of several long-standing identifier properties: ObjectGuid (most would recognize this property as Guid), SamAccountName, and DistinguishedName.

Today, multiple properties can identify the same object in Exchange Online. While this has provided flexibility and compatibility, some of these identifiers reflect design decisions from an earlier era and can add complexity for customers building and maintaining automation, integrations, and administrative workflows.

As part of our modernization efforts, we are exploring whether a smaller and more consistent set of identifiers could better support the future of the service. No decisions have been made. Before determining a path forward, we want to better understand how these properties are used today, what the impact of potential changes could be, and what alternatives, notice periods, and migration assistance customers would need.

We are particularly interested in hearing from customers, partners, and solution providers who use these properties in scripts, automation, reporting, applications, provisioning systems, or operational processes.

The potential changes discussed in this survey apply only to the Exchange Online directory and do not represent changes to on-premises Active Directory or Exchange Server.

Please take a few minutes to complete our survey. Your feedback will help inform our evaluation and any future decisions in this area.

Take the Survey: Exchange Online Directory: Identifier Properties Survey – Fill out form

Thank you!
The Exchange Team

Updated Sep 02, 2026
Version 3.0

7 Comments

  • smoore6857's avatar
    smoore6857
    Brass Contributor

    We only use/rely on DN for including the a group within a Dynamic Distribution Group membership query (e.g. MemberOfGroup -eq DN of Group). Otherwise we focus on Name, UserPrincipalName or Guid for our internal processes. 

  • niehweune1's avatar
    niehweune1
    Tin Contributor

    Can you clarify which actual property you are referring to as ObjectGuid?
    I don't think any of the current cmdlets for Exchange Online (still) expose a property with that name.
    I suppose you're referring to the name of the attribute in the directory schema. Am I correct in assuming Exchange Online exposes this as the Guid attribute when calling Get-Mailbox/Get-Recipient/Get-User/.... cmdlets (just like onprem Exchange)?

    And what about ExternalDirectoryObjectId (my personal favorite, since that one allows matching objects with their counterparts in Graph/Entra)?

    • floatk's avatar
      floatk
      Icon for Microsoft rankMicrosoft

      Hi niehweune1! Good catch, you're absolutely right. ObjectGuid is the directory schema attribute name, and it isn't what you see in cmdlet output. Exchange Online cmdlets surface it simply as 

      Guid : 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d

      So your assumption about Get-Mailbox, Get-Recipient, and Get-User is correct.

      On ExternalDirectoryObjectId: that one is a different case. It's sourced from Entra rather than being a legacy directory identifier that Exchange Online owns, so it isn't in the same category as the three properties we're reviewing here. It stays a good option for the Graph and Entra correlation you describe and deserves to be your personal favorite 😄.

      We've updated the survey to say Guid, and we're getting this post updated as well. Thanks again for flagging this!

      • Satyajit321's avatar
        Satyajit321
        Iron Contributor

        This makes it a bit odd now. By ObjectId had assumed its external obj id from Entra. And we got a lot of guids exchange guild, archive guid etc. Guid specifically in EXO would be rarely used, so far haven't seen anyone including myself using that.

  • Satyajit321's avatar
    Satyajit321
    Iron Contributor

    Looking for alternatives for DistinguishedName DNs:

    MemberOf in EXO, currently the only option is using DN. Also RBAC and Scoping is only possible via this.

    Get-DistributionGroup -Filter "Members -eq '$DN'"

    New-ManagementScope -Name $ScopeName -RecipientRestrictionFilter "MemberOfGroup -eq '$DN'"

    • floatk's avatar
      floatk
      Icon for Microsoft rankMicrosoft

      Hi Satyajit321! Thanks for your input, this is exactly the kind of scenario we're trying to understand. Finding an alternative to DistinguishedName in filters that rely on group membership is one of the main reasons we launched this survey.

      We understand this is a critical scenario for many admins, impacting RBAC management scopes, dynamic distribution groups, and other features.

      If you have a few minutes, the survey has a section specifically on DistinguishedName that asks where these filters are defined and what you'd expect to use instead. Your input there would go directly into the evaluation.

      Thank you!