Group Creation Behavior

[Robert Bollinger]

Hey Team, 

Quick question for you. When I use the portal or (new-distributiongroup) to create a new group, I am finding that the group as "Allow external senders" enabled be default. I can confirm that the option for "Allow people outside my org to send to this group is not selected" at creation time.

This occurs when using the admin center or the cmdlet. I swear that it worked differently last week. Any ideas on the behavior? 

Thanks, 

Robert 

[#2]

Just tested in my tenant, PowerShell still uses a default value of True (external senders disabled) unless you specifically set it to False.

[09:39:05][Login script]# New-UnifiedGroup newwwwww -DisplayName newwwwww

Name DisplayName GroupType PrimarySmtpAddress
---- ----------- --------- ------------------
newwwwww_5c60ee20-e3a7-40b6-b50f-95be93ceb0e7 newwwwww Universal newwwwww@michev.info


[09:39:40][Login script]# Get-UnifiedGroup | ft Name,Require*

Name RequireSenderAuthenticationEnabled
---- ----------------------------------
newwwwww_5c60ee20-e3a7-40b6-b50f-95be93ceb0e7 True

[#3]

Hey Vasil,

Thanks for the test. But this is for a standard distro group. not for unified groups/Microsoft 365 groups. Can you check using the regular new-distributiongroup cmdlets?

thanks

[#4]

Oh sorry, that's what happens when I reply before getting my daily caffeine dose 🙂

Same behavior though:

[19:25:25][Login script]# New-DistributionGroup sdfghj
Name DisplayName GroupType PrimarySmtpAddress
---- ----------- --------- ------------------
sdfghj sdfghj Universal sdfghj@michev.onmicrosoft.com


[19:25:31][Login script]# Get-DistributionGroup sdfghj | ft Name,Req*

Name RequireSenderAuthenticationEnabled
---- ----------------------------------
sdfghj True

[#5]

@VasilMichev 

That's so strange when I do it, I get the same results as you but then if I check "accept messages from" its set to senders inside and outside.

Its almost like it changes the settings on its own.

[#6]

@VasilMichev 

here is another one: No changes were made by me to the group. 

[#7]

Hmmm, so apparently I had to wait a second... checking this morning I see the same behavior:

[08:52:51][Login script]# Get-DistributionGroup sdfghj | ft Name,Req*

Name RequireSenderAuthenticationEnabled
---- ----------------------------------
sdfghj False

And I see absolutely no trace of this in the event log. Check the admin audit log in Exchange/Unified Audit log on your end?

[#8]

Also @TonyRedmond as an FYI

[#9]

@VasilMichev 

I ran this:

New-DistributionGroup -Name "Project Aska" -PrimarySmtpAddress Project.Aska@office365itpros.com -DisplayName "Project Aska Team" -Alias Project.Aska Creating a new Remote PowerShell session using Modern Authentication for implicit remoting of "New-DistributionGroup" command ... New! Microsoft 365 Groups are the next generation of distribution lists.
Groups give teams shared tools for collaborating using email, files, a calendar, and more.
You can start right away using the New-UnifiedGroup cmdlet.

Name DisplayName GroupType PrimarySmtpAddress
---- ----------- --------- ------------------
Project Aska Project Aska Team Universal Project.Aska@office365itpros.com

Get-DistributionGroup Project.Aska | ft req*

RequireSenderAuthenticationEnabled
----------------------------------
True

RequireSenderAuthenticationEnabled is True, so external users can't send to this list. I then checked with EAC and found that the incorrect option appears to be selected:

But when I look at PowerShell again, I find that the property is updated. Something screwy is happening here.

Get-DistributionGroup Project.Aska | ft req*

RequireSenderAuthenticationEnabled
----------------------------------
False

[#10]

@TonyRedmond @VasilMichev 

Thank you so much for confirming what I was seeing. I thought for sure I had finally lost it. I have a ticket open with Microsoft support. I will keep you guys up date on my progress with Support. 

Thanks, 

Robert

[#11]

@VasilMichev 

Here are my admin audit logs: showing settings. no changes made after group created. I also checked the unified audit logs and only see one instance of new-distributiongroup and no other mentions of *distributionGroup*

Showing settings when creating group and no other changes to group

Thought not shown here, if you use the option RequireSenderAuthenticationEnabled $True its ignored and the group is still allowed to accept messages from all senders.

However this only occurs in my companies test and prod tenants, it does not in my tenant. 

[#12]

Microsoft Support has confirmed they are able to recreate this issue in their test tenants. They are now looking into it. So hopefully they will come back with something good.