Access denied to Mail User from outside organisation

%3CLINGO-SUB%20id%3D%22lingo-sub-233608%22%20slang%3D%22en-US%22%3EAccess%20denied%20to%20Mail%20User%20from%20outside%20organisation%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-233608%22%20slang%3D%22en-US%22%3E%3CP%3EPreviously%20I%20used%20%22Mail%20Users%22%20to%20create%20contacts%20that%20people%20from%20outside%20our%20organisation%20can%20email.%26nbsp%3B%20It%20looks%20like%20they%20are%20part%20of%20our%20organisation%2C%20but%20the%20email%20gets%20forwarded%20elsewhere%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1)%20Would%20a%20mail%20contact%20be%20better%20for%20this%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E2)%20Mail%20users%20that%20I%20try%20to%20create%20today%20get%20bounced%20with%20an%20%22Access%20denied%22%20error%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CMAILUSER2%3E%3A%20host%3CBR%20%2F%3Eexample-com.mail.protection.outlook.com%5B213.199.154.138%5D%20said%3A%20550%3CBR%20%2F%3E5.4.1%20%5Bmailuser2%40example.com%5D%3A%20Recipient%20address%20rejected%3A%20Access%3CBR%20%2F%3Edenied%20%5BVE1EUR03FT027.eop-EUR03.prod.protection.outlook.com%5D%20(in%20reply%20to%3CBR%20%2F%3ERCPT%20TO%20command)%3CBR%20%2F%3EReporting-MTA%3A%20dns%3B%20mail3.othercompany.com%3CBR%20%2F%3EX-Postfix-Queue-ID%3A%2020DB3520128%3CBR%20%2F%3EX-Postfix-Sender%3A%20rfc822%3B%20rufus%40othercompany.com%3CBR%20%2F%3EArrival-Date%3A%20Fri%2C%2017%20Aug%202018%2011%3A00%3A20%20%2B0000%20(UTC)%3C%2FMAILUSER2%3E%3C%2FP%3E%3CP%3EFinal-Recipient%3A%20rfc822%3B%20mailuser2%40example.com%3CBR%20%2F%3EOriginal-Recipient%3A%20rfc822%3Bmailuser2%40example.com%3CBR%20%2F%3EAction%3A%20failed%3CBR%20%2F%3EStatus%3A%205.4.1%3CBR%20%2F%3ERemote-MTA%3A%20dns%3B%20example-com.mail.protection.outlook.com%3CBR%20%2F%3EDiagnostic-Code%3A%20smtp%3B%20550%205.4.1%20%5Bmailuser2%40example.com%5D%3A%20Recipient%3CBR%20%2F%3Eaddress%20rejected%3A%20Access%20denied%3CBR%20%2F%3E%5BVE1EUR03FT027.eop-EUR03.prod.protection.outlook.com%5D%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EExisting%20%22Mail%20users%22%20work%20ok.%20The%20mail%20flow%20is%20setup%20not%20to%20reject%20external%20senders%2C%20and%20appears%20the%20same%20as%20the%20existing%20users.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-233608%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-251475%22%20slang%3D%22en-US%22%3ERe%3A%20Access%20denied%20to%20Mail%20User%20from%20outside%20organisation%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-251475%22%20slang%3D%22en-US%22%3EThat's%20not%20the%20issue.%20The%20issue%20is%20to%20get%20a%20mail%20that%20comes%20from%20outside%20Office%20365%20to%20the%20contact%20adress.%20It's%20rejected%20before%20it%20can%20even%20be%20processed%20by%20Office%20365%20to%20be%20redirected%20to%20the%20outside%20again.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-251343%22%20slang%3D%22en-US%22%3ERe%3A%20Access%20denied%20to%20Mail%20User%20from%20outside%20organisation%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-251343%22%20slang%3D%22en-US%22%3E%3CP%3EEither%20option%20allows%20for%20%22redirecting%22%20the%20messages%20outside%20of%20O365.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-251174%22%20slang%3D%22en-US%22%3ERe%3A%20Access%20denied%20to%20Mail%20User%20from%20outside%20organisation%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-251174%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%2C%20his%20problem%20is%20that%20he%20wants%20to%20redirect%20user%40contoso.com%20to%20user%40exmaple.com%20via%20Mail%20Contact%20or%20Mail%20User%20for%20external%20senders.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F172908%22%20target%3D%22_blank%22%3E%40Rufus%20Brown%3C%2FA%3EI%20am%20not%20aware%20that%20this%20works%20with%20both%20Mail%20Contacts%20or%20Mail%20Users%20on%20their%20own.%20You%20need%20to%20create%20a%20Distribution%20List%20and%20add%20the%20Mail%20Contact%2FUser%20to%20the%20list.%20Then%20this%20will%20work%20for%20external%20senders.%20I%20don't%20think%20that%20ever%20worked.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-237930%22%20slang%3D%22en-US%22%3ERe%3A%20Access%20denied%20to%20Mail%20User%20from%20outside%20organisation%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-237930%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20you%20only%20need%20this%20for%20forwarding%20mail%2C%20Mail%20contacts%20will%20do%20just%20fine.%20If%20they%20need%20to%20login%20to%20your%20tenant%20or%20access%20any%20of%20the%20O365%20services%2C%20then%20you%20should%20use%20Mail%20Users%2C%20as%20they%20have%20an%20underlying%20user%20object%20in%20Azure%20AD.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Previously I used "Mail Users" to create contacts that people from outside our organisation can email.  It looks like they are part of our organisation, but the email gets forwarded elsewhere:

 

1) Would a mail contact be better for this?

 

2) Mail users that I try to create today get bounced with an "Access denied" error:

 

<mailuser2@example.com>: host
example-com.mail.protection.outlook.com[213.199.154.138] said: 550
5.4.1 [mailuser2@example.com]: Recipient address rejected: Access
denied [VE1EUR03FT027.eop-EUR03.prod.protection.outlook.com] (in reply to
RCPT TO command)
Reporting-MTA: dns; mail3.othercompany.com
X-Postfix-Queue-ID: 20DB3520128
X-Postfix-Sender: rfc822; rufus@othercompany.com
Arrival-Date: Fri, 17 Aug 2018 11:00:20 +0000 (UTC)

Final-Recipient: rfc822; mailuser2@example.com
Original-Recipient: rfc822;mailuser2@example.com
Action: failed
Status: 5.4.1
Remote-MTA: dns; example-com.mail.protection.outlook.com
Diagnostic-Code: smtp; 550 5.4.1 [mailuser2@example.com]: Recipient
address rejected: Access denied
[VE1EUR03FT027.eop-EUR03.prod.protection.outlook.com]

 

Existing "Mail users" work ok. The mail flow is setup not to reject external senders, and appears the same as the existing users.

4 Replies
Highlighted

If you only need this for forwarding mail, Mail contacts will do just fine. If they need to login to your tenant or access any of the O365 services, then you should use Mail Users, as they have an underlying user object in Azure AD.

Highlighted

@Vasil Michev, his problem is that he wants to redirect user@contoso.com to user@exmaple.com via Mail Contact or Mail User for external senders.

 

@Rufus BrownI am not aware that this works with both Mail Contacts or Mail Users on their own. You need to create a Distribution List and add the Mail Contact/User to the list. Then this will work for external senders. I don't think that ever worked.

Highlighted

Either option allows for "redirecting" the messages outside of O365.

Highlighted
That's not the issue. The issue is to get a mail that comes from outside Office 365 to the contact adress. It's rejected before it can even be processed by Office 365 to be redirected to the outside again.