Office 365 Group External Email (Hybrid)

[zrigby]

We are experiencing problems with our Office 365 Groups not being able to receive external emails in a Hybrid Environment. We have read countless topics about it as it seems like a common issue, but nothing seems to work for us.

• I have attached the error that I get when emailing from Gmail.
• We can email the group internally just fine
• The Groups have been created with the "allow external senders" option turned on
• We have Azure Group write-back enabled and the groups appear in our Active Directory
• We cannot create a mailbox for the groups in our Exchange 2012 server because they already exist due to the AD write-back (this seems like the big issue to me)
• We can email the group externally if we use the {group}@{company}.onmicrosoft.com email but not using {group}@{company}.org
• The email is trying to route through our exchange server first, where it cannot find the email, and then it almost gives up because it thinks that it doesn't exist.

I would be more than happy to supply any information that could get this problem fixed.

We are very frustrated and just need some help!!!

[#2]

You have redacted too much info in that screenshot so it is unfortunately unhelpful. If you need to sanatize it, post a screenshot where you have edited it rather than redacted, so that things like the same server name is used repeatedly and is not just a red box

[#3]

@zrigby Did you ever get this resolved? We have exactly the same problem you described.

[#4]

@JamesH50 Yes we did get this resolved, but we did not do it ourselves as we had to use a vendor. I will reach out to them for a detailed explanation, but here is the idea of what they did:

They used a write-back feature in Azure to recreate the Office 365 groups created on the web in our on-site Active Directory. 

This made it so that when an external email went through our Exchange Server which serves as a relay, the email address existed and allowed it to then go to Office 365 where the actual group existed and distributed the email.

The reason I am not entirely sure how it works is because in AD the groups are called something like: Name: Group_70b9cd7-6f22-... Type: Distribution Group - Universal Description: {Group Name} Email Address: {Email Address}. There is an attribute labeled: msExchRequireAuthToSendTo that needed to be set to FALSE for some of the groups that still had problems. The groups are also placed in an Admin OU since they wont be used for anything except for a relay.

If you use some sort of support, maybe this will help then understand what needs to be done. If I can get a better explanation from someone who knows more than me, I will update here!

[#5]

@zrigby Thanks for the reply, we worked it out earlier today and came up with a similar answer - we needed some Azure AD P1 licences to enable writeback feature.

We then had to follow instructions here to enable the O365 group to receive external email: https://answers.microsoft.com/en-us/msoffice/forum/all/550-57133/be2b2e38-c528-4752-bd0b-cfaca424090...