Manage mail users in standalone EOP

In standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, mail users (also known as mail-enabled users) are the fundamental type of user account. A mail user has account credentials in your standalone EOP organization, and can access resources (have permissions assigned). A mail user's email address is external (for example, in your on-premises email environment).

Note

When you create a mail user, the corresponding user account is available in the Microsoft 365 admin center. When you create a user account in the Microsoft 365 admin center, you can't use that account to create a mail user.

The recommended method to create and manage mail users in standalone EOP is to use directory synchronization as described in the Use directory synchronization to manage mail users section later in this article.

For standalone EOP organizations with a few users, you can add and manage mail users in the Exchange admin center (EAC) or in standalone EOP PowerShell as described in this article.

What do you need to know before you begin?

Use the Exchange admin center to manage mail users

In the EAC at https://admin.exchange.microsoft.com, go to Recipients > Contacts. Or to go directly to the Contacts page, use https://admin.exchange.microsoft.com/#/contacts.

The following information is shown on the Contacts page for each entry:

  • Display name
  • Email address
  • Contact type: This value is MailUser for mail users.

To change the list from normal to compact spacing, select Change view, and then select Compact list.

Use the Search box and a corresponding value to find specific mail users.

To filter the list of entries on the page, select Filter, and then select one of the following values:

  • All contacts
  • Mail contacts
  • Mail users
  • Guest mail users****Groups with dynamic membership or Ownerless groups.

To clear the filter, select Clear filter.

To create a custom filter, select New filter.

In the blank area next to the Display name column, select the round check box that appears next to one or more entries, or select all entries by selecting the round check box that appears in the column heading, and then select the Export contacts action that appears on the page. Select Export contacts in current list or Export all contacts. The default filename is Contacts.csv and the default location is the Downloads folder. If a file with that name already exists, the filename is appended with a number (for example, Contacts (1).csv).

Use the EAC to create mail users

  1. On the Contacts page at https://admin.exchange.microsoft.com/#/contacts, select Add a mail user to open the new mail user wizard.

  2. On the Set up the basic information page, configure the following settings. Settings marked with an * are required.

    • First name
    • Last name
    • Initials: The person's middle initial.
    • Display name*
    • External email address: Enter the user's email address. The domain should be external to your cloud-based organization.
    • Alias*
    • User ID* and Domain*: Enter the account that the person uses to sign in to the service.
    • Password* and Confirm password*: Enter and reenter the account password. Verify that the password complies with the password length, complexity, and history requirements of your organization

    When you're finished on the Set up the basic information page, select Next.

  3. On the Review mail user page, review the details. Select Back to make changes.

    When you're finished on the Review mail user page, select Create.

  4. On the Status page, wait for the mail user creation to finish, and then select Done.

Use the EAC to modify mail users

  1. On the Contacts page at https://admin.exchange.microsoft.com/#/contacts, find the mail user that you want to modify (the Contact type value is MailUser), and select the mail user by clicking on the Display name value (don't select the checkbox).

  2. In the details flyout that opens, the following tabs are available:

    • General tab:
      • General information section: Select Manage general information to modify the following properties:
        • First name
        • Last name
        • Display name
        • Initials
      • Hide from global address list (GAL): Select Manage hide from GAL turn Off or turn On hiding the mail user from the GAL.
      • MailTip section: Select Manage MailTip to add a MailTip to the mail user.
    • Personal information section: The following settings are available:
      • Contact information section: Select Contact information to modify the following properties:
        • Web site
        • Fax phone
        • Home phone
        • Mobile phone
        • Work phone
        • Office
        • Street
        • City
        • State/Province
        • ZIP/Postal code
        • Country/Region
        • Notes
      • Organization information section: Select Edit organization to modify the following properties:
        • Title
        • Department
        • Company
        • Manager
        • Direct reports is available if the mail user is already designated as someone's manager.
    • Others tab:
      • Custom attributes section: Select Manage custom attributes to add text values to the Custom 1 through Custom 15 attributes.
      • Member of (group membership) section: Select Manage member of to remove the mail user from existing groups.
      • Email addresses section: Select Manage email address types to manage the proxy addresses for the mail user.
      • Message delivery restrictions section: Select Manage message delivery restrictions to change the following properties:
        • Accept messages from section:
          • Select All senders or Selected senders. If you select Selected senders, Add sender appears for you to select senders to allow.
          • Select or clear Require senders to be authenticated.
        • Block messages from section: Select None or Selected senders. If you select Selected senders, Add sender appears for you to select senders to block.

    When you're finished modifying the properties of the mail user, select Save.

Use the EAC to remove mail users

  1. On the Contacts page at https://admin.exchange.microsoft.com/#/contacts, find, select, and remove the mail user using either of the following methods:

    • Select the round check box that appears in the blank area next to the Display name column, and then select the Delete action that appears on the page.
    • Click anywhere in the row other than the round check box next to the Display name column. In the details flyout that opens, select Delete contact at the top of the flyout.
  2. Select Confirm in the flyout that opens.

Use standalone Exchange Online Protection PowerShell to manage mail users

To connect to standalone EOP PowerShell, see Connect to Exchange Online Protection PowerShell.

Use standalone EOP PowerShell to view mail users

To return a summary list of all mail users in standalone EOP PowerShell, run the following command:

Get-Recipient -RecipientType MailUser -ResultSize unlimited

To view detailed information about a specific mail user, replace <MailUserIdentity> with the name, alias, or account name of the mail user, and run the following commands:

Get-Recipient -Identity <MailUserIdentity> | Format-List
Get-User -Identity <MailUserIdentity> | Format-List

For detailed syntax and parameter information, see Get-Recipient and Get-User.

Use standalone EOP PowerShell to create mail users

To create mail users in standalone EOP PowerShell, use the following syntax:

New-MailUser -Name "<UniqueName>" -MicrosoftOnlineServicesID <Account> -Password (Read-Host "Enter password" -AsSecureString) [-Alias <AliasValue>] [-DisplayName "<Display Name>"] [-ExternalEmailAddress <ExternalEmailAddress>] [-FirstName <Text>] [-Initials <Text>] [-LastName <Text>]
  • The Name parameter is required, has a maximum length of 64 characters, and must be unique. If you don't use the DisplayName parameter, the value of the Name parameter is used for the display name.
  • If you don't use the Alias parameter, the left side of the MicrosoftOnlineServicesID parameter is used for the alias.
  • If you don't use the ExternalEmailAddress parameter, the MicrosoftOnlineServicesID value is used for the external email address.
  • You're prompted to enter a password.

This example creates a mail user with the following settings:

  • The name is JeffreyZeng and the display name is Jeffrey Zeng.
  • The first name is Jeffrey and the family name is Zeng.
  • The alias is jeffreyz.
  • The external email address is jzeng@tailspintoys.com.
  • The account name is jeffreyz@contoso.onmicrosoft.com.
New-MailUser -Name JeffreyZeng -MicrosoftOnlineServicesID jeffreyz@contoso.onmicrosoft.com -Password (Read-Host "Enter password" -AsSecureString) -ExternalEmailAddress jeffreyz@tailspintoys.com -DisplayName "Jeffrey Zeng" -Alias jeffreyz -FirstName Jeffrey -LastName Zeng

For detailed syntax and parameter information, see New-MailUser.

Use standalone EOP PowerShell to modify mail users

To modify existing mail users in standalone EOP PowerShell, use the following syntax:

Set-MailUser -Identity <MailUserIdentity> [-Alias <Text>] [-DisplayName <Text>] [-EmailAddresses <ProxyAddressCollection>] [-MicrosoftOnlineServicesID <SmtpAddress>]
Set-User -Identity <MailUserIdentity> [-City <Text>] [-Company <Text>] [-CountryOrRegion <CountryInfo>] [-Department <Text>] [-Fax <PhoneNumber>] [-FirstName <Text>] [-HomePhone <PhoneNumber>] [-Initials <Text>] [-LastName <Text>] [-MobilePhone <PhoneNumber>] [-Notes <Text>] [-Office <Text>] [-Phone <PhoneNumber>] [-PostalCode <String>] [-StateOrProvince <String>] [-StreetAddress <Tet>] [-Title <Text>] [-WebPage <Text>]

This example sets the external email address for Pilar Pinilla.

Set-MailUser -Identity "Pilar Pinilla" -EmailAddresses pilarp@tailspintoys.com

This example sets the Company property for all mail users to Contoso.

$Recip = Get-Recipient -RecipientType MailUser -ResultSize unlimited
$Recip | foreach {Set-User -Identity $_.Alias -Company Contoso}

For detailed syntax and parameter information, see Set-MailUser.

Use standalone EOP PowerShell to remove mail users

To remove mail users in standalone EOP PowerShell, replace <MailUserIdentity> with the name, alias, or account name of the mail user, and run the following command:

Remove-MailUser -Identity <MailUserIdentity\>

This example removes the mail user for Jeffrey Zeng.

Remove-MailUser -Identity "Jeffrey Zeng"

For detailed syntax and parameter information, see Remove-MailUser.

How do you know these procedures worked?

To verify that you successfully created, modified, or removed mail users in standalone EOP, use any of the following procedures:

  • In the EAC, go to Recipients > Contacts. Verify that the mail user is listed (or isn't listed). Select the mail user and view the information in the details flyout.

  • In standalone EOP PowerShell, run the following command to verify the mail user is listed (or isn't listed):

    Get-Recipient -RecipientType MailUser -ResultSize unlimited
    
  • Replace <MailUserIdentity> with the name, alias, or account name of the mail user, and run the following commands to verify the settings:

    Get-Recipient -Identity <MailUserIdentity> | Format-List
    
    Get-User -Identity <MailUserIdentity> | Format-List
    

Use directory synchronization to manage mail users

In standalone EOP, directory synchronization is available for customers with on-premises Active Directory. You can synchronize those accounts to Microsoft Entra ID, where copies of the accounts are stored in the cloud. When you synchronize your existing user accounts to Microsoft Entra ID, you can view those users in the Recipients pane of the Exchange admin center (EAC) or in standalone EOP PowerShell.

  • If you use directory synchronization to manage your recipients, you can still add and manage users in the Microsoft 365 admin center, but they aren't synchronized with your on-premises Active Directory. This result occurs because directory synchronization only syncs recipients from your on-premises Active Directory to the cloud.

  • Using directory synchronization is recommended for use with the following features:

    • Outlook Safe Sender lists and Blocked Sender lists: When synchronized to the service, these lists will take precedence over spam filtering in the service. This result lets users manage their own Safe Sender list and Blocked Sender list with individual sender and domain entries. For more information, see Configure junk email settings on Exchange Online mailboxes.

    • Directory Based Edge Blocking (DBEB): For more information about DBEB, see Use Directory Based Edge Blocking to reject messages sent to invalid recipients.

    • End user access to quarantine: To access their quarantined messages, recipients must have a valid user ID and password in the service. For more information about quarantine, see Find and release quarantined messages as a user.

    • Mail flow rules (also known as transport rules): When you use directory synchronization, your existing Active Directory users and groups are automatically uploaded to the cloud, and you can then create mail flow rules that target specific users and/or groups without having to manually add them in the service. Dynamic distribution groups can't be synchronized via directory synchronization.

Get the necessary permissions and prepare for directory synchronization, as described in What is Microsoft Entra Connect?.

Synchronize directories with Microsoft Entra Connect

  1. Activate directory synchronization as described in Microsoft Entra Connect Sync: Understand and customize synchronization.

  2. Install and configure an on-premises computer to run Microsoft Entra Connect as described in Prerequisites for Microsoft Entra Connect.

  3. Select which installation type to use for Microsoft Entra Connect:

Important

When you finish the Azure Active Directory Sync Tool Configuration Wizard, the MSOL_AD_SYNC account is created in your Active Directory forest. This account is used to read and synchronize your on-premises Active Directory information. In order for directory synchronization to work correctly, make sure that TCP 443 on your local directory synchronization server is open.

After configuring your sync, be sure to verify that Microsoft Entra Connect is synchronizing correctly. In the EAC, go to Recipients > Contacts and view that the list of users was correctly synchronized from your on-premises environment.