Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / Exchange / How to Hide Users and Groups from the Global Address List on Exchange/Office 365

March 15, 2024

How to Hide Users and Groups from the Global Address List on Exchange/Office 365

In this article, we’ll look at how to hide a user or distribution group from the Exchange Global Address List (GAL). This guide applies to both the cloud Exchange Online (Microsoft 365) tenant and on-premises Exchange Server 2019/2016/2013, and 2010 organizations.

Contents:
  • Hide Groups and Users from Exchange or Office 365 GAL
  • Hide Users in Address Book when Using Azure AD Connect
  • How to Hide Users from Exchange Distribution Group?

Hide Groups and Users from Exchange or Office 365 GAL

In Exchange Online (Microsoft 365) and on-prem Exchange Server, all users, contacts, and distribution groups are automatically added to the organization’s address book. Any user can see all mail users and groups in their organization in Outlook, as well as their membership.

You can hide any user or group from the Exchange address book by using the Hide from address list option. This option can be enabled in the user’s properties through the Exchange Admin Center (EAC).

Exchange Admin Center - Hide user or group from address list

Also yo can use PowerShell to hide a user in the GAL:

Set-Mailbox -Identity jsmith -HiddenFromAddressListsEnabled $true

You can display all users hidden from the address book:

Get-Mailbox -ResultSize Unlimited | Where {$_.HiddenFromAddressListsEnabled -eq $True} | Select DisplayName,UserPrincipalName, HiddenFromAddressListsEnabled

Set-Mailbox HiddenFromAddressListsEnabled using powershell

Similarly, you can hide other types of objects from the address list:

  • Contacts: Set-MailContact ext24Support -HiddenFromAddressListsEnabled $true
  • Mail-enabled universal distribution and security groups: Set-DistributionGroup global_support -HiddenFromAddressListsEnabled $true
  • Exchange Dynamic Distribution Lists: Set-DynamicDistributionGroup nySales -HiddenFromAddressListsEnabled $true
  • Microsoft 365 Groups: Set-UnifiedGroup groupname1 -HiddenFromAddressListsEnabled:$true

Users and groups will be hidden from the address book after the GAL is updated (may take up to 24 hours).

The following command will list all hidden objects in the address book:

Get-Recipient -ResultSize unlimited -Filter 'HiddenFromAddressListsEnabled -eq $true'
To export the Exchange address book to a CSV file, run:

Get-Recipient -RecipientPreviewFilter $filter | Where-Object {$_.HiddenFromAddressListsEnabled -ne $true} | Select-Object Name,PrimarySmtpAddress, Phone | Export-CSV c:\ps\GAL_except_hidden.csv –NoTypeInformation

You can use a simple PowerShell script to hide disabled users from the Address List:

$mailboxes = get-user | where {$_.UserAccountControl -like '*AccountDisabled*' -and $_.RecipientType -eq 'UserMailbox' } | get-mailbox  | where {$_.HiddenFromAddressListsEnabled -eq $false}
foreach ($mailbox in $mailboxes) {Set-Mailbox -HiddenFromAddressListsEnabled $true -Identity $mailbox}

In Exchange Online, you can use the following command to find disabled user mailboxes:

Get-MailBox -filter {ExchangeUserAccountControl -eq 'AccountDisabled' -and RecipientType -eq 'UserMailbox' -and RecipientTypeDetails -ne 'SharedMailbox' }

Hide Users in Address Book when Using Azure AD Connect

If user mailboxes are hosted in Exchange Online (Microsoft 365), and user accounts are synchronized from on-premises Active Directory (via Azure AD Connect), you won’t be able to enable the HiddenFromAddressListsEnabled attribute in user settings in Office 365 tenant. If you try to do this via EAC, an error will appear:

The operation on mailbox failed because it’s out of the current users’s write scope. The action ‘Set-Mailbox’, ‘HiddenFromAddressListsEnabled’, can’t be performed on the object because the object is being synchronized from your on-premises organization. This action should be performed on the object in your on-premises organization.

mailbox operation failed - out of the current users’s write scope. The action ‘Set-Mailbox’, ‘HiddenFromAddressListsEnabled’, can’t be performed because the object is being synchronized from your on-premises organization

According to this error, the msExchHideFromAddressLists option must be enabled for the user in the local Active Directory and not on the Azure side. The easiest way is to use the Set-ADUser cmdlet from the AD PowerShell module:

Set-ADUser jsmith -Add @{msExchHideFromAddressLists="TRUE"}

After syncing a user to Azure and updating the GAL, the user’s email address will be hidden in the Office 365 address book.

The following command will list all disabled users that are not yet hidden:

Get-ADUser  -Filter {(enabled -eq "false") -and (msExchHideFromAddressLists -notlike "*")}  -Properties enabled,msExchHideFromAddressLists

If Exchange has never been installed in your on-prem Active Directory, then you won’t find the msExchHideFromAddressLists attribute (and others msExch* attributes) in the user properties. In this case, you will have to extend the Active Directory schema using the Exchange installation media.

How to Hide Users from Exchange Distribution Group?

By default, Outlook and OWA users can view the list of members of the Distribution Group in your Exchange organization. You can prevent the membership of a distribution group from being displayed in the Outlook Global Address List. This can be achieved by using the hideDLMembership attribute of Active Directory groups. This attribute prohibits expanding the list of users in a distribution group.

The list of users in a group is also not displayed for Dynamic Distribution Groups. Such groups are dynamically updated according to the specified LDAP query. But this solution does not suit all purposes and is not flexible enough.

You can enable the hideDLMembership attribute in the group properties in the Active Directory Users and Computers (ADUC) console:

  1. Open the ADUC console (dsa.msc);
  2. Enable the Advanced Features option in the View menu;
  3. Manually find a Distribution or a Mail-Enabled Security Group;
    Tip. Don’t use AD search, since there will be no Attribute Editor tab in the group properties.
  4. Open the properties of the necessary group and go to the Attribute Editor tab;
  5. Find the hideDLMembership attribute and change its value to True. Save the changes.hideDLMembership
You can change this AD group attribute via PowerShell:

Set-ADGroup –id corp_admins -replace @{hideDLMembership=$true}

The changes you have made will take effect after Exchange regenerates the Global Address List or Offline Address Book, and Outlook users download it.

mail group in Offline Address Book with hidden membership

As a result, the list of users in the distribution list will no longer be displayed in the Outlook Address Book properties window. The same is true for OWA.

owa hide users

And when you try to expand a distribution list in Outlook, an error will appear:

Cannot perform the requested operation. The command selected is not valid for this recipient. The operation failed.

expand a distribution list in Outlook - Cannot perform the requested operation. The command selected is not valid for this recipient

0 comment
3
Facebook Twitter Google + Pinterest
Azure and Microsoft 365ExchangeMicrosoft OfficePowerShell
previous post
How to Backup (Export) Installed Drivers from Windows
next post
Writing Output to Log Files in PowerShell Script

Related Reading

Outlook Keeps Asking for Password on Windows

March 17, 2024

Get a List of Mailboxes a User Has...

March 15, 2024

How to Cleanup, Truncate or Move Log Files...

March 17, 2024

How to Delete or Rename Default Mailbox Database...

March 17, 2024

Fix: Microsoft Outlook Search Not Working on Windows...

March 17, 2024

Search and Delete Emails from User Mailboxes on...

March 15, 2024

Export Exchange or Office 365 Global Address List...

March 15, 2024

Sending Email with SMTP Authentication via Telnet or...

March 12, 2024

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Recent Posts

  • Map a Network Drive over SSH (SSHFS) in Windows

    May 13, 2025
  • Configure NTP Time Source for Active Directory Domain

    May 6, 2025
  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025
  • AD Domain Join: Computer Account Re-use Blocked

    March 11, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • Outlook Keeps Asking for Password on Windows
  • Checking User Sign-in Logs in Entra ID (Microsoft 365)
  • How to Manually Configure Exchange or Microsoft 365 Account in Outlook 365/2019/2016
  • Search and Delete Emails from User Mailboxes on Exchange Server (Microsoft 365) with PowerShell
  • Fix: Microsoft Outlook Search Not Working on Windows 10/11
  • Blank Sign-in Screen in Office 365 Apps (Outlook, Teams, etc.)
  • Removing Built-in Teams Chat in Windows 11
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top