How to Add an Exchange Online Shared Mailbox to an On-Premises Security Group
Question details
The user needs to add a cloud-created Exchange Online shared mailbox to the allowed-senders list of an on-premises synchronized mail-enabled security group.
- Product
- Exchange Online
- Device & OS
- not provided
- Scenario
- Managing allowed senders for on-premises synchronized mail-enabled security groups in a hybrid Exchange environment.
- Observed behavior
- A shared mailbox created directly in Exchange Online cannot be added to the allowed-senders list of a synchronized on-premises security group.
Ensure you have administrative access to both the on-premises Exchange Server and the Exchange Online admin center, and verify that Azure AD Connect synchronization is functioning properly.
Create Shared Mailbox On-Premises and Migrate to Exchange Online
To bypass the synchronization limitation, create the shared mailbox in your on-premises environment, configure its group permissions, and then migrate it to the cloud.
In a hybrid Exchange environment, on-premises security groups must be managed locally. Because the group is synchronized from the local Active Directory, it cannot accept a cloud-native shared mailbox as an allowed sender. The solution is to originate the mailbox on-premises so its AD object can be manipulated locally before being moved to the cloud.
Use the on-premises Exchange Admin Center (EAC) or Exchange Management Shell to create a new shared mailbox locally.
While the mailbox is still on-premises, open the properties of the synchronized mail-enabled security group and add the new shared mailbox to its allowed-senders list.
Run an Azure AD Connect synchronization cycle to ensure the associated disabled Active Directory user object is synced to Microsoft 365.
Log into the Exchange Online admin center and create a migration batch to move the on-premises shared mailbox to Exchange Online.
After the migration is fully completed, verify the mailbox settings in Exchange Online and reassign 'Send As' or 'Full Access' permissions to the appropriate users if necessary.
Manage Your IT Documentation Efficiently with WPS Office
While troubleshooting complex Exchange hybrid deployments, streamline your IT documentation, reports, and administrative spreadsheets using WPS Office. It is a free, lightweight, and highly compatible alternative to Microsoft Office.
- 1. Download the installer: Visit the official WPS Office website and download the free version for your operating system.
- 2. Install WPS Office: Run the setup file and follow the on-screen prompts to complete the installation in minutes.
- 3. Open your IT documents: Launch WPS Office and directly open your existing Microsoft Office files without worrying about formatting issues.
Frequently Asked Questions
Can I add an Exchange Online mailbox to an on-premises group via PowerShell?
No. If the security group is synchronized from your on-premises Active Directory, its membership and allowed-senders lists are locked in the cloud. You must make these changes on-premises using objects that exist in the local AD.
What happens if I disable Azure AD sync for the shared mailbox's disabled user account?
If the disabled user account in the local Active Directory is excluded from Azure AD Connect synchronization, Azure AD assumes the object was deleted and will subsequently delete the corresponding shared mailbox in Exchange Online.
Do I lose mailbox permissions during the migration to Exchange Online?
Permissions can sometimes be affected during cross-premises migrations. It is highly recommended to verify and reassign 'Send As' and 'Full Access' permissions in the Exchange Online admin center after the migration completes.
