How to Bulk Update SMTP Addresses for Azure AD Connect Users
Question details
IT administrators need to bulk update SMTP proxy addresses for users synchronized via Azure AD Connect without encountering write scope errors.
- Product
- Azure AD Connect / Exchange Online
- Device & OS
- not provided
- Scenario
- Attempting to bulk modify user email addresses (SMTP) for directory-synced users in a hybrid Exchange environment.
- Observed behavior
- Updating directly in Exchange Online fails with an error stating the action cannot be performed because the object is synchronized from the on-premises organization and is outside the current user's write scope.
Ensure you have Domain Admin or Account Operator privileges in your on-premises Active Directory environment, and that your Azure AD Connect synchronization service is functioning properly.
Update On-Premises Active Directory via PowerShell
Because Azure AD Connect users are managed on-premises, you must update their proxy addresses in your local AD using PowerShell, then force or wait for a directory sync.
When Azure AD Connect is active, Exchange Online disables direct editing of core identity attributes like proxy addresses. The system expects the on-premises Active Directory to remain the source of authority.
To resolve the write scope error, you will need to export your target users, append the desired SMTP addresses locally, and let Azure AD connect sync the changes up to Microsoft 365.
Launch PowerShell with administrative privileges on your domain controller or a server with the Active Directory module installed.
Run the command: Get-ADUser -SearchBase "OU=Test,DC=domain,DC=com" -Filter * -Properties * | Select AccountName | Export-Csv C:\users.csv. Replace the SearchBase path with the actual Distinguished Name of your Organizational Unit.
Open the generated users.csv file on your C: drive to ensure only the intended user accounts are listed under the AccountName column.
Execute the following script to add the new proxy addresses: Import-Csv C:\users.csv | ForEach-Object { Set-ADUser -Identity $_.AccountName -Add @{ProxyAddresses="SMTP:" + $_.AccountName + "@domain.com"} }. Adjust the domain suffix as needed.
Wait for the standard 30-minute sync cycle, or manually force a delta sync by running Start-ADSyncSyncCycle -PolicyType Delta on your Azure AD Connect server.
Looking for a Lightweight Office Suite for Your Enterprise?
While managing Exchange Online and Azure AD requires specialized Microsoft administrative tools, your everyday document editing doesn't have to rely on heavy, expensive software. WPS Office provides a robust, fully compatible alternative for creating documents, spreadsheets, and presentations.
- 1. Visit the official WPS Office website: Go to the official WPS download page to access the latest secure enterprise or personal installers.
- 2. Download the installer: Select the appropriate version for your operating system (Windows, macOS, or Linux) and click download.
- 3. Install and transition seamlessly: Follow the installation wizard prompts. Once installed, WPS Office will instantly recognize and smoothly open your existing Microsoft Office files.
Frequently Asked Questions
Why do I get a "write scope" error when changing an SMTP address in Exchange Online?
This error occurs because the user account is synchronized from an on-premises Active Directory using Azure AD Connect. By design, Microsoft requires all identity modifications for synchronized accounts to be performed in the source on-premises environment.
How long does it take for the on-premises SMTP changes to reflect in Microsoft 365?
Azure AD Connect typically synchronizes delta changes every 30 minutes. You can also manually trigger a delta sync cycle using the Start-ADSyncSyncCycle -PolicyType Delta PowerShell command to apply changes immediately.
Can I add multiple proxy addresses to a single user via PowerShell?
Yes. You can append multiple addresses by adding them to the ProxyAddresses attribute. Just remember to use "smtp:" (lowercase) for secondary aliases and "SMTP:" (uppercase) for the single primary routing address.
