Exchange Connection Problems

How to Prevent Primary SMTP Addresses Changing to onmicrosoft.com

Huda Qurayshi Oct 9, 2026 869 views

Question details

The user needs to identify the root cause and stop primary SMTP addresses from automatically changing to the default onmicrosoft.com domain.

Prevent Primary SMTP Addresses Changing to onmicrosoft.com

Product: Microsoft 365 / Exchange Online
Device & OS: not provided
Scenario: Managing a hybrid Microsoft 365 environment where user email attributes are being altered unexpectedly.
Observed behavior: Some users' primary SMTP addresses are automatically changing to the onmicrosoft.com domain without any apparent configuration changes made in the on-premises Active Directory.

Before you start

Ensure you have Global Administrator or Exchange Administrator privileges in your Microsoft 365 tenant, and access to your on-premises Active Directory and Azure AD Connect servers.

Solution 1Recommended

Investigate Audit Logs and Azure AD Connect Configuration

Identify unauthorized or automated changes by reviewing Microsoft Entra audit logs and verifying your synchronization rules.

In a hybrid environment, the primary SMTP address should be controlled by the on-premises Active Directory. If changes are occurring in the cloud, they are likely triggered by a misconfigured sync rule, a service principal, or an automated script.

Review Microsoft Entra Audit Logs

Navigate to the Azure portal and check the audit logs for updates to user accounts. Look for changes to email attributes where there is no associated initiating user, which often indicates an automated process or service principal.

Verify Azure AD Connect Sync Rules

Open the Synchronization Rules Editor on your Azure AD Connect server. Ensure that the attribute mappings and filtering settings correctly synchronize the proxyAddresses attribute from the on-premises Active Directory to the cloud.

Check On-Premises proxyAddresses

In your on-premises Active Directory Users and Computers (ADUC), ensure that the primary SMTP address (capital 'SMTP:') is correctly configured in the proxyAddresses attribute for the affected users.

Investigate Audit Logs and Azure AD Connect Configuration

Audit Log Permissions: Verify that the account you are using to view the Azure AD connection and audit logs has the appropriate read permissions assigned in Microsoft Entra.

Solution 2

Review Service Principals and Third-Party Applications

Check for external applications or provisioning tools that might be making unauthorized changes to user attributes.

Free Microsoft Office alternative

Looking for a Lightweight Office Suite? Try WPS Office

While troubleshooting complex Exchange and Microsoft 365 hybrid server environments, you need a reliable desktop office suite for your daily document productivity. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office that works seamlessly across Windows, Mac, and Linux.

1. Download the Installer: Visit the official WPS Office website and download the installation package for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the simple on-screen instructions to set up the software.
3. Open and Edit Your Documents: Launch WPS Office and immediately start opening, editing, and saving your existing Microsoft Office files with full format compatibility.

Free and lightweight alternative to Microsoft OfficeFully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Familiar and intuitive user interface for seamless migration without a learning curveBuilt-in PDF editor and AI assistance for advanced workflow productivity

microsoft office alternative - wps office

Frequently Asked Questions

Why do primary SMTP addresses suddenly change to onmicrosoft.com in a hybrid setup?

This typically occurs due to misconfigured Azure AD Connect synchronization rules, third-party identity provisioning tools overwriting attributes, or automated scripts operating via a service principal that reset the proxyAddresses attribute to the tenant's default routing domain.

How can I tell if an automated script caused the SMTP address change?

You can determine this by reviewing the Microsoft Entra audit logs. If the log entry detailing the attribute update shows no associated human initiating user, it was likely executed by a service principal, automated background process, or script.

Should I manage email addresses in Exchange Online or on-premises Active Directory?

In a hybrid Microsoft 365 environment with directory synchronization enabled, all user attributes, including the primary SMTP address (managed via the proxyAddresses attribute), must be managed in the on-premises Active Directory and synchronized to the cloud.

Outlook & Email Problems