Exchange Online Contacts and Groups: Distribution Lists, Dynamic Groups, Microsoft 365 Groups, and Mail Contacts

An address book looks simple until you need to answer: should this list accept mail from outside? who owns it? how does a new starter get on it? can it contain people from other tenants? will it show up in the address book? The answers depend on the recipient type.

The Recipient Types

Type	What it is	Has a mailbox?	Typical use
Mail contact	An external email address shown in your address book	No	Partners, suppliers, customers you email often
Mail user	An external address with a sign-in in your tenant	No	A person with an outside address who signs in (for example, a contractor)
Distribution group	A fixed list that expands to members	No	Announcements to a known set of people
Dynamic distribution group	A list built at send time from attributes	No	"Everyone in Sales", "All US staff"
Microsoft 365 group	A collaboration group: mailbox, calendar, files, Teams	Yes (group mailbox)	A project team that needs shared work
Mail-enabled security group	A security group that also receives mail	No	Permissions plus email to the same people
Shared mailbox	A mailbox many people share	Yes	See shared mailboxes

Personal contacts (the *People* section of Outlook) are separate: they belong to one mailbox and follow the user across devices. Organization-wide address book entries come from the Global Address List (GAL), which includes users, groups, shared mailboxes, rooms, and mail contacts.

Which to Use

Need	Use
Email a fixed set of people	Distribution group
Membership should follow department, title, or location	Dynamic distribution group
People collaborate: files, calendar, conversations, Teams	Microsoft 365 group (or a Team)
Control access to a resource and also email the members	Mail-enabled security group
Answer from a single shared address	Shared mailbox
Make an outside person appear in the address book	Mail contact
Give an outside person sign-in rights	Guest user (Entra B2B), not a contact
Receive mail at one address and deliver to several mailboxes	Distribution group, or a shared mailbox with forwarding

Rule of thumb: a *distribution list* sends mail to people, a *Microsoft 365 group* gives people a place to work, and a *security group* gives people permission.

Mail Contacts and Mail Users

A mail contact has an external address and appears in the GAL, so users can find and select it.

Use contacts to:

• Put suppliers and partners in the address book.
• Add an outside address to a distribution group (a contact can be a group member, a guest cannot receive group mail in the same way unless it is a mail-enabled recipient).
• Give a shared mailbox a way to forward to a fixed outside address.

Keep contacts tidy. Stale contacts clutter the GAL and lead to mail going to the wrong person. Name them with the company, for example Alex Partner (Partner Co).

Mail users are different: they have an external address and a sign-in in your tenant. Create them when a person outside your company must sign in to your resources but has no mailbox with you. Often a guest user is a better fit.

Bulk import contacts:

Distribution Groups

Settings that matter:

• Owners (ManagedBy) decide who can manage membership. Always set at least two.
• Membership approval: -MemberJoinRestriction Open|Closed|ApprovalRequired and -MemberDepartRestriction. Open groups let anyone join; closed groups need an owner.
• Who can send: by default only authenticated (internal) senders can send to a group. Turn off RequireSenderAuthenticationEnabled only for groups meant to receive outside mail, such as a sales alias.
• Expansion: Exchange expands the list server-side when mail is sent. Members who leave stop receiving mail after the next sync.
• Nesting: groups can contain groups. This is flexible and can become hard to trace; keep it shallow and documented.
• Limits: Exchange Online has limits on recipients per message and per day, and on the size of a group. Check current limits before planning a mass mailing; a large announcement is better sent through a service built for it.

Dynamic Distribution Groups

Dynamic groups compute their membership from attributes each time mail is sent, so they never need manual updates.

Notes:

• Membership depends on directory attributes (department, title, office, custom attributes). Keep HR data in the directory clean or the group will be wrong.
• You cannot *edit* membership by hand. You change the filter.
• Dynamic groups work only for mailboxes and mail-enabled recipients inside Exchange Online. They cannot be used to assign permissions.
• Always preview before sending to a dynamic group that targets many people.
• They are slower to resolve than static lists. For very large dynamic groups, expect a delay.

Microsoft 365 Groups

A Microsoft 365 group (also called a unified group) gives a team a shared mailbox, calendar, a SharePoint site, a Planner, and optionally a Team. It is the building block for collaboration in Microsoft 365.

Points to know:

• Public or private. Public groups can be joined by anyone; private groups need an owner's approval.
• Guests can be added to Microsoft 365 groups, when guest access is enabled by policy.
• Group email. By default only members can send to a Microsoft 365 group, and outside senders need to be allowed explicitly with -RequireSenderAuthenticationEnabled $false.
• Expiration policy. Entra can expire unused groups. Review it to avoid accidentally losing a group.
• Naming policy can enforce prefixes or block words.
• Teams. Creating a Team creates a Microsoft 365 group behind it.
• Ownership. Every group needs at least two owners. Orphaned groups with no owner are a common problem.
• Cost. Groups need no license, but their members do.

A Microsoft 365 group's mailbox keeps a copy of messages sent to the group so members can view the conversation history, which suits project discussion better than a plain distribution list.

Mail-Enabled Security Groups and Access Control

A mail-enabled security group is a security group with an email address. Use it when you want to grant permissions (for example Full Access to a mailbox, or access to a SharePoint site) and also email the same people.

Things to know:

• You can mail-enable a security group only through Exchange, not by turning on the mail setting in Entra for cloud-only groups in every case. Verify behavior in your tenant.
• Security groups that are not mail-enabled cannot be used as Exchange permission targets in some commands. A mail-enabled one can.
• Use groups, not people, to grant mailbox permissions, so access follows membership. See delegate access.
• Keep a naming convention that separates mail lists from access groups (for example DL- for distribution and SG- for security).

External Senders, Moderation, and Spam

• Let outsiders email a list: Set-DistributionGroup -Identity sales-info -RequireSenderAuthenticationEnabled $false. Do this deliberately, and only for groups that need it. A public list will receive spam and can be used to relay it.
• Moderate a list so messages are approved first:

• Reject big groups for most users: restrict who can send to a company-wide list to a small set of people. This prevents accidental "reply all" storms to thousands of people.
• Reply-all storms. Exchange Online has reply-all storm protection that blocks runaway threads sent to large groups. Check the current thresholds and settings in Microsoft's documentation.
• Out-of-office replies to a group can be suppressed with -ReportToManagerEnabled and related options. Decide whether outsiders should see replies when sending to a list.

Hiding and Naming

Hide groups that should not appear in the address book, for example a group used for mailbox permissions:

Hidden groups still receive mail and still work for permissions. Use clear names: DL-AllStaff, DL-Sales, SG-Support-Access, M365-Project-Phoenix. A good convention saves hours when you are cleaning up later.

Address Lists and Offline Address Book

• Global Address List shows all mail-enabled objects not hidden.
• Custom address lists can be built from filters (for example one per office).
• Offline address book (OAB) is a downloadable copy that Outlook uses in cached mode. Changes take time to appear, often up to 24 hours or more, so a new contact may not be visible to cached Outlook users right away.
• Address book policies create separate address books for different groups of users, which is useful for multi-company tenants or hosted setups.

Lifecycle: Joiners, Movers, Leavers

Groups drift unless you tie them to HR events.

• Joiners: put new starters in the right dynamic groups by setting department and title correctly, and add them to static groups through a request.
• Movers: when someone changes department, review static group memberships.
• Leavers: remove them from groups, or the group's mail continues to land in their mailbox (which may be a shared mailbox or hold). Check group ownership too; a leaver who is the only owner leaves an orphaned group.
• Quarterly review: list groups with no owner, groups with outsiders as members, empty groups, and groups with a large membership.

Migrating and Syncing Groups

• In a hybrid environment, groups synced from on-premises Active Directory are managed on-premises. Edit them there, not in Exchange Online.
• Use Entra Connect attribute sync and check group writeback options if you want cloud groups to appear on-premises.
• When moving from another platform, export lists and recreate them as distribution groups or Microsoft 365 groups, and rebuild the rules that depended on them.

How to Check It Worked

• Send a message to the group from an internal account and confirm all members receive it.
• Send from an external account and confirm the result matches your setting (blocked or delivered).
• For dynamic groups, run the preview and compare it against HR data.
• Check that hidden groups do not show in the address book.
• Check that a removed member no longer receives mail.

Troubleshooting

Symptom	Likely cause
Outsiders get "delivery failed" sending to a list	RequireSenderAuthenticationEnabled is true
A member does not receive group mail	Membership change not synced, mailbox rules, or mail sent from a blocked address
Dynamic group has the wrong people	Directory attributes are wrong or the filter is too broad
New contact not visible in Outlook	Offline address book not yet refreshed
Cannot edit a group	It is synced from on-premises AD
Reply-all storm	Large group open to all senders. Restrict senders and rely on storm protection
Cannot use a group to grant permissions	It is a plain distribution group, not a security group
Group disappeared	Expiration policy or an owner deleted it. Check the deleted groups and restore within the window

A Short Decision Guide

• Fixed list of people: distribution group.
• Membership by attribute: dynamic distribution group.
• Collaboration space: Microsoft 365 group or Team.
• Permissions: mail-enabled security group.
• Outside address in the address book: mail contact.
• Outside person with sign-in: guest user.

Related guides: shared mailboxes, delegate access, and Exchange Online protection.

Cmdlet parameters, group limits, and Microsoft 365 group behavior change over time, and I have not run these commands in your tenant. Test with a pilot group and check Microsoft's current documentation. If you want help cleaning up groups and address lists, get in touch.