Key takeaway: "Contacts and distribution lists" covers five distinct recipient types in Exchange Online: mail contacts, mail users, distribution groups, dynamic distribution groups, Microsoft 365 groups, and mail-enabled security groups. Choosing the wrong type is the most common reason a list does not receive mail from outsiders, cannot be managed, or turns into a security problem. This guide explains each type, when to use it, how to create and restrict it, how groups interact with licensing, moderation, and external senders, how to hide and audit them, and how to use groups for access control.
In This Article
- The Recipient Types
- Which to Use
- Mail Contacts and Mail Users
- Distribution Groups
- Dynamic Distribution Groups
- Microsoft 365 Groups
- Mail-Enabled Security Groups and Access Control
- External Senders, Moderation, and Spam
- Hiding and Naming
- Address Lists and Offline Address Book
- Lifecycle: Joiners, Movers, Leavers
- Migrating and Syncing Groups
- How to Check It Worked
- Troubleshooting
- A Short Decision Guide
An address book looks simple until you need to answer: should this list accept mail from outside? who owns it? how does a new starter get on it? can it contain people from other tenants? will it show up in the address book? The answers depend on the recipient type.
The Recipient Types
| Type | What it is | Has a mailbox? | Typical use |
|---|---|---|---|
| Mail contact | An external email address shown in your address book | No | Partners, suppliers, customers you email often |
| Mail user | An external address with a sign-in in your tenant | No | A person with an outside address who signs in (for example, a contractor) |
| Distribution group | A fixed list that expands to members | No | Announcements to a known set of people |
| Dynamic distribution group | A list built at send time from attributes | No | "Everyone in Sales", "All US staff" |
| Microsoft 365 group | A collaboration group: mailbox, calendar, files, Teams | Yes (group mailbox) | A project team that needs shared work |
| Mail-enabled security group | A security group that also receives mail | No | Permissions plus email to the same people |
| Shared mailbox | A mailbox many people share | Yes | See shared mailboxes |
Personal contacts (the *People* section of Outlook) are separate: they belong to one mailbox and follow the user across devices. Organization-wide address book entries come from the Global Address List (GAL), which includes users, groups, shared mailboxes, rooms, and mail contacts.
Which to Use
| Need | Use |
|---|---|
| Email a fixed set of people | Distribution group |
| Membership should follow department, title, or location | Dynamic distribution group |
| People collaborate: files, calendar, conversations, Teams | Microsoft 365 group (or a Team) |
| Control access to a resource and also email the members | Mail-enabled security group |
| Answer from a single shared address | Shared mailbox |
| Make an outside person appear in the address book | Mail contact |
| Give an outside person sign-in rights | Guest user (Entra B2B), not a contact |
| Receive mail at one address and deliver to several mailboxes | Distribution group, or a shared mailbox with forwarding |
Rule of thumb: a *distribution list* sends mail to people, a *Microsoft 365 group* gives people a place to work, and a *security group* gives people permission.
Mail Contacts and Mail Users
A mail contact has an external address and appears in the GAL, so users can find and select it.
New-MailContact -Name "Alex Partner" -ExternalEmailAddress alex@partner.com -DisplayName "Alex Partner (Partner Co)"
Set-MailContact "Alex Partner" -HiddenFromAddressListsEnabled $false
Get-MailContact | Format-Table DisplayName, ExternalEmailAddress, HiddenFromAddressListsEnabledUse contacts to:
- Put suppliers and partners in the address book.
- Add an outside address to a distribution group (a contact can be a group member, a guest cannot receive group mail in the same way unless it is a mail-enabled recipient).
- Give a shared mailbox a way to forward to a fixed outside address.
Keep contacts tidy. Stale contacts clutter the GAL and lead to mail going to the wrong person. Name them with the company, for example Alex Partner (Partner Co).
Mail users are different: they have an external address and a sign-in in your tenant. Create them when a person outside your company must sign in to your resources but has no mailbox with you. Often a guest user is a better fit.
Bulk import contacts:
Import-Csv .\contacts.csv | ForEach-Object {
New-MailContact -Name $_.Name -ExternalEmailAddress $_.Email -DisplayName $_.Name
}Distribution Groups
# Create
New-DistributionGroup -Name "Team Leaders" -Alias team-leaders -PrimarySmtpAddress team-leaders@contoso.com `
-Type Distribution -Members jsmith@contoso.com, asmith@contoso.com `
-ManagedBy jsmith@contoso.com
# Only internal senders may send
Set-DistributionGroup -Identity "Team Leaders" -RequireSenderAuthenticationEnabled $true
# Allow only named senders
Set-DistributionGroup -Identity "Team Leaders" -AcceptMessagesOnlyFromSendersOrMembers "jsmith@contoso.com"
# Add and remove members
Add-DistributionGroupMember -Identity "Team Leaders" -Member bjones@contoso.com
Remove-DistributionGroupMember -Identity "Team Leaders" -Member bjones@contoso.com -Confirm:$false
Get-DistributionGroupMember -Identity "Team Leaders" | Format-Table DisplayName, PrimarySmtpAddressSettings that matter:
- Owners (
ManagedBy) decide who can manage membership. Always set at least two. - Membership approval:
-MemberJoinRestriction Open|Closed|ApprovalRequiredand-MemberDepartRestriction. Open groups let anyone join; closed groups need an owner. - Who can send: by default only authenticated (internal) senders can send to a group. Turn off
RequireSenderAuthenticationEnabledonly for groups meant to receive outside mail, such as a sales alias. - Expansion: Exchange expands the list server-side when mail is sent. Members who leave stop receiving mail after the next sync.
- Nesting: groups can contain groups. This is flexible and can become hard to trace; keep it shallow and documented.
- Limits: Exchange Online has limits on recipients per message and per day, and on the size of a group. Check current limits before planning a mass mailing; a large announcement is better sent through a service built for it.
Dynamic Distribution Groups
Dynamic groups compute their membership from attributes each time mail is sent, so they never need manual updates.
New-DynamicDistributionGroup -Name "Field Engineers" -Alias field-engineers `
-RecipientFilter "(Department -eq 'Field Engineering') -and (RecipientTypeDetails -eq 'UserMailbox')"
# Preview who is in it
$g = Get-DynamicDistributionGroup "Field Engineers"
Get-Recipient -RecipientPreviewFilter $g.RecipientFilter | Format-Table Name, PrimarySmtpAddressNotes:
- Membership depends on directory attributes (department, title, office, custom attributes). Keep HR data in the directory clean or the group will be wrong.
- You cannot *edit* membership by hand. You change the filter.
- Dynamic groups work only for mailboxes and mail-enabled recipients inside Exchange Online. They cannot be used to assign permissions.
- Always preview before sending to a dynamic group that targets many people.
- They are slower to resolve than static lists. For very large dynamic groups, expect a delay.
Microsoft 365 Groups
A Microsoft 365 group (also called a unified group) gives a team a shared mailbox, calendar, a SharePoint site, a Planner, and optionally a Team. It is the building block for collaboration in Microsoft 365.
New-UnifiedGroup -DisplayName "Project Phoenix" -Alias project-phoenix -AccessType Private `
-Owners jsmith@contoso.com -Members jsmith@contoso.com, asmith@contoso.com
Set-UnifiedGroup -Identity project-phoenix -UnifiedGroupWelcomeMessageEnabled:$false -HiddenFromExchangeClientsEnabled:$false
Get-UnifiedGroupLinks -Identity project-phoenix -LinkType MembersPoints to know:
- Public or private. Public groups can be joined by anyone; private groups need an owner's approval.
- Guests can be added to Microsoft 365 groups, when guest access is enabled by policy.
- Group email. By default only members can send to a Microsoft 365 group, and outside senders need to be allowed explicitly with
-RequireSenderAuthenticationEnabled $false. - Expiration policy. Entra can expire unused groups. Review it to avoid accidentally losing a group.
- Naming policy can enforce prefixes or block words.
- Teams. Creating a Team creates a Microsoft 365 group behind it.
- Ownership. Every group needs at least two owners. Orphaned groups with no owner are a common problem.
- Cost. Groups need no license, but their members do.
A Microsoft 365 group's mailbox keeps a copy of messages sent to the group so members can view the conversation history, which suits project discussion better than a plain distribution list.
Mail-Enabled Security Groups and Access Control
A mail-enabled security group is a security group with an email address. Use it when you want to grant permissions (for example Full Access to a mailbox, or access to a SharePoint site) and also email the same people.
New-DistributionGroup -Name "SM-Support-Members" -Type Security -Members asmith@contoso.com, bjones@contoso.comThings to know:
- You can mail-enable a security group only through Exchange, not by turning on the mail setting in Entra for cloud-only groups in every case. Verify behavior in your tenant.
- Security groups that are not mail-enabled cannot be used as Exchange permission targets in some commands. A mail-enabled one can.
- Use groups, not people, to grant mailbox permissions, so access follows membership. See delegate access.
- Keep a naming convention that separates mail lists from access groups (for example
DL-for distribution andSG-for security).
External Senders, Moderation, and Spam
- Let outsiders email a list:
Set-DistributionGroup -Identity sales-info -RequireSenderAuthenticationEnabled $false. Do this deliberately, and only for groups that need it. A public list will receive spam and can be used to relay it. - Moderate a list so messages are approved first:
Set-DistributionGroup -Identity "All Staff" -ModerationEnabled $true -ModeratedBy "hr@contoso.com" `
-BypassModerationFromSendersOrMembers "ceo@contoso.com"- Reject big groups for most users: restrict who can send to a company-wide list to a small set of people. This prevents accidental "reply all" storms to thousands of people.
- Reply-all storms. Exchange Online has reply-all storm protection that blocks runaway threads sent to large groups. Check the current thresholds and settings in Microsoft's documentation.
- Out-of-office replies to a group can be suppressed with
-ReportToManagerEnabledand related options. Decide whether outsiders should see replies when sending to a list.
Hiding and Naming
Hide groups that should not appear in the address book, for example a group used for mailbox permissions:
Set-DistributionGroup -Identity "SM-Support-Members" -HiddenFromAddressListsEnabled $trueHidden groups still receive mail and still work for permissions. Use clear names: DL-AllStaff, DL-Sales, SG-Support-Access, M365-Project-Phoenix. A good convention saves hours when you are cleaning up later.
Address Lists and Offline Address Book
- Global Address List shows all mail-enabled objects not hidden.
- Custom address lists can be built from filters (for example one per office).
- Offline address book (OAB) is a downloadable copy that Outlook uses in cached mode. Changes take time to appear, often up to 24 hours or more, so a new contact may not be visible to cached Outlook users right away.
- Address book policies create separate address books for different groups of users, which is useful for multi-company tenants or hosted setups.
Lifecycle: Joiners, Movers, Leavers
Groups drift unless you tie them to HR events.
- Joiners: put new starters in the right dynamic groups by setting department and title correctly, and add them to static groups through a request.
- Movers: when someone changes department, review static group memberships.
- Leavers: remove them from groups, or the group's mail continues to land in their mailbox (which may be a shared mailbox or hold). Check group ownership too; a leaver who is the only owner leaves an orphaned group.
- Quarterly review: list groups with no owner, groups with outsiders as members, empty groups, and groups with a large membership.
Get-DistributionGroup -ResultSize Unlimited | Where-Object { -not $_.ManagedBy } | Select DisplayName, PrimarySmtpAddress
Get-UnifiedGroup -ResultSize Unlimited | Where-Object { -not $_.ManagedBy } | Select DisplayName
Get-DistributionGroup -ResultSize Unlimited | Where-Object { $_.RequireSenderAuthenticationEnabled -eq $false } | Select DisplayNameMigrating and Syncing Groups
- In a hybrid environment, groups synced from on-premises Active Directory are managed on-premises. Edit them there, not in Exchange Online.
- Use Entra Connect attribute sync and check group writeback options if you want cloud groups to appear on-premises.
- When moving from another platform, export lists and recreate them as distribution groups or Microsoft 365 groups, and rebuild the rules that depended on them.
How to Check It Worked
- Send a message to the group from an internal account and confirm all members receive it.
- Send from an external account and confirm the result matches your setting (blocked or delivered).
- For dynamic groups, run the preview and compare it against HR data.
- Check that hidden groups do not show in the address book.
- Check that a removed member no longer receives mail.
Troubleshooting
| Symptom | Likely cause |
|---|---|
| Outsiders get "delivery failed" sending to a list | RequireSenderAuthenticationEnabled is true |
| A member does not receive group mail | Membership change not synced, mailbox rules, or mail sent from a blocked address |
| Dynamic group has the wrong people | Directory attributes are wrong or the filter is too broad |
| New contact not visible in Outlook | Offline address book not yet refreshed |
| Cannot edit a group | It is synced from on-premises AD |
| Reply-all storm | Large group open to all senders. Restrict senders and rely on storm protection |
| Cannot use a group to grant permissions | It is a plain distribution group, not a security group |
| Group disappeared | Expiration policy or an owner deleted it. Check the deleted groups and restore within the window |
A Short Decision Guide
- Fixed list of people: distribution group.
- Membership by attribute: dynamic distribution group.
- Collaboration space: Microsoft 365 group or Team.
- Permissions: mail-enabled security group.
- Outside address in the address book: mail contact.
- Outside person with sign-in: guest user.
Related guides: shared mailboxes, delegate access, and Exchange Online protection.
Cmdlet parameters, group limits, and Microsoft 365 group behavior change over time, and I have not run these commands in your tenant. Test with a pilot group and check Microsoft's current documentation. If you want help cleaning up groups and address lists, get in touch.