Keeping the Global Address List (GAL) clean is an important part of Microsoft 365 administration. Organizations often need to hide service accounts, privileged administrative identities, backend automation mailboxes, and inactive accounts to reduce user confusion and improve directory hygiene.
However, in hybrid Exchange environments, hiding a mailbox from the GAL is rarely as straightforward as it should be. Many administrators unknowingly make the change in Exchange Online when the mailbox is actually synchronized from on-premises Active Directory, resulting in “Out of Write Scope” errors or settings that automatically revert after synchronization. This article walks through the complete process of hiding users and mailboxes from the GAL.
What is the Global Address List (GAL)?
To better understand why these issues occur, let’s first look at what the Global Address List (GAL) actually is. The Global Address List is a shared electronic address book that contains contact information for every user, group, shared mailbox, resource, and external contact within a Microsoft 365 organization.
When an employee opens Microsoft Outlook or Outlook on the Web and creates a new email, the auto-complete search functionality pulls directly from the GAL. It acts as the central directory for company-wide communication.
Why Do You Need to Hide Objects from the GAL?
While transparency across an organization is usually ideal, administrators frequently need to hide specific accounts to maintain security and directory cleanliness:
Service Accounts: Automated background accounts used for software integrations do not need to receive user emails.
Shared Mailboxes for Internal Automation: Mailboxes set up strictly for backend processes or system logs should be hidden to prevent users from accidentally messaging them.
Sensitive Personnel Roles: Terminated employees, executive test accounts, or contractors under non-disclosure agreements often need to be restricted from public view.
How to Hide Users from the Global Address List in Exchange
Learn how to hide mailboxes and user accounts from the Global Address List (GAL) in both Exchange Online and hybrid Microsoft 365 environments
Option A: Cloud-Only Environment
To hide a user or mailbox from the Global Address List (GAL) in Exchange Online, use the Exchange admin center or the Exchange Online PowerShell V3 module. This prevents the account from showing up in Outlook and Teams address searches.
Method 1: Using the Exchange Admin Center (EAC)
- Log in to the Exchange admin center using your Administrator credentials.
- In the left navigation menu, go to Recipients > Mailboxes.
- Click the name of the user or shared mailbox you want to hide.
- In the settings pane that opens, click the General tab, and locate the Hide from address lists option and click Manage hide from GAL.
- Toggle the setting to On (or check the box) and click Save.
Method 2: Using Exchange Online PowerShell
If you need to hide accounts in bulk or prefer the command line, connect to Exchange Online PowerShell and run the following command:
Set-Mailbox -Identity "UserAlias@domain.com" -HiddenFromAddressListsEnabled:$true To hide multiple mailboxes at once, you can run:
Get-Mailbox -RecipientTypeDetails UserMailbox | Where-Object {$_.Department -eq "SalesDept"} | Set-Mailbox -HiddenFromAddressListsEnabled:$trueOption B: Hybrid Environment (On-Premises AD Sync)
In hybrid environments synchronized with Microsoft Entra Connect, the mailbox visibility setting must be managed from on-premises Active Directory. Attempting to change the setting directly in Exchange Online may result in “Out of Write Scope” errors or overwritten configurations after synchronization.
Method 1: Using Active Directory Users and Computers (ADUC)
- Launch Active Directory Users and Computers on your on-premises domain controller.
- In the top menu, click View and ensure Advanced Features is checked.
- Find the user account you want to hide, right-click it, and select Properties.
- Go to the Attribute Editor tab.
- Scroll down to find the msExchHideFromAddressLists attribute. Double-click it and set the value to True.
- Ensure the mailNickname attribute is populated with an alias (usually the part before the ‘@’ in their email). If this is blank, the sync to Exchange Online might fail.
- Click OK to close the properties. Trigger a delta sync on your Entra Connect server by running the following command in PowerShell as an administrator:
Start-ADSyncSyncCycle -PolicyType DeltaMethod 2: Using Active Directory PowerShell
For hybrid infrastructures, you must use the ActiveDirectory PowerShell module targeted at your on-premises domain controller.
Prerequisites: Remote Server Administration Tools (RSAT) with Active Directory Module
# Step 1: Hide the user account via the on-premises attribute
Set-ADUser -Identity 'serviceaccount' -Replace @{msExchHideFromAddressLists = $true}
# Step 2: Ensure mailNickname is populated (required by Entra Connect to process GAL changes)
Set-ADUser -Identity 'serviceaccount' -Replace @{mailNickname = 'serviceaccount'}
# Step 3: Trigger a delta sync to push the changes to Exchange Online
Start-ADSyncSyncCycle -PolicyType Delta Note: If your on-premises Active Directory lacks the msExchHideFromAddressLists attribute, you may need to extend your local AD schema with the Exchange Server installation media before this command will work.
The Complexity of Standard Microsoft Tools
Managing GAL visibility in Microsoft 365 often becomes more complicated than expected, especially in hybrid Exchange environments where settings, synchronization, and source of authority all play a role.
1. Hidden Settings in Exchange Online
In the Exchange Admin Center (EAC), the Hide from address lists option is buried inside mailbox settings, making it difficult to find and manage efficiently.
2. Hybrid Environment Problems
- In hybrid environments, the on-premises Active Directory object remains the source of authority.
- Direct changes made in Exchange Online may be overwritten during the next synchronization cycle.
- Missing
msExchHideFromAddressListsattributes may require extending the Active Directory schema using Exchange Server schema extensions. - Additionally, GAL visibility changes can take time to replicate across Microsoft 365 services and Offline Address Books (OAB).
Why EasyEntra Works Better for Hiding Users from GAL
EasyEntra removes the guesswork, PowerShell scripting, and hybrid synchronization confusion involved in managing GAL visibility. Instead of switching between Active Directory Users and Computers, Exchange admin center, synchronization tools, and PowerShell sessions, administrators can manage everything from a single interface.
For cloud-only mailboxes, EasyEntra updates Exchange Online directly. For traditional synchronized hybrid identities, EasyEntra writes changes to the on-premises msExchHideFromAddressLists attribute.
For organizations using Microsoft’s new Exchange Online source-of-authority model, EasyEntra fully supports cloud-managed Exchange attributes and automatically reads from and writes to the configured authority. This ensures administrators always update the correct location without needing to manually determine whether the object is managed on-premises or in the cloud.
As a result, EasyEntra helps prevent:
- Synchronization overwrites,
- “Out of Write Scope” errors,
- Incorrect attribute modifications,
- Inconsistent GAL visibility states.
How to Hide a Mailbox with EasyEntra
Follow the below steps to automatically hide users from GAL in Exchange Online.
- Open the target User, Group, or Contact properties within the EasyEntra dashboard.
- Click over to the Mailbox tab.
- Check the Hide from address lists box.
- Click OK.
The result is a significantly faster and more reliable administrative workflow with no manual attribute editing or PowerShell dependency.
