Quick answer: For a cloud-managed mailbox, hide the recipient in the Microsoft 365 admin center, Exchange admin center or Exchange Online PowerShell by setting HiddenFromAddressListsEnabled to True. For a directory-synchronized mailbox, first confirm where its Exchange attributes are managed: traditional hybrid environments manage them on-premises, while mailboxes specifically configured with cloud Exchange-attribute management can be changed in Exchange Online. After the change, verify the recipient setting before troubleshooting Outlook caching or AutoComplete.
Introduction
When I first started managing Exchange environments, I remember the confusion on my colleagues’ faces when some email addresses “disappeared” from the company directory.
As an administrator, I was asked to explain why some accounts were visible while others were hidden. This experience taught me just how crucial proper Global Address List (GAL) management really is to an organization’s comms infrastructure.
In my experience working with organizations ranging from 50 to 15,000 users, nearly every company eventually needs to hide users from the global address list.
Let me walk you through the exact processes I use when managing GAL visibility, complete with the nuances and gotchas I’ve discovered along the way.
Before you start: where are the Exchange attributes managed?
Before hiding a recipient, confirm where its Exchange attributes are authoritative.
Cloud-only users: manage the setting in Microsoft 365, the Exchange admin center or Exchange Online PowerShell. Directory-synchronized users in a traditional hybrid configuration: Exchange attributes remain managed on-premises and are synchronized to Microsoft 365.
Directory-synchronized users whose Exchange-attribute source of authority has been transferred to Exchange Online: supported Exchange attributes, including HiddenFromAddressListsEnabled, can be managed in Exchange Online even though identity attributes such as the user’s name can remain authoritative in on-premises Active Directory.
This cloud-management capability must be specifically configured. Do not assume that every hybrid tenant or every synchronized mailbox uses it.
To check a synchronized Exchange Online mailbox:
Get-Mailbox -Identity “[email protected]” |
Format-List Identity,IsDirSynced,IsExchangeCloudManaged
If IsExchangeCloudManaged is True, supported Exchange attributes are managed in Exchange Online. If it is False, follow the organization’s on-premises Exchange management model.
How to Hide Users from the Global Address List
Method 1: Microsoft 365 admin center – user mailboxes
The Microsoft 365 Admin Center has a graphical interface that lets you manage user visibility. I’ve used this method countless times, especially when training new administrators or when I need to make quick changes to individual accounts.
Here’s how it goes:
- Sign in to the Microsoft 365 admin center and open Users > Active users.
- Select the user.
- On the Mail tab, select Manage global address list visibility.
- Clear Show in my organization address list and select Save changes.
This approach makes it easy to manage the GAL, even for admins who might not be comfortable with PowerShell commands. The visual interface makes it crystal clear what you’re changing.
Note that changes typically propagate within 5-15 minutes across the organization, though it may take up to an hour in some larger tenants with complex hybrid configurations.
| Pro Tip: When hiding multiple users, you might be tempted to open several browser tabs and make the changes at once. I’ve found this can sometimes cause some conflicts in the admin center. I recommend either using PowerShell for bulk operations or working through the users sequentially if you prefer the GUI approach. |
Method 2: Exchange admin center
PowerShell has been my go-to method for GAL management since I discovered how much time it saves.
Here’s my approach for hiding users from the Global Address List using PowerShell commands:
- Connect to Exchange Online PowerShell:
Connect-ExchangeOnline
- Hide a single user:
Set-Mailbox -Identity “[email protected]” -HiddenFromAddressListsEnabled $true
Hide multiple users (my preferred method for batch operations):
Get-Mailbox -Filter {CustomAttribute1 -eq “Contractor”} | Set-Mailbox -HiddenFromAddressListsEnabled $true
I really value PowerShell’s filtering capabilities. For instance, using a filter based on their CustomAttribute1, I can complete the entire operation in a single command rather than spending an hour clicking through the admin center.
The real power of PowerShell becomes apparent when you create more complex filters. For instance, here’s a command you can use to hide all mailboxes that had been inactive for over 90 days:
$date = (Get-Date).AddDays(-90)
Get-Mailbox -ResultSize Unlimited | Where-Object {$_.LastLogonTime -lt $date} | Set-Mailbox -HiddenFromAddressListsEnabled $true
| Pro Tip: Before executing any bulk hide operation, always run the initial Get-Mailbox portion of the command first and map it to Measure-Object to confirm exactly how many accounts will be affected. This simple precaution can save you from accidentally hiding hundreds of accounts. |
To verify the hidden status, use this PowerShell command to list all recipients hidden from the GAL:
Get-Recipient -ResultSize unlimited -Filter ‘HiddenFromAddressListsEnabled -eq $true’
If you would like to export a list of all hidden recipients to CSV, use this command:
Get-Recipient -Filter { HiddenFromAddressListsEnabled -eq $true } -ResultSize Unlimited |
Select-Object Identity, DisplayName, RecipientType, HiddenFromAddressListsEnabled |
Export-Csv “C:\temp\HiddenGAL.csv” -Encoding utf8 -NoTypeInformation
Hide Users in On-Premises Exchange
On-premises Exchange environments offer their own unique way to help you manage GAL users. Below are some methods you can use to hide GAL users:
Method 3: Exchange Online PowerShell
To hide one mailbox:
Connect-ExchangeOnline
Set-Mailbox -Identity “[email protected]” -HiddenFromAddressListsEnabled $true
Before making a bulk change, confirm that you are connected to the correct Microsoft 365 tenant and validate every recipient in the CSV. Do not run the change directly against an unreviewed list. Assume the CSV contains a UserPrincipalName column.
Step 1: Preview the recipients and their current settings
$Users = Import-Csv “C:\Temp\hide.csv”
$Preview = foreach ($User in $Users) {
Get-Recipient -Identity $User.UserPrincipalName |
Select-Object DisplayName,
PrimarySmtpAddress,
RecipientTypeDetails,
HiddenFromAddressListsEnabled
}
$Preview | Format-Table -AutoSize
Review the output and confirm that every entry is the intended recipient type and belongs to the correct tenant.
Step 2: Save the existing visibility settings before changing anything
$Preview |
Export-Csv “C:\Temp\GAL-visibility-backup.csv” `
-NoTypeInformation `
-Encoding UTF8
Keep this file until the change has been verified.
Step 3: Apply the change only after the preview has been approved
$Users | ForEach-Object {
Set-Mailbox -Identity $_.UserPrincipalName `
-HiddenFromAddressListsEnabled $true
}
This example assumes that every recipient in the CSV is a mailbox. If the list contains distribution groups, Microsoft 365 groups, mail contacts or mail users, use the recipient-specific cmdlet shown later in this guide instead of Set-Mailbox.
Step 4: Verify the result
$Users | ForEach-Object {
Get-Recipient -Identity $_.UserPrincipalName |
Select-Object DisplayName,
PrimarySmtpAddress,
RecipientTypeDetails,
HiddenFromAddressListsEnabled
}
Rollback
If a mailbox was hidden by mistake, restore its previous value from the backup. For a mailbox that was previously visible:
Set-Mailbox -Identity “[email protected]” `
-HiddenFromAddressListsEnabled $false
Use the backup CSV to identify which recipients were visible before the bulk change rather than assuming every recipient should be restored to the same state. Build bulk lists from an approved HR, offboarding or administrative source rather than from mailbox activity. LastLogonTime is not a reliable indicator of whether a person has left the organization.
This feedback is worth implementing. Bulk GAL changes are exactly where a preview and rollback step make the article much safer.
Method 4: Hybrid and directory-synchronized users
In a traditional hybrid environment where on-premises Active Directory remains authoritative for Exchange attributes, make the change with the supported on-premises Exchange management tools.
For a remote mailbox hosted in Exchange Online:
Set-RemoteMailbox -Identity “[email protected]” `
-HiddenFromAddressListsEnabled $true
For a mailbox still hosted on an on-premises Exchange server, use Set-Mailbox in the on-premises Exchange Management Shell.
Microsoft Entra Connect then synchronizes the relevant directory changes to Microsoft 365. Its default synchronization cycle is 30 minutes, but this is only the synchronization schedule and should not be presented as a guarantee that every Outlook client will reflect the change within 30 minutes.
If the user’s Exchange-attribute source of authority has been specifically transferred to Exchange Online, manage HiddenFromAddressListsEnabled in Exchange Online instead.
If the organization no longer runs its last Exchange server but retains on-premises directory synchronization, use Microsoft’s supported Exchange Management Tools workflow or the configured cloud Exchange-attribute management model. Avoid editing msExchHideFromAddressLists directly in Active Directory when supported Exchange management tools are available.
When and Why You Might Need to Hide Users
While managing different Exchange environments, I’ve found many reasons to hide users from the GAL might be useful. Here are a few of them:
Service Accounts and System Mailboxes
Service accounts should almost always be hidden from the GAL.
Take, for instance, a financial services company with over 300 service accounts used for automation and system notifications. Without proper GAL management, employees could frequently email these accounts instead of the proper support channels.
Shared and Resource Mailboxes
In most cases, organizations would have departmental mailboxes that should only receive messages from specific groups.
This is a great example of where hiding can be appropriate.
I once worked with a healthcare organization that maintained separate shared mailboxes for different medical departments. When we hid specific specialized department mailboxes from the GAL, only authorized staff with the direct email address could send sensitive patient information to these destinations.
Former Employees During Transition
When employees leave a company, there’s usually a transition period before their accounts are deprovisioned.
Let’s say you manage a retail company with high seasonal turnover. You could develop a staged offboarding process where departing employees are:
- Hidden from the GAL immediately upon departure.
- Maintained in a disabled state for 30 days with email forwarding.
- Fully removed after 60 days.
This phased approach can reduce communication issues while maintaining security. So, just maintain some form of email presence for departing employees for a period of time.
Executive and VIP Protection
For executives and high-profile employees, GAL visibility can easily pose security risks.
For example, it could be a great idea to maintain some alternate, non-public email addresses for C-suite executives that are hidden from the general directory.
| Pro Tip: When implementing hidden executive accounts, create a standardized naming convention that’s easy for authorized individuals to remember but not obvious to potential spammers. I’ve found that using middle initials or role-based patterns works well. |
Hide groups, contacts and other recipients
| Recipient type | Cmdlet (with -HiddenFromAddressListsEnabled $true) |
| User, shared, room or equipment mailbox | Set-Mailbox |
| Mailbox of a synced user (hybrid, run on-premises) | Set-RemoteMailbox |
| Distribution list or mail-enabled security group | Set-DistributionGroup |
| Microsoft 365 group | Set-UnifiedGroup |
| Dynamic distribution group | Set-DynamicDistributionGroup |
| Mail contact | Set-MailContact |
| Mail user | Set-MailUser |
Microsoft 365 groups associated with newly created Teams are normally created hidden from Exchange client experiences, and Microsoft also documents them as hidden from the GAL by default. However, do not assume the current visibility state from the group’s origin alone. Administrators may have changed either setting later.
Check both properties first:
Get-UnifiedGroup -Identity “<group>” |
Format-List DisplayName,
HiddenFromAddressListsEnabled,
HiddenFromExchangeClientsEnabled
HiddenFromAddressListsEnabled controls whether the group appears in the GAL and address lists.
HiddenFromExchangeClientsEnabled controls whether the group is exposed in Exchange client experiences such as Outlook.
To make a group visible in the GAL:
Set-UnifiedGroup -Identity “<group>” `
-HiddenFromAddressListsEnabled $false
If it also needs to appear normally in Outlook and other Exchange client experiences:
Set-UnifiedGroup -Identity “<group>” `
-HiddenFromExchangeClientsEnabled:$false
When will the change appear?
Different stages of the process update on different schedules, so there is no single guaranteed time for a hidden recipient to disappear everywhere.
| Stage | What to expect |
| Microsoft Entra synchronization in a hybrid environment | Microsoft Entra Connect runs a synchronization cycle every 30 minutes by default. This is the synchronization schedule, not a guarantee that the change will be visible in every Outlook client within 30 minutes. |
| Exchange Online Offline Address Book | Exchange Online generates Offline Address Books on its own schedule; Microsoft currently documents generation every 8 hours. |
| Classic Outlook in Cached Exchange Mode | Classic Outlook uses a downloaded Offline Address Book. A server-side change can therefore take additional time to reach a cached Outlook profile. Do not describe 24 hours as a guaranteed maximum. |
| Outlook AutoComplete | AutoComplete is separate from the GAL. A previously used address can remain in the To-field suggestions until the cached suggestion is removed. |
When troubleshooting, first confirm that the Exchange recipient itself has the expected HiddenFromAddressListsEnabled value. Then distinguish between directory synchronization, Offline Address Book propagation and a local AutoComplete suggestion rather than treating them as the same issue.
What hiding does and does not do
- Hiding a recipient changes its visibility in Exchange address lists. It does not disable the Microsoft Entra account, delete the mailbox, remove its license or complete the offboarding process.
- A mailbox that is hidden from the GAL can still receive email if the sender knows its address.
- Hiding is not a security control. To restrict who can send to a mailbox, use supported delivery restrictions or mail flow rules.
- Hiding also does not revoke mailbox permissions or delegate access. Existing permissions remain until they are changed separately.
- For a shared mailbox, Microsoft warns that hiding it from the address list can prevent new shared-mailbox members from adding that mailbox to their Outlook profile until it is visible in the address list again.
- Hiding does not automatically remove existing Outlook AutoComplete suggestions. An address that a user has previously used can continue to appear while composing a message until that cached suggestion is removed.
- Do not assume that hiding a recipient from Exchange address lists makes it invisible in every Microsoft 365 application. Other services can use different directory and search experiences. Verify the application you are trying to control rather than treating the GAL setting as a tenant-wide visibility control.
| Pro Tip: Before implementing widespread GAL changes, create a comprehensive inventory of all mailboxes, their purposes, and their interdependencies. I maintain this as a simple spreadsheet with columns for email address, purpose, owner, and visibility status. This reference has proven invaluable during troubleshooting and audits. |
How to Unhide a User from the Global Address List
In the Microsoft 365 admin center, open the user’s Mail tab, select Manage global address list visibility, select Show in my organization address list and save. In PowerShell, run the same cmdlet you used to hide the recipient with -HiddenFromAddressListsEnabled $false. For synced users, do it on-premises.
FAQ
Does hiding a user from the GAL stop them receiving email?
No. The mailbox still receives mail from anyone who has the address. Use delivery restrictions or mail flow rules to control who can send to it.
Why does a hidden user still appear in Outlook?
First confirm the recipient’s current HiddenFromAddressListsEnabled value in Exchange. In classic Outlook, an older Offline Address Book may still contain the recipient. If the name appears only while typing in the To field, it may instead be an AutoComplete suggestion. These are separate mechanisms and can update at different times.
Why can’t I hide a directory-synchronized user in Exchange Online?
In a traditional hybrid configuration, Exchange attributes for a directory-synchronized mailbox remain managed on-premises, so make the change with the supported on-premises Exchange tools.
Microsoft also supports transferring the Exchange-attribute source of authority for eligible directory-synchronized users with Exchange Online mailboxes to the cloud. This must be specifically configured. If IsExchangeCloudManaged is True, supported Exchange attributes such as HiddenFromAddressListsEnabled can be managed in Exchange Online.
Why is a Microsoft 365 group missing from the GAL?
First check the group’s current visibility settings:
Get-UnifiedGroup -Identity “<group>” | Format-List HiddenFromAddressListsEnabled,HiddenFromExchangeClientsEnabled
Teams-created Microsoft 365 groups are normally created with restricted Exchange visibility, but the settings may have been changed later. If HiddenFromAddressListsEnabled is True, set it to $false to make the group visible in the GAL. Check HiddenFromExchangeClientsEnabled separately if the group is also missing from Outlook.
Does hiding a user affect their license?
No. Hiding is an address list setting; licenses and mailbox access stay the same.
Can I hide users from some people but not from others?
Not with this setting, which applies to everyone. To give different groups different views of the directory, use address book policies.
Sometimes you need to keep certain accounts out of the public directory. Think of service accounts, break-glass admin accounts, or accounts not meant for day-to-day communication. Hiding them reduces confusion and lowers the chance that someone emails the wrong mailbox.
No, hiding a user from the GAL doesn’t delete or disable the account. The account stays active. You’re only removing it from the global directory that appears in Outlook and other connected apps.
Yes. Hiding the account doesn’t affect mail flow. They can send, receive, and log in normally unless other restrictions are applied.
Not always. Outlook uses an Offline Address Book, which updates on its own schedule. Users might not see the change right away. It can take several hours in some environments.
Yes. Licensing has nothing to do with GAL visibility. You can add or remove licenses at any time.
Yes. GAL hiding does not change permissions. If the user is a member of a group or has access to a resource mailbox, that still works.
Conclusion
Hide cloud-managed recipients in the Microsoft 365 admin center, Exchange admin center or PowerShell. For directory-synchronized recipients, make the change wherever your organization manages the Exchange attribute source of authority. Classic Outlook in Cached Exchange Mode may take additional time to reflect the change because it relies on the Offline Address Book, and remember that hiding is about tidiness, not security. For the rest of your directory hygiene, see our GAL best practices for IT admins. And if your directory also needs to reach employees’ phones, CiraSync syncs the GAL to native contacts apps.
