Update November 18, 2022: Microsoft began the rollout of the change to make the Name parameter have the same value as the ExternalDirectoryObjectId (EDOID) in September. However, they have paused the rollout until January 2023. Some tenants have the feature now.
On April 13, the Exchange development group announced a change that took a little part away from the product’s history. Microsoft wants to alter the format of the Name and DistinguishedName attributes for mailboxes to make them more unique and plans to use the external directory object identifier (aka EDOID) instead.
When Microsoft launched Exchange 4.0 in 1996, the X.400 and X.500 standards still exerted a huge influence on the world of email. Because of this, the developers used X.500-like naming conventions within the Exchange directory store (DS), the forerunner of what became Active Directory when Windows 2000 launched in 1999 and Azure Active Directory later. X.500 objects use distinguished names as unique identifiers. To create an X.500 distinguished name, you concatenate attributes to form a path to the named entry. Exchange Online mail-enabled objects still have these values in the LegacyDn property, where you’ll find something like this:
o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=43bdc98a69d147568728728be0335b34-James.Keane
Exchange Online has its own form of distinguished names, which still serve as unique identifiers for objects. Here’s an example:
The CN (common name) portion comes from the mailbox name. The OU (organization) entities identify the Microsoft 365 tenant and Exchange Online, while the DC entities give the path to the Outlook.com domain controller Exchange Online connected to when it created the mailbox.
Make Synchronization Happy
What Microsoft is now saying is that the format used for Exchange Online distinguished names needs to change. They have encountered situations where conflicts happened when objects synchronize from Azure Active Directory to Exchange Online. When they considered how the conflicts occurred, they decided that a better source of uniqueness is necessary.
Microsoft proposes to change the generation of the Name property for mail-enabled objects from its current basis (the MailNickName or Alias) to use the external directory object identifier pointing to the Azure AD account owning the object. Let’s explore what that means.
Using Unique Identifiers
All Azure AD objects have unique identifiers (GUIDs). When you create a new Microsoft 365 account with an Exchange Online license, Exchange Online takes the account’s MailNickName property and uses that for the mailbox name and alias properties. For example, if you create a new account with a username of Sue.P.Pickett@office365itpros.com, among the Azure AD account properties are:
When Exchange Online creates a mailbox, it takes the MailNickName value and uses it to create the mailbox alias, name, and distinguished name. The first two properties have the same value as MailNickName, while the distinguished name becomes:
In addition, Exchange Online writes the Azure AD account ObjectId into the mailbox’s ExternalDirectoryObjectId property. You can use this value to find a mailbox, as in:
Get-ExoMailbox -Identity b67c8bd7-a8d3-4358-b42f-cd51821f7ba3 -Properties Name
ExternalDirectoryObjectId : b67c8bd7-a8d3-4358-b42f-cd51821f7ba3
UserPrincipalName : Sue.P.Pickett@office365itpros.com
Alias : Sue.P.Pickett
DisplayName : Sue Pickett
Name : Sue.P.Pickett
DistinguishedName : CN=Sue.P.Pickett,OU=Office365itpros.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR04A002,DC=prod,DC=outlook,DC=com
Microsoft’s proposed change means that Exchange Online will use the Azure AD account identifier for the mailbox name and as the CN part of the distinguished name. Hence, we end up with:
Get-ExoMailbox -Identity b67c8bd7-a8d3-4358-b42f-cd51821f7ba3 -Properties Name
ExternalDirectoryObjectId : b67c8bd7-a8d3-4358-b42f-cd51821f7ba3
UserPrincipalName : Sue.P.Pickett@office365itpros.com
Alias : Sue.P.Pickett
DisplayName : Sue Pickett
Name : b67c8bd7-a8d3-4358-b42f-cd51821f7ba3
DistinguishedName : CN= b67c8bd7-a8d3-4358-b42f-cd51821f7ba3, OU=Office365itpros.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR04A002,DC=prod,DC=outlook,DC=com
Because an Azure AD account identifier is unique within Microsoft 365, the properties of the Exchange mailbox will also be unique, and it solves the synchronization problems. In fact, you can write the account identifier into a mailbox’s Name property today if you want:
When you update the Name property, Exchange updates the mailbox’s distinguished name so that the CN part of the name matches the value assigned to the Name property.
Distinguished Names and Exchange Online
Distinguished names only exist within Exchange Online. No trace of them exists in Azure AD object properties because the link between Azure AD and Exchange Online is via the external directory object identifier. This property exists for all Exchange Online objects which have a corresponding object in Azure AD:
Microsoft says that the change will apply only to new mail-enabled objects. They don’t plan to retrospectively update older objects with the new naming scheme. When the new naming scheme rolls out, Microsoft says that they will stop the ability of administrators to update the mailbox Name property using cmdlets like Set-Mailbox and Set-User, which seems logical.
A Pause for Reflection
Soon after Microsoft posted their blog, they added an update saying that based on feedback, they will delay making the change and will give a new schedule at the end of April. I think this is reasonable. Although I’m not worried about using object identifiers in distinguished names, the Name property is a little different because Exchange Online exposes it more often. For instance, if you look at who manages a distribution group, this output doesn’t look right:
Exchange and Microsoft 365 user interfaces will hide the switchover because they can take the GUIDs and resolve them into “pretty” values like display names (Figure 1).
Figure 1: No trace off distinguished names for a mailbox viewed through the Exchange admin center
Any potential problems will arise in administrative scripts which use the Name or DistinguishedName properties and expect values returned by Exchange Online to follow a certain format. Scripts (like this one to report distribution lists and their managers) that resolve values to retrieve display names are unaffected by the change.
Like any modification proposed for something which has been in use for a very long time, there are bound to be some edge cases that turn up and need resolution. I believe the Exchange developers are on the right path to seek unique anchors for synchronization. I just hope that they can get there without causing too much upheaval for customers.
So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.
Hello, how to cope with that changes after implementation? Any tipps or tricks?
Is it possible to change the EXO Mailbox Name Field back to any readable name (Alias, Display Name)?
We are currently impacted within mobile device quarantine on EXO Admin, becaus it shows the ObjectID (Name), and that needs further steps to check who requested access:
{"id":null,"mode":"button","open_style":"in_modal","currency_code":"EUR","currency_symbol":"\u20ac","currency_type":"decimal","blank_flag_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/blank.gif","flag_sprite_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/flags.png","default_amount":100,"top_media_type":"featured_image","featured_image_url":"https:\/\/office365itpros.com\/wp-content\/uploads\/2022\/11\/cover-141x200.jpg","featured_embed":"","header_media":null,"file_download_attachment_data":null,"recurring_options_enabled":true,"recurring_options":{"never":{"selected":true,"after_output":"One time only"},"weekly":{"selected":false,"after_output":"Every week"},"monthly":{"selected":false,"after_output":"Every month"},"yearly":{"selected":false,"after_output":"Every year"}},"strings":{"current_user_email":"","current_user_name":"","link_text":"Virtual Tip Jar","complete_payment_button_error_text":"Check info and try again","payment_verb":"Pay","payment_request_label":"Office 365 for IT Pros","form_has_an_error":"Please check and fix the errors above","general_server_error":"Something isn't working right at the moment. Please try again.","form_title":"Office 365 for IT Pros","form_subtitle":null,"currency_search_text":"Country or Currency here","other_payment_option":"Other payment option","manage_payments_button_text":"Manage your payments","thank_you_message":"Thank you for supporting the work of Office 365 for IT Pros!","payment_confirmation_title":"Office 365 for IT Pros","receipt_title":"Your Receipt","print_receipt":"Print Receipt","email_receipt":"Email Receipt","email_receipt_sending":"Sending receipt...","email_receipt_success":"Email receipt successfully sent","email_receipt_failed":"Email receipt failed to send. Please try again.","receipt_payee":"Paid to","receipt_statement_descriptor":"This will show up on your statement as","receipt_date":"Date","receipt_transaction_id":"Transaction ID","receipt_transaction_amount":"Amount","refund_payer":"Refund from","login":"Log in to manage your payments","manage_payments":"Manage Payments","transactions_title":"Your Transactions","transaction_title":"Transaction Receipt","transaction_period":"Plan Period","arrangements_title":"Your Plans","arrangement_title":"Manage Plan","arrangement_details":"Plan Details","arrangement_id_title":"Plan ID","arrangement_payment_method_title":"Payment Method","arrangement_amount_title":"Plan Amount","arrangement_renewal_title":"Next renewal date","arrangement_action_cancel":"Cancel Plan","arrangement_action_cant_cancel":"Cancelling is currently not available.","arrangement_action_cancel_double":"Are you sure you'd like to cancel?","arrangement_cancelling":"Cancelling Plan...","arrangement_cancelled":"Plan Cancelled","arrangement_failed_to_cancel":"Failed to cancel plan","back_to_plans":"\u2190 Back to Plans","update_payment_method_verb":"Update","sca_auth_description":"Your have a pending renewal payment which requires authorization.","sca_auth_verb":"Authorize renewal payment","sca_authing_verb":"Authorizing payment","sca_authed_verb":"Payment successfully authorized!","sca_auth_failed":"Unable to authorize! Please try again.","login_button_text":"Log in","login_form_has_an_error":"Please check and fix the errors above","uppercase_search":"Search","lowercase_search":"search","uppercase_page":"Page","lowercase_page":"page","uppercase_items":"Items","lowercase_items":"items","uppercase_per":"Per","lowercase_per":"per","uppercase_of":"Of","lowercase_of":"of","back":"Back to plans","zip_code_placeholder":"Zip\/Postal Code","download_file_button_text":"Download File","input_field_instructions":{"tip_amount":{"placeholder_text":"How much would you like to tip?","initial":{"instruction_type":"normal","instruction_message":"How much would you like to tip? Choose any currency."},"empty":{"instruction_type":"error","instruction_message":"How much would you like to tip? Choose any currency."},"invalid_curency":{"instruction_type":"error","instruction_message":"Please choose a valid currency."}},"recurring":{"placeholder_text":"Recurring","initial":{"instruction_type":"normal","instruction_message":"How often would you like to give this?"},"success":{"instruction_type":"success","instruction_message":"How often would you like to give this?"},"empty":{"instruction_type":"error","instruction_message":"How often would you like to give this?"}},"name":{"placeholder_text":"Name on Credit Card","initial":{"instruction_type":"normal","instruction_message":"Enter the name on your card."},"success":{"instruction_type":"success","instruction_message":"Enter the name on your card."},"empty":{"instruction_type":"error","instruction_message":"Please enter the name on your card."}},"privacy_policy":{"terms_title":"Terms and conditions","terms_body":null,"terms_show_text":"View Terms","terms_hide_text":"Hide Terms","initial":{"instruction_type":"normal","instruction_message":"I agree to the terms."},"unchecked":{"instruction_type":"error","instruction_message":"Please agree to the terms."},"checked":{"instruction_type":"success","instruction_message":"I agree to the terms."}},"email":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email address"},"success":{"instruction_type":"success","instruction_message":"Enter your email address"},"blank":{"instruction_type":"error","instruction_message":"Enter your email address"},"not_an_email_address":{"instruction_type":"error","instruction_message":"Make sure you have entered a valid email address"}},"note_with_tip":{"placeholder_text":"Your note here...","initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"empty":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"not_empty_initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"saving":{"instruction_type":"normal","instruction_message":"Saving note..."},"success":{"instruction_type":"success","instruction_message":"Note successfully saved!"},"error":{"instruction_type":"error","instruction_message":"Unable to save note note at this time. Please try again."}},"email_for_login_code":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email to log in."},"success":{"instruction_type":"success","instruction_message":"Enter your email to log in."},"blank":{"instruction_type":"error","instruction_message":"Enter your email to log in."},"empty":{"instruction_type":"error","instruction_message":"Enter your email to log in."}},"login_code":{"initial":{"instruction_type":"normal","instruction_message":"Check your email and enter the login code."},"success":{"instruction_type":"success","instruction_message":"Check your email and enter the login code."},"blank":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."},"empty":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."}},"stripe_all_in_one":{"initial":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"empty":{"instruction_type":"error","instruction_message":"Enter your credit card details here."},"success":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"invalid_number":{"instruction_type":"error","instruction_message":"The card number is not a valid credit card number."},"invalid_expiry_month":{"instruction_type":"error","instruction_message":"The card's expiration month is invalid."},"invalid_expiry_year":{"instruction_type":"error","instruction_message":"The card's expiration year is invalid."},"invalid_cvc":{"instruction_type":"error","instruction_message":"The card's security code is invalid."},"incorrect_number":{"instruction_type":"error","instruction_message":"The card number is incorrect."},"incomplete_number":{"instruction_type":"error","instruction_message":"The card number is incomplete."},"incomplete_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incomplete."},"incomplete_expiry":{"instruction_type":"error","instruction_message":"The card's expiration date is incomplete."},"incomplete_zip":{"instruction_type":"error","instruction_message":"The card's zip code is incomplete."},"expired_card":{"instruction_type":"error","instruction_message":"The card has expired."},"incorrect_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incorrect."},"incorrect_zip":{"instruction_type":"error","instruction_message":"The card's zip code failed validation."},"invalid_expiry_year_past":{"instruction_type":"error","instruction_message":"The card's expiration year is in the past"},"card_declined":{"instruction_type":"error","instruction_message":"The card was declined."},"missing":{"instruction_type":"error","instruction_message":"There is no card on a customer that is being charged."},"processing_error":{"instruction_type":"error","instruction_message":"An error occurred while processing the card."},"invalid_request_error":{"instruction_type":"error","instruction_message":"Unable to process this payment, please try again or use alternative method."},"invalid_sofort_country":{"instruction_type":"error","instruction_message":"The billing country is not accepted by SOFORT. Please try another country."}}}},"fetched_oembed_html":false}
Why don’t they combine both the human readable name and the guid? For example. Cn=JoeUser.guid-here
Which is what they do for Microsoft 365 Groups:
Get-UnifiedGroup -Id “Office 365 Adoption”| fl name, distinguishedname, externaldirectoryobjectid
Name : Office365Adoption_b647d5ff-3bda-4333-b768-7990084569b6
DistinguishedName : CN=Office365Adoption_b647d5ff-3bda-4333-b768-7990084569b6,OU=office365itpros.onmicrosoft
.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR04A002,DC=prod,DC=outlook,DC=com
ExternalDirectoryObjectId : b647d5ff-3bda-4333-b768-7990084569b6
Hello, how to cope with that changes after implementation? Any tipps or tricks?
Is it possible to change the EXO Mailbox Name Field back to any readable name (Alias, Display Name)?
We are currently impacted within mobile device quarantine on EXO Admin, becaus it shows the ObjectID (Name), and that needs further steps to check who requested access:
You can change the alias back to whatever value you like with Set-Mailbox.
Not if the user was create OnPrem and then sync, a message said that the object is out of write access.
Makes sense when you think about it because I bet they haven’t tested all the use cases for the change on on-premises servers.