{"id":4639,"date":"2025-09-28T11:26:14","date_gmt":"2025-09-28T11:26:14","guid":{"rendered":"https:\/\/geekmungus.co.uk\/?p=4639"},"modified":"2025-09-28T11:26:14","modified_gmt":"2025-09-28T11:26:14","slug":"unable-to-remove-proxyaddress-from-non-mail-enabled-non-exchange-online-user-in-microsoft-365","status":"publish","type":"post","link":"https:\/\/geekmungus.co.uk\/?p=4639","title":{"rendered":"Unable to Remove ProxyAddress from Non-Mail Enabled (Non-Exchange Online) User (in Microsoft 365)"},"content":{"rendered":"\n

We have a user which has somehow added a proxyAddress (an email address to their account) but they don’t have an Exchange Online mailbox, and seemingly never have. Microsoft says the following about it from this\u00a0article<\/a>:<\/p>\n\n\n\n

\n

mail<\/strong> and proxyAddresses<\/strong> are both email-related properties. The proxyAddresses<\/strong> property is a collection of addresses only relevant to the Microsoft Exchange server. It’s used to store a list of mail addresses for a user that are tied to a single mailbox. The mail<\/strong> property is used as the user’s email address for various purposes including user sign-in and defines the primary proxy address.<\/p>\n\n\n\n

Both mail<\/strong> and proxyAddresses<\/strong> can be retrieved through the GET user<\/a> API. You can update the mail<\/strong> via the Update user<\/a> API, but can’t update proxyAddresses<\/strong> through Microsoft Graph. When a user’s mail<\/strong> property is updated, it triggers recalculation of proxyAddresses<\/strong> and the newly updated mail is set to be the primary proxy address, except in the following scenarios:<\/p>\n\n\n\n

    \n
  1. If a user has a license that includes Microsoft Exchange, all their proxy addresses must belong to a verified domain on the tenant. Any that don’t belong to verified domains are silently removed.<\/li>\n\n\n\n
  2. A user’s mail is NOT set to the primary proxy address if the user is a guest and the primary proxy address contains the guest’s UPN string with #EXT#.<\/li>\n\n\n\n
  3. A user’s mail is NOT removed, even if they no longer have proxy addresses if the user is a guest.<\/li>\n<\/ol>\n\n\n\n

    proxyAddresses<\/strong> are unique across directory objects (users, groups, and organizational contacts). If a user’s mail<\/strong> property conflicts with one of the proxyAddresses<\/strong> of another object, an attempt to update the mail<\/strong> fails, and the proxyAddresses<\/strong> property isn’t updated either.<\/p>\n<\/blockquote>\n\n\n\n

    An example of the problem can be seen below, as you can see the object on the right has the bob@address.com<\/strong> email address but an incoming synching account also has this address. So we need to remove the erroneous entry (email address) from the account on the right, so the synchronisation happens properly.<\/p>\n\n\n\n

    Of course, how can you end up in this situation? Well, there are a few ways, it could be an account that did have a mailbox but it has now been removed and the associated address was not removed, or in this case the user had an administrative account which they edited the profile of to add their on-premise email addresses to so it could receive email, turned out when editing the profile, this gets the email addresses stuck in there.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    When we look at the object, we see the SMTP address (circled).<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Resolution<\/h1>\n\n\n\n

    To resolve the issue, we need to add an Exchange Online licence to the user’s account, once added, we can then remove the problematic proxyAddress, then we can remove the Exchange Online licence.<\/p>\n\n\n\n

    Add a Licence to Enable Mailbox Features<\/h3>\n\n\n\n

    Add the licence, Microsoft 365 E3 should do the trick (or whatever you are using in your environment), then click on “Save Changes”.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Remove Problematic Address<\/h3>\n\n\n\n

    Using PowerShell run:<\/p>\n\n\n\n

    Connect-ExchangeOnline\n\nSet-Mailbox \"Bob Smith\" -EmailAddresses @{remove=\"bob@address.com\"}<\/code><\/pre>\n\n\n\n
    Where bob@address.com is the email address you want to remove.<\/p>\n\n\n\n
    Note that if the problematic address you are removing is the PrimarySMTPAddress, you need to add something in its place BEFORE you attempt to remove the problematic email address. So, you’ll need to add something unique.<\/p>\n\n\n\n
    Now run the following command to see that it is gone!<\/p>\n\n\n\n
    Get-Mailbox \"Bob Smith\" | fl DisplayName,PrimarySMTPAddress,EmailAddresses<\/code><\/pre>\n\n\n\n
    Remove Licence<\/h3>\n\n\n\n
    Finally, we remove the licence, we added earlier from the user account, then click on “Save Changes”.<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    The issue should now be resolved, also check to ensure you don’t have multiple things that are conflicting!<\/p>\n\n\n\n
    Additional Information<\/h2>\n\n\n\n