We have roughly 145 administrator identities, each using a `.admin` address suffix. Those accounts cannot use their users' normal primary addresses because that would create duplicate addresses in Entra ID, and most of the admin identities do not have mailbox licenses. Occasionally, important notifications—such as cloud support case updates—are sent to those addresses and end up being missed because the addresses do not actually receive mail. What's a scalable way to route these messages without maintaining 145 separate mail-flow rules?
3 Answers
If an admin address is published or used with an external service, it should be a functioning address rather than a placeholder. Set the admin identity up as a shared mailbox, which normally does not require a license, and configure forwarding to the user’s regular mailbox. Distribution lists can also work if several people need to receive the same notifications.
The documented approach for Azure-related notifications is to populate the user’s Alternate email attribute in Entra ID. Unfortunately, not every Microsoft service honors it consistently, and external services generally cannot see that attribute. A practical workaround is to provision a mailbox temporarily, configure forwarding to the person’s real mailbox, hide it from the address list, convert it to a shared mailbox, and then remove the license.
A central shared mailbox can work well. Route all of the admin addresses to it, then use mailbox rules or folders to sort messages based on the original recipient. You can add or remove aliases as administrators change, rather than maintaining a separate mail-flow rule for every account.
Another variation is to use plus addressing so every admin identity has a unique destination while everything lands in one mailbox. Test this carefully first, since some external senders and services do not support plus-addressed recipients reliably.