How do you handle email sent to unlicensed administrator accounts?
Asked by
MellowCedar42
We have roughly 145 administrator identities whose addresses use a `.admin` suffix. Because those accounts cannot share the same primary email address as the users' normal accounts in Entra ID, the admin addresses are effectively invalid or unmonitored when services send notifications to them. This has caused important messages, including cloud provider case updates, to be missed. Mail flow rules could redirect the messages, but maintaining around 145 individual rules would be cumbersome. What's a practical way to make these admin addresses reliably deliver mail?
Answers
A single shared mailbox can act as the collection point. Give it aliases for the admin addresses and use inbox rules or mail flow rules to sort messages into folders based on the recipient address. This avoids maintaining a separate destination mailbox for every administrator, though aliases still need to be added or removed as accounts change.
Reply to this answer
The intended approach for Entra-related notifications is to populate the account’s Alternate email attribute with the address that should receive the messages. Unfortunately, not every Microsoft service consistently honors that field, and unrelated services have no way to use it. A workaround is to temporarily license the admin account, hide it from the address list, configure forwarding, then convert it to a shared mailbox and remove the license.
Reply to this answer
Another simple option is to make each admin identity a shared mailbox, configure it to forward to the user’s normal mailbox, and remove the license. This gives the address a real delivery target without requiring a full user mailbox. Make sure forwarding and retention behavior match your organization’s security requirements.
Reply to this answer
If an address is used with an external service, it should be a functioning address rather than an intentionally invalid one. In some environments, adding the `.admin` address as an alias on the user’s licensed primary mailbox is the easiest solution, provided the platform allows the alias without creating a duplicate.
Reply to this answer
Exchange plus addressing can provide unique delivery addresses that all route to one mailbox. Each admin identity gets its own tagged address, and rules can sort those messages based on the tag. It’s worth testing first because some external senders and applications don’t handle plus-addressed recipients consistently.
Reply to this answer
Add your answer
Answers are reviewed before publication.
PixelHarbor7: That workaround is more reliable than depending on every individual service to interpret the Alternate email field correctly, especially for third-party systems.