How do you handle email sent to unlicensed administrator accounts?
Asked by
MellowCedar42
We have roughly 145 administrator identities, each using a `.admin` address suffix. Those accounts cannot use their users' normal primary addresses because that would create duplicate addresses in Entra ID, and most of the admin identities do not have mailbox licenses. Occasionally, important notifications—such as cloud support case updates—are sent to those addresses and end up being missed because the addresses do not actually receive mail. What's a scalable way to route these messages without maintaining 145 separate mail-flow rules?
Answers
A central shared mailbox can work well. Route all of the admin addresses to it, then use mailbox rules or folders to sort messages based on the original recipient. You can add or remove aliases as administrators change, rather than maintaining a separate mail-flow rule for every account.
Reply to this answer
The documented approach for Azure-related notifications is to populate the user’s Alternate email attribute in Entra ID. Unfortunately, not every Microsoft service honors it consistently, and external services generally cannot see that attribute. A practical workaround is to provision a mailbox temporarily, configure forwarding to the person’s real mailbox, hide it from the address list, convert it to a shared mailbox, and then remove the license.
Reply to this answer
If an admin address is published or used with an external service, it should be a functioning address rather than a placeholder. Set the admin identity up as a shared mailbox, which normally does not require a license, and configure forwarding to the user’s regular mailbox. Distribution lists can also work if several people need to receive the same notifications.
Reply to this answer
Add your answer
Answers are reviewed before publication.
RiverNook88: Another variation is to use plus addressing so every admin identity has a unique destination while everything lands in one mailbox. Test this carefully first, since some external senders and services do not support plus-addressed recipients reliably.