Hide Users From Global Address List (GAL)

In this guide, you will learn how to hide users, groups, and shared mailboxes from the Office 365 Global Address List (GAL).

You can hide any object with a mailbox from the Global Address List (GAL) including User and Shared Mailboxes, Groups (Microsoft 365, Distribution Lists, and Mail-Enabled), Resources, and Contacts. Mailboxes that are hidden cannot be located by any services that depend on the GAL.

Table of contents:

• Hide User or Shared Mailbox from GAL in Hybrid Environment
• Hide User or Shared Mailbox from GAL in Cloud Only Environment
• Hide Contact from the GAL using Exchange Admin Center
• Hide Resources from the GAL using Exchange Admin Center
• Hide Group from the GAL using Exchange Admin Center
• Hide User from GAL using PowerShell (Hybrid)
• Hide User from GAL using PowerShell (Cloud only)
• Hide contact from GAL using PowerShell
• Hide group from GAL using PowerShell

Hide Users or Shared Mailbox from GAL in Hybrid Environment

If you have an on-premises Active Directory domain controller that syncs with Azure then follow these steps to hide a users from the GAL.

Step 1. In your on-prem Active Directory Domain Controller, open Active Directory Users and Computers.

Step 2. Locate the user you want to hide from the Global Address List and double-click on the user.

Step 3. Click on the Attribute Editor tab.

Step 4. Locate the attribute msExchHideFromAddressLists and edit it. Set it to True.

Step 5. Perform a sync to push the changes to the cloud.

Want to check or bulk update the msExchHideFromAddressLists for all users?

The AD Pro Toolkit can be used to report on the msExchHideFromAddressLists value for all users. Run the user Export tool and add the msExchHideFromAddressLists attribute to the report. This will create a report like below. This is a quick and easy way to see which users are hidden from the GAL.

If you want to bulk modify this attribute use the bulk updater tool.

Hide Users or Shared Mailbox from GAL in Cloud Only Environment

Step 1. Log into the Exchange Admin Center

Click on mailboxes, to see a list of user and shared mailboxes.

Step 2. Click on the mailbox you would like to hide.

The mailbox settings page will be displayed. At the top, click on hide mailbox.

A Hide from the address list screen will open. Toggle from Off to On. Then click Save at the bottom of the screen.

It can take up to 24 hours for an existing mailbox to be hidden from the Global Address List.

Hide Contact from the GAL using Exchange Admin Center

Step 1. Log into the Exchange Admin Center.

From the left menu click on recipients and then contacts. You will see your tenant contact list.

Step 2. Locate the contact you want to hide from the address list and click on it. You will see Hide from global address list at the bottom.

Click on manage hide from GAL.

The Manage hide from global address list (GAL) screen will display. Toggle the Hide from Global Address List setting to On and click Save at the bottom of the screen.

It can take up to 24 hours before an existing contact is hidden in the GAL.

Hide Resources from the GAL using Exchange Admin Center

Step 1. Log into the Exchange Admin Center.

From the left menu click on recipients and then resources. You will see a list of your resources.

Step 2. Locate and click on the Resource you want to hide.  The settings page will open. Click on the box “Hide this from the global address list” and then click the save button.

It can take up to 24 hours before an existing resource is hidden from the GAL.

Hide Group from the GAL using Exchange Admin Center

Step 1. Log into the Exchange Admin Center.

From the left menu click on recipients and then groups. You will see a list of your groups. You can hide any group, Microsoft 365, Distribution List, Dynamic Distribution List, or Mail-enabled Security.

Step 2. Click on the group

Click on the tab Microsoft 365, Distribution list, Dynamic distribution list, or Mail-enabled security where your group is located.  In this case, I’m choosing a Microsoft 365 Group so I’m going to click on the Microsoft 365 tab.  Click on the group you want to hide.  The group information box will open. 

Click on the Settings tab. Under General Settings, click on the box to the left of the Hide this group form the global address list. Click Save at the bottom.

It can take up to 24 hours before an existing group is hidden from the GAL.

Hide Users from GAL using PowerShell (Hybrid)

You need to have the Active Directory PowerShell module installed to run these commands.

In this example, we change the Active Directory user “123 User”.

Set-ADUser -identity 123user -Replace @{msExchHideFromAddressLists=$true}

To check the setting of the msExchHideFromAddressLists attribute, use the cmdlet Get-ADUser
In this example, I check the status of user “ABC User”

Get-ADUser -Identity “ABC User” -Properties msExchHideFromAddressLists

Hide Users from GAL using PowerShell (Cloud Only)

First, connect to Exchange Online.

See the article Connect to exchange online for detailed steps.

To hide a user, resource, or shared mailbox from the Global Address List, use the Set-Mailbox cmdlet.

In this example, I am hiding the user “ABC User” from the GAL.

Set-Mailbox -Identity "ABC User" -HiddenFromAddressListsEnabled $true

To unhide the user mailbox from the GAL, use the Set-Mailbox cmdlet.

Set-Mailbox -Identity "ABC User" -HiddenFromAddressListsEnabled $false

To see what mailboxes are hidden from GAL, use the following script:

Get-Mailbox -ResultSize unlimited | where {$_.HiddenFromAddressListsEnabled -eq $true} | Select DisplayName

Hide Contact from GAL using PowerShell

First, connect to Exchange Online.

See the article Connect to exchange online for detailed steps.

Use the Set-MailContact cmdlet to hide a contact from the GAL. In this example, we hide the contact “Cherry Pie” from the GAL.

Set-MailContact -Identity "Cherry Pie" -HiddenFromAddressListsEnabled $true

To check the status of the HiddenFromAddressListsEnabled, use cmdlet Get-MailContact

In this example, I check the status of mail contact “Cherry Pie”

Get-MailContact -Identity "Cherry Pie" | FL HiddenFromAddressListsEnabled

To view any Mail Contact hidden from GAL, use the following command:

Get-MailContact -ResultSize unlimited | Where {$_.HiddenFromAddressListsEnabled -eq $true} | Select Name,HiddenFromAddressListsEnabled

Hide Group from GAL using PowerShell

First, connect to Exchange Online.

See the article Connect to exchange online for detailed steps.

Distribution Group

Use the Set-DistributionGroup cmdlet to hide a Distribution list or Mail-Enabled Security group from GAL. In this example, I hide the Distribution List “ADProAll” from the GAL.

Set-DistributionGroup -Identity "ADProAll"-HiddenFromAddressListsEnabled $true

To see the setting of the HiddenFromAddressListsEnabled for a Distribution Group, use the cmdlet Get-DistributionGroup

In this example, I check the status of Distribution Group “ADProAll”

Get-DistributionGroup -Identity "ADProAll" | FL HiddenFromAddressListsEnabled

To view all Distribution Groups hidden from the GAL, use the following script:

Get-DistributionGroup -ResultSize unlimited | Where {$_.HiddenFromAddressListsEnabled -eq $true} | Select Name,HiddenFromAddressListsEnabled

Microsoft 365 Group

To hide a Microsoft 365 Group, use cmdlet Set-UnifiedGroup.

In this example, I hide the Microsoft 365 Group “Accounting Team” from the GAL.

Set-UnifiedGroup -Identity "Accounting Team" -HiddenFromAddressListsEnabled $true

To view the setting of HiddenFromAddressListsEnabled on a Microsoft 365 Group, use the cmdlet Get-UnifiedGroup

In this example, I check the setting of “Accounting Team”

Get-UnifiedGroup -Identity "Accounting Team" | FL HiddenFromAddressListsEnabled

To view all Microsoft 365 Groups hidden from GAL, use the following script:

Get-UnifiedGroup -ResultSize unlimited | Where {$_.HiddenFromAddressListsEnabled -eq $true} | Select Name,HiddenFromAddressListsEnabled

Dynamic Distribution List

To hide a Dynamic Distribution List, use the Set-DynamicDistributionGroup cmdlet.

In this example, I hide the Dynamic Distribution List named “ADProDDL” from the GAL.

Set-DynamicDistributionGroup -Identity ADProDDL -HiddenFromAddressListsEnabled $true

To check the setting of HiddenFromAddressListsEnabled on a Dynamic Distribution List, use the cmdlet Get-DynamicDistributionGroup.

Get-DynamicDistributionGroup -Identity "ADProDDL" | FL HiddenFromAddressListsEnabled

To get a list of all objects hidden from the GAL, use the cmdlet Get-Recipient.

Get-Recipient -ResultSize unlimited -Filter {HiddenFromAddressListsEnabled -eq $true}