5.2 Creating & Managing Contacts
Key Takeaways
- Microsoft 365 distinguishes Mail contacts (external contact visible in the GAL, no sign-in credentials) from Mail users (external email address plus managed Entra credentials)
- Mail contacts are created in Exchange Online and show in the Global Address List so internal users can email an external person without that person holding a mailbox in the tenant
- Contacts are directory objects — not guest users and not shared mailboxes — and never consume a Microsoft 365 license
- A Mail user signs in with Entra credentials but delivers mail to an external address; a Mail contact cannot sign in at all
- Use a contact when the external party only needs to be email-reachable from inside the tenant; use a guest user when they need to collaborate in Teams, SharePoint, or M365 Group content
Two Kinds of Contacts in Microsoft 365
Microsoft 365 has two mail-enabled contact object types. They look similar in the GAL but differ in whether the object carries managed credentials.
| Object | Has Entra sign-in credentials? | External email address? | Visible in GAL? | Typical use |
|---|---|---|---|---|
| Mail contact | No | Yes (external) | Yes | An external vendor or partner you want everyone in the company to be able to email |
| Mail user | Yes (managed in Entra) | Yes (external delivery) | Yes | A contractor who logs in to Entra-managed apps but receives mail at their own external address |
Key distinction: A Mail user is an identity with an external delivery target. A Mail contact is just a directory entry with an external email — no identity, no sign-in, no password. Both appear in the GAL; only the Mail user can authenticate.
Creating Contacts
You can create contacts from two surfaces:
Microsoft 365 Admin Center
M365 admin center → Teams & groups → Shared mailboxes & Contacts (the left nav item is under Resources/Contacts depending on portal version) → Add a contact. The wizard collects display name, alias, and external email address. The contact is provisioned in Exchange Online automatically.
Exchange Admin Center
Exchange admin center → Recipients → Contacts → New contact. The Exchange surface exposes more mail-flow properties — custom email address policies, mail-tip text, message size restrictions, and hide-from-GAL lists — that the M365 wizard omits. Use the Exchange admin center when you need fine-grained mail-flow control.
Core Contact Properties
- Display name — what appears in the GAL and on outgoing mail
- Alias — the local part used to form the internal mail-routing address (
bobbecomesbob@contoso.onmicrosoft.comfor routing, even though delivery is to the external address) - External email address (TargetAddress) — where mail actually goes; this is the only address external senders see on replies
- Hide from address lists — yes/no toggle to suppress GAL visibility while keeping mail flow (useful for internal-only routing contacts)
GAL Visibility and Using Contacts for Distribution
Contacts appear in the GAL by default, so any internal user can resolve the name in Outlook's address book and send mail — the contact routes the message to the external address. Contacts can also be added as members of distribution lists and Mail-enabled security groups, which is how an external partner gets looped into a recurring mailing list without being granted any tenant access.
A hidden contact (Hide from address lists = Yes) is not visible in the GAL but still accepts mail addressed to its routing address — useful for system mailboxes that forward to an external address but should not clutter the address book.
Differentiating Contacts from Guest Users and Shared Mailboxes
These three object types are frequently confused because they all relate to external mail addresses or external people. They are not interchangeable.
Decision Table
| You need to… | Use this | Why |
|---|---|---|
| Let internal staff email an external person who has no access to your tenant | Mail contact | No identity, no license, GAL-reachable |
| Give an external contractor sign-in access to Entra-managed apps while their mail stays external | Mail user | Has managed credentials; mail routed externally |
| Invite an external partner to collaborate in Teams/SharePoint/M365 Groups | Entra B2B guest user | Issues a guest object with #EXT# UPN; home tenant authenticates them |
| Provide a generic mailbox (info@, support@) that several internal users open together | Shared mailbox | One mailbox, multiple delegates, no separate license up to 50 GB |
Exam angle: Contacts never authenticate and never consume licenses. Guest users authenticate with their home identity and collaborate in workloads. Shared mailboxes are for internal delegates sharing one address — they are not for external recipients.
Managing and Updating Contacts
- Bulk operations — Exchange admin center and PowerShell (
Set-MailContact,Set-MailUser) support bulk property updates and CSV import - Mail-tip — a short hint shown in Outlook when a user addresses the contact (e.g., 'This is a third-party vendor — do not share internal data')
- Hide from GAL — toggle when a contact should remain mail-reachable but not discoverable
- Delete — removing a contact is immediate (no 30-day window like user accounts); the GAL entry disappears within directory sync latency
Common Misconfiguration
Creating a Mail user when you meant to create a Mail contact leaves an orphan Entra identity that someone could sign in with — a real security gap if the external party was not supposed to have credentials. Always confirm which object type the wizard selected before saving.
Quick Reference: Where Each Object Lives
| Object | Created in | Managed in | Authenticates against | License? |
|---|---|---|---|---|
| Mail contact | M365 admin center or EAC | Exchange Online | No | No |
| Mail user | EAC or PowerShell | Exchange Online + Entra ID | Yes — Entra credentials | Only if you assign one |
| B2B guest user | Entra admin center / invitation API | Entra ID | Home identity provider | Generally no host M365 license |
| Shared mailbox | M365 admin center or EAC | Exchange Online | No (delegates use their own creds) | No up to 50 GB; Plan 2 over 50 GB or with archive |
A contractor needs to sign in to a Microsoft Entra-managed app in your tenant, but all of their email must be delivered to their existing external address at their employer. Which object should you create?