If, like me, you are setting up email with Office 365, you may have stumbled on a little problem with distribution lists. The problem runs like this:

1. You are syncing your on-site Active Directory with Azure AD Connect
   
2. After syncing your email distribution lists set up in your on-site AD you want to change whether internal users only, or anyone can send mail to the list.
   
3. You try to alter the setting in 365 but it throws an error saying that as you are syncing your AD it needs to be set in AD by altering the ‘msExchRequireAuthToSendTo’ AD attribute of the Group
   
4. You find that this attribute does not exist in your AD so you can’t alter it. Dammit!
   

This issue occurred because I was syncing an AD that had not been extended for Exchange with Exchange Online, which uses the ‘msExchRequireAuthToSendTo’ attribute to determine whether internal/external senders can send email to the group.

Unfortunately, it appears that information on this issue was scarce and I had to piece together the solution from many different blog posts from people with different issues. Here beginth the solution:

Step 1 – Extend your AD for Exchange.

So the first thing we need to do is to extend AD for Exchange. This gives us more control of Exchange Online by adding new AD attributes to send off to 365. You can do this with a trial version of Exchange such as the one found here: Download Microsoft Exchange Server 2010 from Official Microsoft Download Center (this is Exchange 2010, I did try 2016 but ran into a strange error when extending the schema, 2010 worked fine though).

Extract the downloaded files and, using an account with ‘Enterprise Admin’ and ‘Schema Admin’ permissions, run ‘setup /PrepareSchema’ and wait for it to complete.

Hurrah! You should now be able to set the ‘msExchRequireAuthToSendTo’ AD attribute for your distribution group, sync your AD with Azure and find that the option has altered in 365 right? Right?

Wrong!

Step 2 – Update Azure AD Connect for the updated schema

Why doesn’t it work? Unfortunately, when you install Azure AD Connect it picks up the current schema and that’s what it will run with, even if the schema is updated later. Of course if I knew what I knew now I would have extended the schema before I installed Azure AD Connect which would have made everything a lot more simple. But hey, when is IT simple right?

The good news is that Azure AD Connect allows you to refresh schema. Hurrah!

1. Load up the Sync Manager, click on the ‘Connectors’ tabs
   
2. Highlight your local domain, click ‘Refresh Schema’ in the right hand window
   
3. Puzzle as you are asked you for a password for an account that was automatically generated during the Azure AD Connect installation. Oh… you say, I have no idea what that is. However, it appears that resetting that password has no major effects (the account is only used to access AD for AADC). So go ahead and reset the password.
   
4. Now you can refresh the schema
   

Hurrah! You should now be able to set the ‘msExchRequireAuthToSendTo’ AD attribute for your distribution group, sync your AD with Azure and find that the option has altered in 365 right? Right?

Wrong!

Step 3 – Update the AD attributes to be synced

Why doesn’t it work? Well, you may have added the new Exchange AD attributes to AADC but it is not set to retrieve them from AD yet. So now we need to tell Sync Manager to do this

1. Load up the Sync Manager, click on the ‘Connectors’ tabs
   
2. Highlight your local domain, click ‘properties’ in the right hand window
   
3. Click ‘Select Attributes’
   
4. Scroll through and tick ‘msExchRequireAuthToSendTo’
   
5. Click ok
   

Hurrah! You should now be able to set the ‘msExchRequireAuthToSendTo’ AD attribute for your distribution group, sync your AD with Azure and find that the option has altered in 365 right? Right?

Wrong!

Step 3 – Update the AADC sync rules

Why doesn’t it work? Ok so this one took a bit of puzzling, a lot of Googling and a bit of playing around.

When you intall AADC you get a tool called ‘Synchronization Rules Editor’ which specifies exactly what is retrieved from your local AD (Inbound rules) and sent to Azure (Outbound rules). At this point, let me state that I don’t really understand why you have to tell Sync Manager what to retrieve and send and the same for the Rules Editor as well, but you do. Though I would appreciate someone explaining that to me?

So, here it’s a good idea to clone and disable an existing rule and edit the copy (in case you make a major booboo and want to go back to the previous state). For each rule specified below you need to add the following information to the ‘Transformations’ section:

· FlowType = Direct

· Target Attribute = msExchRequireAuthToSendTo

· Source = msExchRequireAuthToSendTo

Inbound rules to alter:

1. ‘In from AD – Group Join’
   
2. ‘In from AD – Group Common’
   

Outbound rules to alter:

1. Out to AAD – Group Identity
   
2. Out to ADD – Group Dynamics CRM
   
3. Out to AAD – Group Intune
   
4. Out to AAD – Group LyncOnline
   
5. Out to AAD – Group SharePointOnline
   
6. Out to AAD – Group Azure RMS
   

Hurrah! You should now be able to set the ‘msExchRequireAuthToSendTo’ AD attribute for your distribution group, sync your AD with Azure and find that the option has altered in 365 right? Right?

RIGHT! It should now work. J