Personal e-mail appearing in O365

[SVSITSupport]

Hello

 

We've had an issue arise where students are searching for a teacher, and their personal @Outlook.com e-mail appears in the directory in O365..

 

There is no trace of this in AD, and never has been (syncing via AADS)

There is no record at all in the EAC for the Outlook address

The only place this would have been used, was when they were in the process of joining the school, correspondence would have been sent to and from that e-mail, but only via a single mailbox (for recruitment)

 

When I search from my mailbox, I can hover over the address and click the 'X' to remove it, however that is only for me (and I have never e-mailed this teacher)

I've then gone in to another user mailbox and started to search but it's still there (just to prove that my last step was only affecting my address book)

 

Has anyone seen this before/knows what it could be?

 

Thank you in advance

[synaesthesia]

In the global directory? I'd be running content searches and message traces to absolutely ensure they haven't sent an email or two accidentally (or ignorantly) from their personal address first and foremost. Contacts don't get added to the global address list just because they've emailed in once or twice though...

[TechMonkey]

I bet they have attached a home account when signing in. I've not found the process that does this but have seen them. Check in Azure AD, and set the "Show" drop down to show "Guest users only". I've never seen them come up in GAL though so there may be a way to hide them.

[E_G_R2]

We had this with a member of staff who cc'd themselves on all emails to there personal email (don't ask) then their address got propagated out into our email environment by people clicking reply all.

 

Apparently this removes the address vi power-shell

 

Set-Mailuser – Identity “[email protected]” –HiddenFromAddressListsEnabled $true

Set-MailContact – Identity “[email protected]” –HiddenFromAddressListsEnabled $true

[SVSITSupport]

Thanks for the quick replies

 

@synaesthesia - I'm just running a 90 day trace, but at present from the last 7 days there has been 3 e-mails outbound to the outlook address (3 students sending homework) and 3 e-mails inbound (the teacher then forwarding them back to her school account) - I agree mailing them shouldn't make them appear, but her personal e-mail isn't even on her MIS profile!

 

@TechMonkey - no such luck with AAD unfortunately, again no results - there's only 40 or so in that list altogether

 

@E_G_R2 - I tried that to begin with (we had a case before where contacts weren't hidden from the GAL so all parent contacts stored in AD were visible to students..) - unfortunately no luck with that either, as there is no User or Contact that exists to hide

[djm968]

Had this recently and had to do a new Compliance search for the email address and use this search in Powershell to do a brute force delete of all messages containing this address.

 

New-ComplianceSearchAction -SearchName "Your Compliance Search Name" -Purge

[SVSITSupport]

@djm968 - thank you so much, that did the trick!

 

Resolution for anyone who may stumble across this at a later date..

1) create a new content search in O365 - https://docs.microsoft.com/en-us/microsoft-365/compliance/content-search?view=o365-worldwide - add condition, type - email, add/remove more options, select 'contacts', search location select all on the Exchange e-mail group - save & run

2) scan through the results just to make sure it's what you're after

3) connect to an instance of SCC through PowerShell - https://docs.microsoft.com/en-us/powershell/exchange/office-365-scc/connect-to-scc-powershell/connect-to-scc-powershell?view=exchange-ps

4) once connected, run djm968's command - New-ComplianceSearchAction -SearchName "compliance search name" -Purge (changing compliance search name to the name you specified in step 1, keeping the quotations)

5) leave it a little while to run - I couldn't find a command to check the status, but I found that if you run it again it should return a result, with the last column being status - complete

Edited April 1, 2020 by SVSITSupport