Understanding GALs

[CyBeRkId2002]

Afternoon all,

 

I am currently in the process of planning details on a centralised migration of Microsoft Tenencies and want to understand a little more on GAL from those who understand them. Understandably we want to seperate school to school comms (for safeguarding reasons) as well as provide email addresses to Governors / Trustees who should not have access to students emails.

 

In short, I am struggling to understand the difference between GALs and Address Book Policies - and to find a reliable and

 

• I believe GALs can be defined with filters when they are created - either precanned or based upon user attributes. Are these allocated at the point of user account creation, or are users checked against these lists periodically?
  
• What happens if a user meets the coniditons in two GALs filters
  
• Are they a reliable way of allocating users to GALs
  
• Where do Address List Policies fit in with all of this?
  

 

Ultimately I want a solid way to put these restictions in place, to allow us to setup GALs as we see fit - but most importantly be reassured that users are reliably being allocated to these groups.

[Boredguy]

We have several GAL's and Mailbox policies setup, so that our Students only get a mailbox with fellow students and Teachers, and not the support staff and governors.

 

When student e-mail accounts are created, we assign them the specific Address book Policy.

Set-Mailbox -Identity $user.UserPrincipalName -AddressBookPolicy "ABP_Students"

 

You can have as many GALs and Address book polices as you wish based on your settings.

For us with 5 schools, we are planning to have 10 or more GAL's configured. 1 for each school for students and the Teachers of that site.

1 for each school site for the Governors so they only have access to their own address and staff

and 1 for the central staff who have access to all the Staff across the MAT

 

 

Example of the Address Lists currently assigned to our Student Addressbook Policy

AddressLists               : {\AL_Students, \AL_Teaching_Staff}
GlobalAddressList          : \GAL_Students
RoomList                   : \AL_Student_Resources
OfflineAddressBook         : \OAB_Students

 

PS N:\> Get-AddressList -Identity "AL_Students"

Name                      DisplayName               RecipientFilter                                                                                                                               
----                      -----------               ---------------                                                                                                                               
AL_Students               Student Address List      ((RecipientType -eq 'UserMailbox') -and (Office -eq 'Student'))  

Edited November 10, 2021 by Boredguy

[CyBeRkId2002]

Thanks fgor taking the time to reply in so much detail! I clarifies things a little, but I am still at a loss on a couple of bits:

 

You have a recipient filter which puts Student (for example) in an Address List. When does this run? At student account creation? Hourly? Daily?

What happens if users match recipient filters for more than one Address List (guessing it would put them in all as students can be in MULTIPLE address list.

 

How do you define your Global Address Lists? Do you use Recipient filters too, or is it as simple as which GAL a user ends up in depends on Address Book Policy?

 

I think ultimately I am going to end up forgetting about RecipientFilters and just writing a script to run hourly that Assigns address book policy based on similar filters - I was just hoping there was a simpler way that didn't rely on scripts running (we all know scripts break from time to time)

[Boredguy]

We have a powershell script that runs hourly during the day that checks for any student accounts that does not have their Address book policy set, which updates it to the correct one and also sets that account to use a student mailbox policy we have as well, mainly so that any new accounts we create. we used to use the script for assigning licences as well before they brought in the Group membership feature in Azure.

 

The Student address list in the example above only includes User mailboxes (so no rooms/resources etc hence the recipient Type) and only if the Office value in the users details is "student".

You can have as many different Address List types as you want which you can use to create your required policy.

 

The GAL for students is then defined based on the information I want in it. When I did our way back in 2015/16 I followed this guide from MS https://blogs.technet.microsoft.com/educloud/2013/04/15/alumni-address-book-policy-in-office-365-education/

[CyBeRkId2002]

Ok... I thought I would update this for anyone else who stumbles across this in the future as it has taken me hours to really get my head around it!

 

• Most importantly users can be in multiple GALs at the same time, contrary to what I had read on multiple websites / blogs / pages. If they meet the requirements of the recipient filter they will appear in that GAL, regardless of which other GALs they appear in
  
• Who appears on a Global Address list is defined solely by the recipient filter assigned to that Global Address List
  
• Who can SEE the global address list is defined by the AddressBookPolicy assigned to that user. If no policy is defined they default to the default GAL which includes everyone.
  
• 
  

 

Out of curiosity, in the interest of safeguarding, has anyone removed the recipient filter from the default GAL so no-one appears in this list? Tempted to do this as if the script breaks, stops working at any point I would rather users get an empty GAL than one with potentially other users from other schools.