๐ง Recipe ยท Exchange & Email
Add an Email Alias (Proxy Address) to a Mailbox via Microsoft Graph
Add a secondary SMTP address to a Microsoft 365 mailbox so it can receive mail at multiple addresses
Complexity
Beginner
Impact
mail-flow + identity + low-risk + reversible
Context
Why This Matters
Email aliases (also known as proxy addresses) let a single mailbox receive mail at more than one address without creating additional licensed users. Common scenarios include:
- A shared mailbox like
info@contoso.comthat also needs to accept mail forcontact@contoso.com. - Adding a personalized alias (e.g.
firstname.lastname@contoso.com) alongside a standardflast@contoso.comUPN. - Absorbing mail flow for a newly-acquired domain into an existing mailbox.
In Microsoft 365, aliases are stored on the user object as the proxyAddresses multi-valued attribute. Each entry is prefixed with SMTP: (uppercase, for the primary address) or smtp: (lowercase, for secondary aliases).
This recipe shows how to safely add a new alias without accidentally removing existing ones or demoting the primary address.
Expected Outcomes
After following this recipe you will have:
- Added the new alias as a lowercase
smtp:entry in the mailbox'sproxyAddressescollection. - Preserved the existing primary (
SMTP:) address and all other aliases. - Verified the alias is registered on the user object and ready to receive mail (typically within a few minutes).
Risks & Considerations
Warnings & gotchas
- The domain must be verified in your Microsoft 365 tenant before it can be used in a proxy address. Unverified domains will be rejected by Graph.
- Case matters. Only one entry should begin with uppercase
SMTP:โ that is the primary reply address. Adding a second uppercase entry, or changing case accidentally, will change the reply-from address for the mailbox. - Uniqueness is enforced tenant-wide. An alias cannot be assigned if the same SMTP address is already in use on any other user, group, or mailbox.
- PATCH replaces the entire array. When updating
proxyAddressesvia Graph, always send the full existing list plus the new entry โ sending only the new entry will wipe existing aliases. - If the mailbox is synced from on-premises Active Directory, changes made in the cloud will be overwritten by AD Connect. Make the change on the on-prem user's
proxyAddressesattribute instead. - Propagation to Exchange Online directory can take a few minutes. Test delivery only after waiting.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| User.ReadWrite.All | Required to read and update the proxyAddresses attribute on user objects. |
| Directory.ReadWrite.All | Alternative, broader permission that also permits modifying directory objects including user proxy addresses. |
| Exchange Administrator or Global Administrator role | Required when using the Exchange admin center or Exchange Online PowerShell (Set-Mailbox) instead of Graph. |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
For End Users
How an employee would ask Dex for help
Add an alias using the Microsoft 365 admin center
- Sign in to the Microsoft 365 admin center as a Global Administrator, User Administrator, or Exchange Administrator.
- Navigate to (for a regular user mailbox) or (for a shared mailbox).
- Click the display name of the mailbox you want to modify (for example,
info@contoso.com). - In the flyout, select the Mail tab, then click Manage email aliases.
- In the Alias field, type the local part of the new alias (e.g.
dex), then choose the verified domain from the dropdown (e.g.contoso.com). Click Add. - Click Save changes. The alias appears in the list with the label Alias; the address marked Primary remains unchanged.
- Wait 5โ10 minutes for directory propagation, then send a test message to the new alias to confirm delivery.
Shared mailboxes (Exchange admin center)
- Go to the Exchange admin center.
- Select and open the target mailbox.
- Under General โ Manage email address types, click + Add email address type, choose SMTP, enter the alias, and save.
Add an alias using Microsoft Graph
Aliases are managed as the proxyAddresses property on the user resource. Because proxyAddresses is a collection, a PATCH replaces the full list โ so you must first read the existing values, append the new one, and write the combined list back.
Step 1 โ Read the current proxy addresses
GET https://graph.microsoft.com/v1.0/users/{mailbox-upn}?$select=id,displayName,userPrincipalName,proxyAddressesExample response:
{
"id": "6a6900a9-c0a6-4d0c-8e4f-5fe437f6b460",
"displayName": "Info",
"userPrincipalName": "info@contoso.com",
"proxyAddresses": [
"SMTP:info@contoso.com"
]
}Step 2 โ Check whether the alias already exists
Compare case-insensitively against the existing entries. If smtp:dex@contoso.com or SMTP:dex@contoso.com is already present, stop โ no action is required.
Step 3 โ PATCH the user with the combined list
PATCH https://graph.microsoft.com/v1.0/users/{mailbox-upn}
Content-Type: application/json
{
"proxyAddresses": [
"SMTP:info@contoso.com",
"smtp:dex@contoso.com"
]
}A successful request returns 204 No Content.
Step 4 โ Verify
Re-run the GET from Step 1 and confirm the new smtp: entry is present and the uppercase SMTP: primary is unchanged.
Common errors
| Status | Meaning | Fix |
|---|---|---|
400 | Unable to update the specified properties for objects that have originated within an external service. | The user is synced from on-prem AD. Modify the on-prem proxyAddresses attribute. |
400 | Another object with the same value for property proxyAddresses already exists. | The alias is in use elsewhere in the tenant. Locate and remove the conflicting entry first. |
403 | Insufficient privileges. | Consent to User.ReadWrite.All (or Directory.ReadWrite.All). |
Add an alias using PowerShell
You have two good options depending on what's installed:
Option A โ Microsoft Graph PowerShell SDK (recommended)
Install once:
Install-Module Microsoft.Graph -Scope CurrentUserThen:
Connect-MgGraph -Scopes "User.ReadWrite.All"
# Read current proxyAddresses
$mailbox = "info@contoso.com"
$newAlias = "dex@contoso.com"
$user = Get-MgUser -UserId $mailbox -Property Id,ProxyAddresses
$existing = @($user.ProxyAddresses)
# Skip if already present (case-insensitive on the address part)
if ($existing -match "^smtp:$([regex]::Escape($newAlias))$") {
Write-Host "Alias already exists โ no change."
return
}
$updated = $existing + "smtp:$newAlias"
Update-MgUser -UserId $user.Id -ProxyAddresses $updatedOption B โ Exchange Online PowerShell
If you prefer the Exchange cmdlets:
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline
Set-Mailbox -Identity "info@contoso.com" `
-EmailAddresses @{Add="smtp:dex@contoso.com"}The @{Add=...} hashtable syntax adds to the existing list without replacing it โ safer than passing a full array.
Verify
Get-MgUser -UserId "info@contoso.com" -Property ProxyAddresses |
Select-Object -ExpandProperty ProxyAddressesNext steps