📧 Recipe · Exchange & Email

Create a Distribution List and Configure Shared Mailbox Forwarding

Provision a mail-enabled distribution list with external members and forward a shared mailbox (and its aliases) to it

Complexity

Intermediate

Impact

mail-flow + exchange-online + distribution-group + shared-mailbox + forwarding

Context

Why This Matters

A common Exchange Online pattern is to route inbound mail from a public-facing address (e.g. info@company.com) to a small team rather than a single person. The clean way to do this is:

Create a mail-enabled distribution list (DL) that contains the recipients.
Ensure any non-tenant members exist as Mail Contacts (DLs cannot contain raw external addresses — they need directory objects).
Configure the DL to accept mail from external senders.
Set mailbox forwarding on the shared mailbox so every message (including those delivered to its SMTP aliases, such as dex@company.com) is redirected to the DL.

Run this recipe when you are standing up a new shared inbox, reorganising who owns an existing one, or consolidating multiple aliases behind a single team-routing address.

Important platform note: Microsoft Graph cannot create classic distribution lists, cannot create Exchange mail contacts, and in most tenants cannot modify a mailbox's forwarding SMTP address. These are Exchange Online objects owned by the Exchange service. The authoritative tooling is Exchange Online PowerShell or the Exchange Admin Center. Graph is only useful here for preflight lookups (confirming users, aliases, and existing groups).

Expected Outcomes

After completing this recipe you will have:

A mail-enabled distribution list {dl_address} visible in the Exchange Admin Center and GAL.
All required members (internal users and/or external mail contacts) added to the DL.
The DL configured to accept mail from senders outside the organization.
The source shared mailbox {source_mailbox} forwarding all inbound mail to the DL, with or without keeping a local copy.
Verified that mail sent to any SMTP alias of the shared mailbox (e.g. {alias_address}) also flows to DL members, because aliases are accepted addresses on the same mailbox and follow the same forwarding rule.

Risks & Considerations

Warnings and gotchas

Graph API limitation: POST /v1.0/groups with mailEnabled:true and securityEnabled:false returns Request_BadRequest — Graph does not author distribution lists. Do not loop on this; switch to Exchange Online PowerShell.
External members must be Mail Contacts. A distribution list cannot store a bare external SMTP address; you must first create a MailContact with New-MailContact, then add it with Add-DistributionGroupMember.
Anti-auto-forwarding policy: Many tenants have an outbound anti-spam policy that blocks auto-forwarding to external recipients. If the DL contains external contacts and the shared mailbox forwards to it, recipients may silently stop getting mail. Review Anti-spam outbound policy → Automatic forwarding rules before going live.
External senders to the DL: Setting RequireSenderAuthenticationEnabled $false allows anyone on the internet to mail the list. This is usually desired for info@-style addresses but increases spam exposure — keep the DL protected by your normal inbound mail hygiene.
Keep a copy? Decide whether the shared mailbox should also retain a local copy (DeliverToMailboxAndForward $true) for auditing/compliance, or forward only ($false). Forwarding-only means no archive in the source mailbox.
Graph mailbox forwarding is restricted. Even with MailboxSettings.ReadWrite, setting ForwardingSmtpAddress via Graph is blocked in most tenants for anti-exfiltration reasons. Use Set-Mailbox in Exchange Online PowerShell.
Licensing: The source shared mailbox under 50 GB does not require a license, but must not be converted to a regular mailbox during this work.

Required Permissions

Permission	Why It's Needed
Exchange Administrator (or Recipient Administrator) role	Required to create distribution groups, mail contacts, and modify mailbox forwarding in Exchange Online.
User.Read.All (Graph)	Preflight lookups to confirm the source mailbox exists and to enumerate its proxyAddresses (aliases).
Group.Read.All (Graph)	Preflight check that the target DL mailNickname/SMTP is not already in use.
ExchangeOnlineManagement PowerShell module	All write operations (New-DistributionGroup, New-MailContact, Set-Mailbox) are performed against Exchange Online, not Graph.

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

Create a distribution list {dl_address} (display name {dl_display_name}) with members {member_list}. For any members outside the tenant, create Mail Contacts first. Allow external senders to email the list. Then configure {source_mailbox} to auto-forward all mail to {dl_address} (keep a copy in the mailbox: {true|false}), and confirm that messages sent to its aliases (e.g. {alias_address}) also reach the DL members. Use Exchange Online PowerShell — Graph can't do this.

Try in Dex Pro

For End Users

How an employee would ask Dex for help

Mail sent to our info@ address should go to me and two teammates instead of just one shared inbox — can you set that up?

Try in Dex Playground

Using the Exchange Admin Center (EAC)

Navigation: admin.exchange.microsoft.com → Recipients

Step 1 — Create mail contacts for any external members

Go to Recipients → Contacts.
Click Add a mail contact.
Enter display name, alias, and external email address (e.g. person@partner.com).
Save. Repeat for every external member of the DL.

Step 2 — Create the distribution list

Go to Recipients → Groups → Distribution list.
Click Add a group and choose Distribution.
Name: e.g. Marketing Notifications. Alias: {dl_alias}. Primary SMTP: {dl_address}.
Assign an owner (typically an admin or team lead).
Add members: select the internal users and the mail contacts created in Step 1.
On the Settings page, under Communication, check Allow external senders to email this group.
Review and Create group.

Step 3 — Confirm external-sender setting

Open the new group → Settings → Edit delivery management.
Select Senders inside and outside of my organization. Save.

Step 4 — Configure forwarding on the shared mailbox

Go to Recipients → Mailboxes and open {source_mailbox}.
On the Mailbox tab, scroll to Manage email forwarding.
Toggle Forward all emails sent to this mailbox ON.
Enter the DL address {dl_address}.
Decide whether to also keep a copy in the shared mailbox (Deliver message to both forwarding address and mailbox).
Save.

Step 5 — Verify alias behavior

Aliases on the shared mailbox (e.g. {alias_address}) are accepted addresses on the same mailbox object — they do not need separate configuration. Send a test message to each alias and confirm every DL member receives it.

Graph API — scope and limits

Graph is not the right tool to perform the write operations in this recipe. Graph can only be used for read-only preflight checks. Attempting POST /groups with mailEnabled:true, securityEnabled:false returns Request_BadRequest — Exchange owns distribution list authoring. Mailbox ForwardingSmtpAddress is also not writable via Graph in most tenants.

Preflight 1 — Confirm the DL does not already exist

GET https://graph.microsoft.com/v1.0/groups?$filter=mailNickname eq '{dl_alias}' or mail eq '{dl_address}'

Expected: value: []. If non-empty, an object with that alias already exists — stop and reconcile.

Preflight 2 — Confirm the source mailbox and list its aliases

GET https://graph.microsoft.com/v1.0/users?$filter=mail eq '{source_mailbox}'&$select=id,displayName,userPrincipalName,mail,proxyAddresses

Look at proxyAddresses — every entry prefixed smtp: (lowercase) is an alias; the single SMTP: (uppercase) entry is the primary. Confirm {alias_address} is listed.

Preflight 3 — Resolve internal member UPNs

GET https://graph.microsoft.com/v1.0/users?$filter=userPrincipalName eq '{member1_upn}' or userPrincipalName eq '{member2_upn}'&$select=id,userPrincipalName,mail

What Graph will refuse to do

POST /groups to create a DL → Request_BadRequest.
POST /contacts to create an Exchange mail contact → Graph /contacts is personal contacts, not org mail contacts.
PATCH /users/{id}/mailboxSettings with a forwardingAddress property → property does not exist on mailboxSettings; ForwardingSmtpAddress is an Exchange mailbox property, not a mailbox setting.

For the actual writes, use the PowerShell recipe below.

Exchange Online PowerShell — the authoritative path

This is the recommended way to perform every step of the recipe. It works end-to-end in a single session.

1. Connect

Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

2. Create mail contacts for external members

New-MailContact -Name "Jane External" -ExternalEmailAddress "jane@partner.com"

Repeat for each external address. Internal users do not need a contact — reference them by UPN.

3. Create the distribution list

New-DistributionGroup `
    -Name "Marketing Notifications" `
    -Alias "{dl_alias}" `
    -PrimarySmtpAddress "{dl_address}" `
    -Type Distribution `
    -MemberJoinRestriction Closed `
    -MemberDepartRestriction Closed

4. Allow external senders

Set-DistributionGroup -Identity "{dl_address}" `
    -RequireSenderAuthenticationEnabled $false

5. Add members (internal users + mail contacts)

Add-DistributionGroupMember -Identity "{dl_address}" -Member "user1@contoso.com"
Add-DistributionGroupMember -Identity "{dl_address}" -Member "jane@partner.com"   # resolved via the mail contact created in step 2

6. Configure forwarding on the shared mailbox

Set-Mailbox -Identity "{source_mailbox}" `
    -ForwardingSmtpAddress "{dl_address}" `
    -DeliverToMailboxAndForward $true   # $false = forward only, no local copy

7. Verify

Get-DistributionGroup "{dl_address}" | Select DisplayName,PrimarySmtpAddress,RequireSenderAuthenticationEnabled
Get-DistributionGroupMember "{dl_address}"
Get-Mailbox "{source_mailbox}" | Select ForwardingSmtpAddress,DeliverToMailboxAndForward,EmailAddresses

Then send a test message to both {source_mailbox} and any alias (e.g. {alias_address}) and confirm all DL members receive it.

Next steps

More Exchange & Email recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.