Exchange Online recipients

Exchange Online, not on-premises Exchange

This page covers Microsoft 365 mail. The on-premises Exchange equivalents have the same names and different screens.

Four recipient types beyond mailboxes, each with its own screen.

Contacts

An address-book entry for someone outside the organization. No mailbox, no licence consumed — it exists so external people are findable and can be added to lists.

Each contact has general settings and a mail flow tab.

Distribution lists

Mail to one address is delivered to every member. Tabs cover general settings, addresses, member-of, permissions and mail flow, and a report lists the organization’s groups with their membership.

Restrict who can send to large lists

By default a list may accept mail from outside the organization. Anyone on the internet who learns an all-staff address can then mail everyone at once — a phishing delivery mechanism and a reply-all storm waiting to happen.

Restrict large lists to authenticated internal senders on the mail flow tab.

Dynamic distribution lists

Membership is not stored — it is evaluated from a filter each time mail is sent. A new starter matching the filter is included automatically; a leaver drops out.

Tabs cover delivery management, message approval, email options, MailTips and group delegation.

You cannot review the membership before sending

Because it resolves at send time, there is no roster to check. A filter broader than intended is discovered after the mail has gone.

Verify the filter against the current directory before using a dynamic list for anything sensitive, and use a static list where the audience must be exact.

A dynamic list is only as good as the directory attributes it filters on. One filtered on department depends on the department field being right on every user.

Mail-enabled security groups

A security group that also receives mail — it grants access to resources and acts as a distribution list.

Membership changes do two things at once

Adding someone to a mail-enabled security group grants them whatever that group’s permissions grant, not just a place on a mailing list. Someone added “so they get the emails” may also gain access to files, sites or mailboxes.

Check what the group secures before changing its membership, and prefer a plain distribution list where only mail is intended.

Which to use

	Use
External people in the address book	Contact
A fixed, auditable audience	Distribution list
An audience that follows a directory attribute	Dynamic distribution list
Access and mail for the same set of people	Mail-enabled security group

Related

• Exchange Online mailboxes
• Transport and journaling rules