[GUIDE] Hide users from Global Address List in AD Hybrid Joined Domains.


Recommended Posts

My company recently deployed a Hybrid Joined environment, and we came across an issue where the Entra and Admin portals were not allowing us to hide accounts from the global address list any longer. Here is the solution I came up with the resolve the issue.

1) on the Machine hosting the AD Connect tool. Open Synchronization Rules Editor.

2) Verify Direction is set to "Inbound" and then click "Add new Rule" On the right side.

image.png.c008691f482ef3031e2aa5789d71404d.png

3) Give it a name like "Hide user from GAL" or whatever makes sense to you. Connected System is your Local Domain, Connected System Object Type "User", Metaverse object type "Person", Link Type "Join", Precedence "50", then leave Tag, Enable Password Sync, and Disabled alone.

image.png.0232cdcdebf194a9ded046d2ac21bbb7.png

4) Hit Next, and Skip, "Scoping Filter, and Join Rules"

5) on Transformation rules, set Flow Type to "Expression", Target Attribute to "msExchHideFromAddressLists", then set Merge Type to "Update" Use the following script in the "Source" field.
 

IIF(IsPresent([msDS-cloudExtensionAttribute1]),IIF([msDS-cloudExtensionAttribute1]="HideFromGAL",True,False),NULL)

6) Thats the Hard part done. Now you need to manipulate each user account that you want to be hidden. You have 2 options here, you can use PowerShell, or just AD Users and Computers.

7) The PowerShell way.

8 ) Run PowerShell as a Domain Admin and simply run the command below.

Set-ADUser -Identity "FULL USERNAME" -Replace @{'msDS-cloudExtensionAttribute1'="HideFromGAL"}

9) The AD Users and Computers way

10) Open AD Users and Computers and click View to Verify "Advanced Features" is enabled.

11) Manually navigate to the user that needs hidden. unfortunately you cannot use the Search command here because when you search for a user Attrribute editor is not available.

12) on the user in question go to the Attribute Editor tab and then look for "msDS-cloudExtensionAttribute1", and set it to "HideFromGAL"

13) Once you have updated the user, either way for the AD to Azure Sync or force it to run. (You can do that from the machine running the Azure AD Connect by running PowerShell as an admin and running the following command.)

start-adsyncsynccycle -policytype delta

 

Can I assume you removed your last exchange box\management tools?

If Exchange wasn't present, extend the AD schema (using the Exchange setup) and install the Exchange management tools, you'll be able to hide the a user from a GAL in a supported\non hacky way.

https://learn.microsoft.com/en-us/Exchange/plan-and-deploy/prepare-ad-and-domains?view=exchserver-2019

In this circumstance we are not using self-hosted Exchange we are using M365 Exchange so there are no management tools other than the include Exchange admin center, Entra, and M365 Admin Center. All of which when you attempt to Hide a user from GAL you receive a Generic error message. The check boxes are there it just refuses to comply. I even tried using the Attribute editor to set " msExchHideFromAddressLists" attribute to True however, it did nothing.

image.png

I understand what you've got configured, the supported method of hiding from the GAL is to extend the AD schema with the Exchange attributes. Once you've done that you'll be able to install the Exchange management tools (Exchange shell specifically), and hide users from the GAL.

...I know because this is exactly what I've configured in many greenfield deployments in the past several years, on-prem AD becomes the source anchor when you turn on directory sync.

To be clear, you don't need a full Exchange Server configured.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Posts

    • OneDrive for Mac now lets you sync files to removable drives by Taras Buria If you use OneDrive on Mac and often work with external drives (a common sight among Mac users where internal storage is not upgradeable), Microsoft has some good news for you: the OneDrive client for macOS now supports removable drives, allowing you to sync files to external disks, both non-removable and removable. Microsoft introduced external drive support in OneDrive for Mac at the beginning of 2025. However, the initial rollout was limited to drives that macOS detects as non-removable. The company received plenty of feedback from users regarding this change, and it is now addressing the inability to sync files to removable drives. External drive support in OneDrive works the same way as syncing files to internal storage. If you unplug your drive, say, a portable SSD, OneDrive will stop syncing and notify you with an error message (there is a short delay for drives that sporadically disconnect). To resume sync, reconnect your drive and restart OneDrive. If you want to sync OneDrive to an external drive, your drive should be formatted for APFS (Apple File System) and protected by FileVault (read-only, network, and quarantined drives are not supported). Also, you need macOS version 15.0 or newer and OneDrive version 25.097 or newer. For now, external drive support is only available for insiders, but a wider rollout is coming soon. Finally, Microsoft adds that external drive support does not allow moving drives between devices. Therefore, you must set up OneDrive sync again every time you connect your drive to a new Mac. You can read more about external drive support in OneDrive for Mac in a post on the official Tech Community website. In other OneDrive news, check out our recently published guide, which details how to change OneDrive folder colors for extra personalization.
    • I'm here for it! Bill Pullman & Rick Moranis Returning For New ‘Spaceballs’; Keke Palmer Also Set https://deadline.com/2025/06/spaceballs-2-casts-rick-moranis-bill-pullman-keke-palmer-1236431204/ It's gonna be epic! 
    • Lipstick on a data-hungry pig...
    • I really feel like we need a 3rd good phone OS option to compete with Google and Apple.
    • After 40 years we asked what the fans want...... and are making this movie anyway! 
  • Recent Achievements

    • One Month Later
      POR2GAL4EVER earned a badge
      One Month Later
    • One Year In
      Orpheus13 earned a badge
      One Year In
    • One Month Later
      Orpheus13 earned a badge
      One Month Later
    • Week One Done
      Orpheus13 earned a badge
      Week One Done
    • Week One Done
      serfegyed earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      536
    2. 2
      ATLien_0
      262
    3. 3
      +FloatingFatMan
      205
    4. 4
      +Edouard
      168
    5. 5
      Xenon
      124
  • Tell a friend

    Love Neowin? Tell a friend!