Licensing your Entra Administrator accounts for email is a common practice to ensure you are across service health updates, user, security and billing alerts but by doing this it introduces security risks and additional costs for mailbox licensing. As a best practice, privileged accounts should remain isolated from unnecessary communication channels to minimise vulnerabilities or avenues of attack. Using Plus Addressing we a simple and cost-effective way to receive admin notifications without assigning a mailbox license.
Firstly, ensure that your M365 Exchange Online Org has plus addressing enabled. To confirm, log into Exchange Admin Centre (EAC), navigate to Settings and Mail Flow. Once the blade opens on the right, ensure that “Turn off plus addressing for your organization” is not ticked (this is usually not unless you have a very old tenancy). There is nothing you need to do on the user mailbox side.
Now navigate to Entra Admin Centre and go to the global admin user that you want to add the plus address to. Select Properties then click Edit Contact Information. Under the Email Contact field, we can add the custom plus address such as [email protected] we can use anything you want for the plus address (similar to the Gmail feature). Click Save to make that permanent.
We can also easily set this property using Microsoft Graph PowerShell using the following commands
Connect-MgGraph -Scope User.ReadWrite.All
Update-MgUser -Userid [email protected] -Mail [email protected]
Now once the contact property has been added this should start working. You can test this by sending an e-mail to the plus address you’ve specified. I’d also suggest setting up an Outlook rule to keep the inbox tidy and again you can simply target anything sent to the plus address.
Leave a Reply