This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
I currently have a client with an Entra ID user (not migrated from on-premises) that is cloud-based, but has proxyAddresses values assigned.
Now, I want to update the proxyAddresses through the Graph Explorer and have used this link as a guide: https://learn.microsoft.com/en-us/answers/questions/2280046/entra-connect-sync-blocking-user-creation-due-to-h.
Now this guide is suggesting you can use the BETA model and this URL format...
It states you can use that URL to do both 'GET' and 'PATCH' queries - the PATCH query being the one that will change the settings. You have to put forth a body for the proxyAddresses property in the PATCH query, which represents all of the addresses you want the user to utilise as proxy addresses.
Now the GET query works...
The PATCH query does not...
Screenshot provided:
Now, regarding the error message, I have applied ALL possible permissions in the 'Modify Permissions' tab. It is still erroring,
Now I cannot use Exchange Online PowerShell, as the user does not have a mailbox!
Aside from potentially using a license for Exchange Online or provisioning a mailbox for the user, and making the necessary changes, would the only other option be to delete/recreate the user?
@Steven Perazzo could you possibly give guidance here, please?
A cloud-based identity and access management service for securing user authentication and resource access
Yes, delete and recreate the user if you can not apply an Exchange License. I have never been able to make that work otherwise :) This hints that a license is required:
Hi Andy.
I truly appreciate your quick response.
I would love to know how the user from the article (https://learn.microsoft.com/en-us/answers/questions/2280046/entra-connect-sync-blocking-user-creation-due-to-h.) I mentioned above got it working! :-)
At this moment time now, I am going to have to delete the user to remove reference to the mail/proxyAddresses it has associated with it, and create a Shared Mailbox with the same mail address.
Before I delete the user, I have noticed that the mail address has some flow rules associated with it. Would you know how they are impacted if I delete the user/create the Shared Mailbox?
Jason
Provisioning an Exchange licence against the existing cloud-based user allowed for the mail and proxyAddresses attributes to be reset. The problem is now fixed.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(137.6, 60%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBT%3C/text%3E%3C/svg%3E)
Can confirm this worked for me on a cloud-only Entra ID user (no Exchange Online license, RecipientType: User, no mailbox).
Update-MgUser -ProxyAddresses via the Microsoft.Graph PowerShell SDK fails with the documented read-only error:
Property 'proxyAddresses' is read-only and cannot be set.
But issuing a raw PATCH against the beta endpoint succeeds where the v1.0 SDK cmdlet does not:
$body = @{ proxyAddresses = @("SMTP:******@domain.com") } | ConvertTo-Json Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/beta/users/{userId}" -Body $body -ContentType "application/json"
A follow-up GET confirmed the full proxyAddresses array was replaced as requested.
Worth noting for anyone relying on this: the official docs for proxyAddresses still list it as read-only in both v1.0 and beta, so this is undocumented behavior on Microsoft's part, not a supported write path. I'd treat it as something that could be locked down or changed without notice