Sign in with Microsoft
Sign in or create an account.
Hello,
Select a different account.
You have multiple accounts
Choose the account you want to sign in with.

Symptoms

In Microsoft Exchange Server 2019 or Exchange Server 2016, a user might have two Windows accounts, one without a mailbox (for example, this is used for administrative purposes), let's call this WindowsOnlyAccount and a standard mailbox account to which an AddressBookPolicy is applied. When the WindowsOnlyAccount is currently logged on, the user can create an Outlook online-mode profile and provide the credentials of the mailbox account. In this scenario, address list separation isn’t applied any longer for this mailbox user. This results in all address lists being visible and browsable. That means:

  1. All address book information about the exchange organization can be viewed if the user has full permissions to another user's mailbox.

  2. All address book information about the exchange organization can be viewed until Outlook is started at least a second time if the user uses another user's credentials to sign in to his mailbox.

Resolution

To fix this issue, install one of the following updates:

For Exchange Server 2019, install the Cumulative Update 4 for Exchange Server 2019 or a later cumulative update for Exchange Server 2019.

For Exchange Server 2016, install the Cumulative Update 15 for Exchange Server 2016 or a later cumulative update for Exchange Server 2016.

Notes:

  • For Outlook 2016, you need to install the October 1, 2019, update for Outlook 2016 (KB4484107) (or a later update for Outlook 2016) to make sure this update can work together with Outlook. For Outlook 2013, you need to install the October 1, 2019, update for Outlook 2013 (KB4484096) (or a later update for Outlook 2013) to make sure this update can work together with Outlook.

  • After you install this update, an empty address list will be returned for the two scenarios.

  • To enable this fix, you also need to run the following command for your organization:

    Set-OrganizationConfig -EmptyAddressBookForNonExchangeUsers:$true

References

Learn about the  terminology that Microsoft uses to describe software updates.

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.

Was this information helpful?

What affected your experience?
By pressing submit, your feedback will be used to improve Microsoft products and services. Your IT admin will be able to collect this data. Privacy Statement.

Thank you for your feedback!

×