users

User Accounts. Directory user accounts and their per-user briefing settings. The users entity set lives under /exchange/v1.0/users in the Recipients category.

Fact	Value
Path	/exchange/v1.0/users
Category	Recipients
Tier	Tier 0, Directory
Read role	User.Read.All (Community)
Write role	User.ReadWrite.All (Pro)
Backing cmdlets	Get-User, Set-User, Get-UserBriefingConfig, Set-UserBriefingConfig

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/users	List Exchange-side users - every Entra user that Exchange recognizes (with or without a mailbox). OData $filter pushes down to OPATH.	User.Read	Community
GET	/exchange/v1.0/users/{key}	Get a single users entry by Identity.	User.Read	Community
PATCH	/exchange/v1.0/users/{key}	PATCH /users/{key} - partial update via Set-User. Covers personal info, org info, address, display naming, EXO module enablement. Returns 200 + updated entity.	User.ReadWrite	Pro
GET	/exchange/v1.0/users/{key}/briefingConfig	Get-UserBriefingConfig - Cortana / Daily Briefing email opt-in for this user.	User.Read	Community
PATCH	/exchange/v1.0/users/{key}/briefingConfig	PATCH /users/{key}/briefingConfig - toggle the Cortana Daily Briefing email opt-in via Set-UserBriefingConfig. Body: { “enabled”: true|false }. Returns 200 + the refreshed config. The read side is GET /users/{key}/briefingConfig. The cmdlet has no -WhatIf, so ?dryRun=true returns 422 (DryRunUnsupported).	User.ReadWrite	Pro
GET	/exchange/v1.0/users/{key}/mailbox	GET /users/{key}/mailbox - 0..1 navigation. Calls Get-Mailbox directly with the user’s identity (UPN/alias/ExternalDirectoryObjectId all resolve to mailbox identities). Returns 204 if the user has no mailbox.	Mailbox.Read	Community
GET	/exchange/v1.0/users/{key}/memberOf	GET /users/{key}/memberOf - reverse navigation, Graph-style.	User.Read	Community

GET /exchange/v1.0/users

List Exchange-side users - every Entra user that Exchange recognizes (with or without a mailbox). OData $filter pushes down to OPATH.

Backing cmdlet: Get-User. Role: User.Read (Community).

Parameter	In	Type	Required	Description
all	query	bool (switch)		Return all results instead of the EXO default of 1000. Maps -ResultSize Unlimited on Get-User; prevents silent truncation in large tenants.
anr	query	string		Ambiguous name resolution - partial-name search across users. Maps -Anr on Get-User.
isVIP	query	bool (switch)		Return only priority (VIP) accounts. Maps -IsVIP on Get-User.
recipientTypeDetails	query	string		Filter by user subtype (comma-separated, e.g. UserMailbox,RoomMailbox). Maps -RecipientTypeDetails on Get-User.
publicFolder	query	bool (switch)		Scope to public-folder mailboxes. Maps -PublicFolder on Get-User.

List users

Returns Exchange-relevant users (UPN, displayName, mailNickname). For full user attributes - manager, license, sign-in status - use Microsoft Graph’s /users instead; this is a thin Exchange-side projection intentionally (see Architecture §2 Q13).

GET /exchange/v1.0/users?$top=2&$select=Id,UserPrincipalName,DisplayName,MailNickname HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#users(Id,UserPrincipalName,DisplayName,MailNickname)",
  "value": [
    {
      "Id": "_TestUser",
      "UserPrincipalName": "testmailbox@contoso.com",
      "DisplayName": "_TestUser",
      "MailNickname": null
    },
    {
      "Id": "[Forward]",
      "UserPrincipalName": "fwdcontoso@contoso.com",
      "DisplayName": "[Forward]",
      "MailNickname": null
    }
  ]
}

Notes: AccountEnabled is NOT projected onto User - query Graph for full Entra user state. Set-User (PATCH) only covers Exchange-side attributes.

Related: GET /exchange/v1.0/users/{key}, GET /exchange/v1.0/users/{key}/mailbox, GET /exchange/v1.0/users/{key}/memberOf, PATCH /exchange/v1.0/users/{key}

GET /exchange/v1.0/users/{key}

Get a single users entry by Identity.

Backing cmdlet: Get-User. Role: User.Read (Community).

Get a single user by UPN

Returns one Exchange user. Key can be UPN, mailNickname, or Id (Entra ExternalDirectoryObjectId).

GET /exchange/v1.0/users/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#users/$entity",
  "Id": "a003556f-d8a0-4b72-b8fb-24813d53195a",
  "UserPrincipalName": "john.woods@contoso.com",
  "Name": "a003556f-d8a0-4b72-b8fb-24813d53195a",
  "DisplayName": "John Woods",
  "SimpleDisplayName": "",
  "PhoneticDisplayName": "",
  "FirstName": "John",
  "LastName": "Woods",
  "Initials": "",
  "MailNickname": null,
  "SamAccountName": "$S28HG0-BPS5UOJT1AMA",
  "WindowsEmailAddress": "john.woods@contoso.com",
  "Guid": "ad77eeee-5e2f-48e9-af48-6ef69d3787bd",
  "ExternalDirectoryObjectId": "a003556f-d8a0-4b72-b8fb-24813d53195a",
  "DistinguishedName": "CN=a003556f-d8a0-4b72-b8fb-24813d53195a,OU=contoso.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
  "Identity": "a003556f-d8a0-4b72-b8fb-24813d53195a",
  "ImmutableId": null,
  "AccountDisabled": false,
  "RemotePowerShellEnabled": true,
  "IsResource": false,
  "IsShared": false,
  "IsSecurityPrincipal": true,
  "IsLinked": false,
  "IsSoftDeletedByDisable": false,
  "IsSoftDeletedByRemove": false,
  "IsInactiveMailbox": false,
  "Title": "",
  "Department": "Engineering",
  "Company": "Contoso Corporation",
  "Office": "",
  "Manager": "78714c17-4236-406b-98f8-40591a93ac94",
  "AssistantName": "",
  "Phone": "",
  "MobilePhone": "",
  "HomePhone": "",
  "Fax": "",
  "Pager": "",
  "OtherTelephone": null,
  "OtherFax": null,
  "OtherHomePhone": null,
  "TelephoneAssistant": "",
  "WebPage": "",
  "Notes": "",
  "StreetAddress": "",
  "City": "",
  "StateOrProvince": "",
  "PostalCode": "",
  "PostOfficeBox": null,
  "CountryOrRegion": "United States",
  "GeoCoordinates": null,
  "RecipientType": "UserMailbox",
  "RecipientTypeDetails": "UserMailbox",
  "OrganizationalUnit": "eurpr01a017.prod.outlook.com/Microsoft Exchange Hosted Organizations/contoso.com",
  "AuthenticationPolicy": null,
  "AuthenticationFlowPolicy": null,
  "UserAccountControl": "NormalAccount",
  "SeniorityIndex": null,
  "VIP": false,
  "WhenCreated": "2026-03-30T17:05:44+03:00",
  "WhenChanged": "2026-04-22T01:54:43+03:00",
  "WhenCreatedUTC": "2026-03-30T14:05:44Z",
  "WhenChangedUTC": "2026-04-21T22:54:43Z",
  "StsRefreshTokensValidFrom": "2026-04-16T00:47:48+03:00",
  "AdministrativeUnits": [],
  "AgentIdentityBlueprintId": "",
  "AllowUMCallsFromNonUsers": "SearchEnabled",
  "ArchiveRelease": "None",
  "BlockedSendersHash": null,
  "BulkMailEnabled": false,
  "CanHaveCloudCache": false,
  "CertificateSubject": [],
  "CloudCacheAccountType": "None",
  "CloudCacheProvider": 0,
  "CloudCacheRemoteEmailAddress": "",
  "CloudCacheScope": 0,
  "CloudCacheUserName": null,
  "ConsumerNetID": null,
  "CreationType": "None",
  "DefaultMailboxWorkloadsMask": null,
  "DesiredMailboxWorkloads": null,
  "DesiredMailboxWorkloadsGracePeriod": null,
  "DesiredMailboxWorkloadsModified": null,
  "DirectReports": [
    "f1ca8057-e149-4557-855f-ac109b4faa26"
  ],
  "DirectReportsWithDisplayName": [],
  "EXOModuleEnabled": true,
  "EnforcedTimestamps": "[{\"EventTimestamp\":\"2026-04-15T21:48:04.1403015Z\",\"EnforcedUntilTimestamp\":\"2026-04-15T21:43:04.1403015Z\",\"EventType\":17},{\"EventTimestamp\":\"2026-03-11T11:54:45.1989312Z\",\"EnforcedUntilTimestamp\":\"2026-03-11T11:49:45.1989312Z\",\"EventType\":16},{\"EventTimestamp\":\"2026-02-06T16:44:17.813973Z\",\"EnforcedUntilTimestamp\":\"2026-02-06T16:39:17.813973Z\",\"EventType\":16},{\"EventTimestamp\":\"2025-03-18T18:21:59.5722618Z\",\"EnforcedUntilTimestamp\":\"2025-03-18T18:16:59.5722618Z\",\"EventType\":16},{\"EventTimestamp\":\"2025-03-18T17:39:28.4137909Z\",\"EnforcedUntilTimestamp\":\"2025-03-18T17:34:28.4137909Z\",\"EventType\":16}]",
  "ExchangeObjectId": "88239689-1aac-40b1-9a94-5b144bbc3dc7",
  "GrantSendOnBehalfTo": [],
  "InPlaceHoldsRaw": [
    "UniH8bcbfdfd-77ad-4386-b0d2-72eb55fc0b33"
  ],
  "InformationBarrierSegments": [],
  "IsAgenticUser": false,
  "IsCloudCache": false,
  "IsCloudCacheBlocked": false,
  "IsCloudCacheProvisioningComplete": false,
  "IsDirSynced": false,
  "Languages": [
    "en-US"
  ],
  "LegacyExchangeDN": "/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=f59ccb47889e464b89a302bf55708d82-a003556f-d8",
  "LegalAgeGroup": null,
  "LinkedMasterAccount": "",
  "M365BackupState": "None",
  "MailboxLocations": [
    "1;a07b03d2-3759-4d44-ab31-f42b82a8f22d;Primary;eurprd02.prod.outlook.com;418b49d1-d885-47df-b268-f25b5456a281"
  ],
  "MailboxProvisioningConstraint": null,
  "MailboxProvisioningPreferences": [],
  "MailboxRegion": null,
  "MailboxRegionLastUpdateTime": null,
  "MailboxRegionSuffix": "None",
  "MailboxRelease": "E15",
  "MailboxWorkloads": "Mail, Calendar, Contacts, Substrate",
  "ManagerWithDisplayName": [],
  "MicrosoftOnlineServicesID": "john.woods@contoso.com",
  "NetID": "100320037E3AAECB",
  "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.com/Configuration",
  "OrganizationalUnitRoot": "contoso.com",
  "PersistedCapabilities": [
    "WPA_INSIGHTS",
    "M365_COPILOT_INTELLIGENT_SEARCH",
    "M365_COPILOT_BUSINESS_CHAT",
    "BPOS_S_Enterprise",
    "GRAPH_CONNECTORS_SEARCH_INDEX",
    "MYANALYTICSP2",
    "BPOS_S_BookingsAddOn",
    "BPOS_S_O365PremiumEncryption",
    "M365AuditPlatform",
    "MIP_S_CLP2",
    "RecordsManagement",
    "BPOS_S_EquivioAnalytics",
    "BPOS_S_O365PAM",
    "BPOS_S_ThreatIntelligenceAddOn",
    "CustomerKey",
    "M365Auditing",
    "BPOS_S_Analytics",
    "InsiderRiskManagement",
    "BPOS_S_CustomerLockbox",
    "CommunicationsCompliance",
    "BPOS_S_InformationBarriers",
    "InformationGovernance"
  ],
  "PitrCopyIntervalInSeconds": 0,
  "PitrEnabled": false,
  "PitrOffboardedTimestamp": null,
  "PitrPaused": false,
  "PitrPausedTimestamp": null,
  "PitrState": "None",
  "PreviousRecipientTypeDetails": "None",
  "ResetPasswordOnNextLogon": false,
  "RoamingOptIn": false,
  "SKUAssigned": true,
  "SafeRecipientsHash": null,
  "SafeSendersHash": null,
  "SharingAnonymousIdentities": "",
  "Sid": "S-1-5-21-701439281-3420630407-1831248095-22021276",
  "UMCallingLineIds": [],
  "UMDialPlan": null,
  "UMDtmfMap": [],
  "UpgradeDetails": null,
  "UpgradeMessage": null,
  "UpgradeRequest": "None",
  "UpgradeStage": null,
  "UpgradeStageTimeStamp": null,
  "UpgradeStatus": "None",
  "UserIdentityParent": "",
  "UserPersona": "InternalMember",
  "UserType": "Member",
  "VoiceMailSettings": [],
  "WhenIBSegmentChanged": null,
  "WhenSoftDeleted": null,
  "WindowsLiveID": "john.woods@contoso.com"
}

Related: GET /exchange/v1.0/users, GET /exchange/v1.0/users/{key}/mailbox, PATCH /exchange/v1.0/users/{key}

PATCH /exchange/v1.0/users/{key}

PATCH /users/{key} - partial update via Set-User. Covers personal info, org info, address, display naming, EXO module enablement. Returns 200 + updated entity.

Backing cmdlet: Set-User. Role: User.ReadWrite (Pro).

Parameter	In	Type	Required	Description
assistantName	body
authenticationPolicy	body
blockCloudCache	body
canHaveCloudCache	body
city	body
clearDataEncryptionPolicy	body	boolean (switch)
company	body
countryOrRegion	body
department	body
desiredWorkloads	body
displayName	body
exoModuleEnabled	body
fax	body
firstName	body
geoCoordinates	body
homePhone	body
initials	body
isShadowMailbox	body
lastName	body
mailboxRegion	body
mailboxRegionSuffix	body
managedOnboardingType	body
manager	body
mobilePhone	body
name	body
notes	body
office	body
otherFax	body
otherHomePhone	body
otherTelephone	body
pager	body
permanentlyClearPreviousMailboxInfo	body	boolean (switch)
phone	body
phoneticDisplayName	body
postalCode	body
postOfficeBox	body
remotePowerShellEnabled	body
resetPasswordOnNextLogon	body
seniorityIndex	body
simpleDisplayName	body
stateOrProvince	body
streetAddress	body
stsRefreshTokensValidFrom	body
title	body
vip	body
webPage	body
windowsEmailAddress	body
dryRun	query	bool (switch)

Update a user’s personal and org info

Partial update of an Exchange-side user via Set-User. Send only the fields you want changed; the controller returns the re-fetched entity. Backed by the Set-User cmdlet.

PATCH /exchange/v1.0/users/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "displayName": "Exonaut Sample User",
  "department": "Engineering",
  "title": "Senior Platform Engineer"
}

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8

{
  "Identity": "exonaut-sample-users",
  "Id": "exonaut-sample-users",
  "DisplayName": "Exonaut Sample User",
  "Department": "Engineering",
  "Title": "Senior Platform Engineer",
  "WindowsEmailAddress": "exonaut-sample-users@contoso.com"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/users

GET /exchange/v1.0/users/{key}/briefingConfig

Get-UserBriefingConfig - Cortana / Daily Briefing email opt-in for this user.

Backing cmdlet: Get-UserBriefingConfig. Role: User.Read (Community).

PATCH /exchange/v1.0/users/{key}/briefingConfig

PATCH /users/{key}/briefingConfig - toggle the Cortana Daily Briefing email opt-in via Set-UserBriefingConfig. Body: { “enabled”: true|false }. Returns 200 + the refreshed config. The read side is GET /users/{key}/briefingConfig. The cmdlet has no -WhatIf, so ?dryRun=true returns 422 (DryRunUnsupported).

Backing cmdlet: Set-UserBriefingConfig. Role: User.ReadWrite (Pro).

Parameter	In	Type	Required	Description
enabled	body
dryRun	query	bool (switch)

Toggle a user’s Daily Briefing email

Sub-resource of the user at GET /users/{key} - toggles the Cortana / Viva Daily Briefing email opt-in via Set-UserBriefingConfig. Body: { “enabled”: true|false } (required). Returns 200 + the refreshed config. The cmdlet has no -WhatIf, so ?dryRun=true returns 422 (DryRunUnsupported) rather than silently executing.

PATCH /exchange/v1.0/users/{key}/briefingConfig HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "enabled": false
}

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#users('john.woods%40contoso.com')/briefingConfig",
  "Id": "john.woods@contoso.com",
  "Identity": "john.woods@contoso.com",
  "Enabled": false
}

Notes: dryRun-422 behavior live-verified 2026-05-29 (PATCH …/briefingConfig?dryRun=true returns 422 DryRunUnsupported - the cmdlet has no functional -WhatIf). Success body is doc-derived: on this tenant the read-back (Get-UserBriefingConfig) is itself RBAC-gated for the app-only principal (‘Access to the requested resource is forbidden’), so a 200 success could not be live-captured on this tenant; the shape shown is the Wiki-documented config projection. Identifiers sanitized.

Related: GET /exchange/v1.0/users/{key}/briefingConfig

GET /exchange/v1.0/users/{key}/mailbox

GET /users/{key}/mailbox - 0..1 navigation. Calls Get-Mailbox directly with the user’s identity (UPN/alias/ExternalDirectoryObjectId all resolve to mailbox identities). Returns 204 if the user has no mailbox.

Backing cmdlet: Get-Mailbox. Role: Mailbox.Read (Community).

Parameter	In	Type	Required	Description
softDeletedMailbox	query	bool (switch)		Return only the soft-deleted (recoverable) mailbox for this user instead of the active one. Maps -SoftDeletedMailbox on Get-Mailbox.
includeInactiveMailbox	query	bool (switch)		Include the inactive (on-hold, soft-deleted) mailbox for this user in the result. Maps -IncludeInactiveMailbox on Get-Mailbox.

Get the mailbox for a user

Sub-resource of the user at GET /users/{key} - returns the user’s mailbox (the 0..1 navigation), backed by Get-Mailbox resolved against the user’s identity. Returns 204 No Content when the user has no mailbox.

GET /exchange/v1.0/users/{key}/mailbox HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#mailboxes/ExchangeApi.SharedMailbox/$entity",
  "@odata.type": "#ExchangeApi.SharedMailbox",
  "Id": "Support",
  "ExchangeGuid": "b496f793-0cfa-4e78-a703-df5ee6a51051",
  "Guid": "c80fb3b2-8bd1-4d1f-bab5-e06d74c3377a",
  "DisplayName": "Support",
  "SimpleDisplayName": "",
  "PhoneticDisplayName": null,
  "Name": "Support",
  "Alias": "Support",
  "DistinguishedName": "CN=Support,OU=contoso.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
  "Identity": "Support",
  "ExternalDirectoryObjectId": "d30c0254-af7e-4c04-a884-4265976e20b0",
  "PrimarySmtpAddress": "support@contoso.com",
  "WindowsLiveID": "support@contoso.com",
  "WindowsEmailAddress": "support@contoso.com",
  "EmailAddresses": [
    "SMTP:support@contoso.com",
    "smtp:support@contoso.onmicrosoft.com"
  ],
  "EmailAddressPolicyEnabled": false,
  "RecipientType": "UserMailbox",
  "RecipientTypeDetails": "SharedMailbox",
  "OrganizationalUnit": "eurpr01a017.prod.outlook.com/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com",
  "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
  "CustomAttribute1": "",
  "CustomAttribute2": "",
  "CustomAttribute3": "",
  "CustomAttribute4": "",
  "CustomAttribute5": "",
  "ExtensionCustomAttribute1": [],
  "ExtensionCustomAttribute2": [],
  "ExtensionCustomAttribute3": [],
  "ExtensionCustomAttribute4": [],
  "ExtensionCustomAttribute5": [],
  "HiddenFromAddressListsEnabled": false,
  "AddressBookPolicy": null,
  "WhenCreated": "2026-03-31T17:57:27+03:00",
  "WhenChanged": "2026-05-22T00:31:32+03:00",
  "WhenCreatedUTC": "2026-03-31T14:57:27Z",
  "WhenChangedUTC": "2026-05-21T21:31:32Z",
  "UserPrincipalName": "support@contoso.com",
  "SamAccountName": "$B6VJH0-DDO3526KIOHC",
  "Database": "eurprd02.prod.outlook.com/9b2bf06b-6c7c-4221-adb7-eecf47f237f3",
  "ServerName": "vi1pr02mb4655",
  "MailboxPlan": "ExchangeOnline-053fb9b6-d15f-43dd-87d3-3d8591877ebf",
  "MicrosoftOnlineServicesID": "support@contoso.com",
  "UseDatabaseQuotaDefaults": false,
  "IssueWarningQuota": "49 GB (52,613,349,376 bytes)",
  "ProhibitSendQuota": "49.5 GB (53,150,220,288 bytes)",
  "ProhibitSendReceiveQuota": "50 GB (53,687,091,200 bytes)",
  "RecoverableItemsQuota": "30 GB (32,212,254,720 bytes)",
  "RecoverableItemsWarningQuota": "20 GB (21,474,836,480 bytes)",
  "CalendarLoggingQuota": "6 GB (6,442,450,944 bytes)",
  "MaxSendSize": "35 MB (36,700,160 bytes)",
  "MaxReceiveSize": "36 MB (37,748,736 bytes)",
  "RecipientLimits": 500,
  "ArchiveStatus": "None",
  "ArchiveGuid": "00000000-0000-0000-0000-000000000000",
  "ArchiveName": null,
  "ArchiveDatabase": null,
  "ArchiveDomain": null,
  "ArchiveQuota": "50 GB (53,687,091,200 bytes)",
  "ArchiveWarningQuota": "45 GB (48,318,382,080 bytes)",
  "ArchiveState": "None",
  "AutoExpandingArchiveEnabled": "False",
  "LitigationHoldEnabled": false,
  "LitigationHoldDuration": "Unlimited",
  "LitigationHoldOwner": "",
  "LitigationHoldDate": null,
  "RetentionHoldEnabled": "False",
  "StartDateForRetentionHold": null,
  "EndDateForRetentionHold": null,
  "RetentionPolicy": "Default MRM Policy",
  "RetainDeletedItemsFor": "14.00:00:00",
  "SingleItemRecoveryEnabled": true,
  "InPlaceHolds": [],
  "ComplianceTagHoldApplied": "False",
  "DelayHoldApplied": "False",
  "DelayReleaseHoldApplied": "False",
  "ForwardingAddress": null,
  "ForwardingSmtpAddress": null,
  "DeliverToMailboxAndForward": false,
  "GrantSendOnBehalfTo": [],
  "AcceptMessagesOnlyFrom": [],
  "AcceptMessagesOnlyFromDLMembers": [],
  "AcceptMessagesOnlyFromSendersOrMembers": [],
  "RejectMessagesFrom": [],
  "RejectMessagesFromDLMembers": [],
  "RejectMessagesFromSendersOrMembers": [],
  "BypassModerationFromSendersOrMembers": [],
  "ModerationEnabled": false,
  "ModeratedBy": [],
  "SendModerationNotifications": "Always",
  "RequireSenderAuthenticationEnabled": false,
  "ResourceCustom": [],
  "IsResource": false,
  "IsShared": true,
  "IsRoomMailbox": false,
  "IsLinked": false,
  "IsInactiveMailbox": false,
  "IsMonitoringMailbox": false,
  "ResourceType": null,
  "ResourceCapacity": null,
  "AuthenticationPolicy": null,
  "AuthenticationFlowPolicy": null,
  "AccountDisabled": "True",
  "OABEnabled": null,
  "WhenSoftDeleted": null,
  "WhenMailboxCreated": "2026-03-16T17:46:01+02:00",
  "ExchangeUserAccountControl": "AccountDisabled",
  "AcceptMessagesOnlyFromDLMembersWithDisplayNames": [],
  "AcceptMessagesOnlyFromSendersOrMembersWithDisplayNames": [],
  "AcceptMessagesOnlyFromWithDisplayNames": [],
  "AddressListMembership": [
    "\\Default Global Address List",
    "\\All Recipients(VLV)",
    "\\All Mailboxes(VLV)",
    "\\Mailboxes(VLV)",
    "\\Offline Global Address List",
    "\\All Users"
  ],
  "AdminDisplayVersion": "Version 15.21 (Build 71.14)",
  "AdministrativeUnits": [],
  "AgentIdentityBlueprintId": "",
  "AggregatedMailboxGuids": [],
  "AntispamBypassEnabled": false,
  "ArbitrationMailbox": null,
  "ArchiveDatabaseGuid": "00000000-0000-0000-0000-000000000000",
  "ArchiveRelease": "",
  "AuditAdmin": [
    "Update",
    "MoveToDeletedItems",
    "SoftDelete",
    "HardDelete",
    "SendAs",
    "SendOnBehalf",
    "Create",
    "UpdateFolderPermissions",
    "UpdateInboxRules",
    "UpdateCalendarDelegation",
    "ApplyRecord",
    "MailItemsAccessed",
    "Send"
  ],
  "AuditDelegate": [
    "Update",
    "MoveToDeletedItems",
    "SoftDelete",
    "HardDelete",
    "SendAs",
    "SendOnBehalf",
    "Create",
    "UpdateFolderPermissions",
    "UpdateInboxRules",
    "ApplyRecord",
    "MailItemsAccessed"
  ],
  "AuditEnabled": true,
  "AuditLogAgeLimit": "90.00:00:00",
  "AuditOwner": [
    "Update",
    "MoveToDeletedItems",
    "SoftDelete",
    "HardDelete",
    "UpdateFolderPermissions",
    "UpdateInboxRules",
    "UpdateCalendarDelegation",
    "ApplyRecord",
    "MailItemsAccessed",
    "Send"
  ],
  "AutoArchivingEnabled": true,
  "CalendarRepairDisabled": false,
  "CalendarVersionStoreDisabled": false,
  "CustomAttribute10": "",
  "CustomAttribute11": "",
  "CustomAttribute12": "",
  "CustomAttribute13": "",
  "CustomAttribute14": "",
  "CustomAttribute15": "",
  "CustomAttribute6": "",
  "CustomAttribute7": "",
  "CustomAttribute8": "",
  "CustomAttribute9": "",
  "DataEncryptionPolicy": null,
  "DatabaseGuid": "9b2bf06b-6c7c-4221-adb7-eecf47f237f3",
  "DefaultAuditSet": [
    "Admin",
    "Delegate",
    "Owner"
  ],
  "DefaultPublicFolderMailbox": null,
  "DisabledArchiveDatabase": null,
  "DisabledArchiveGuid": "00000000-0000-0000-0000-000000000000",
  "DisabledMailboxLocations": false,
  "DowngradeHighPriorityMessagesEnabled": false,
  "EffectivePublicFolderMailbox": null,
  "ElcProcessingDisabled": false,
  "EmailAddressDisplayNames": [],
  "EnforcedTimestamps": "",
  "ExchangeObjectId": "79b9957f-760f-4c95-a732-917c14b4a9fd",
  "ExchangeSecurityDescriptor": null,
  "ExternalOofOptions": "External",
  "ForwardingAddressWithDisplayNames": [],
  "GeneratedOfflineAddressBooks": [],
  "GrantSendOnBehalfToWithDisplayNames": [],
  "HasPicture": false,
  "HasSnackyAppData": false,
  "HasSpokenName": false,
  "HttpDeliveryEndpoint": "",
  "HttpDeliveryScenario": "None",
  "ImListMigrationCompleted": false,
  "ImmutableId": "",
  "InactiveMailboxRetireTime": null,
  "IncludeInGarbageCollection": false,
  "IsAgenticUser": false,
  "IsDirSynced": false,
  "IsExchangeCloudManaged": false,
  "IsExcludedFromServingHierarchy": false,
  "IsHierarchyReady": true,
  "IsHierarchySyncEnabled": true,
  "IsMachineToPersonTextMessagingEnabled": false,
  "IsMailboxEnabled": true,
  "IsPersonToPersonTextMessagingEnabled": false,
  "IsPublicFolderSystemMailbox": false,
  "IsRootPublicFolderMailbox": false,
  "IsSoftDeletedByDisable": false,
  "IsSoftDeletedByRemove": false,
  "JournalArchiveAddress": "",
  "Languages": [
    "en-US"
  ],
  "LastExchangeChangedTime": null,
  "LegacyExchangeDN": "/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=b95cae9b8f1d4b0eae92f8afad103fc9-Support",
  "LinkedMasterAccount": "NT AUTHORITY\\SELF",
  "M365BackupState": "None",
  "MailTip": null,
  "MailTipTranslations": [],
  "MailboxContainerGuid": null,
  "MailboxLocations": [
    "1;b496f793-0cfa-4e78-a703-df5ee6a51051;Primary;eurprd02.prod.outlook.com;9b2bf06b-6c7c-4221-adb7-eecf47f237f3"
  ],
  "MailboxMoveBatchName": "",
  "MailboxMoveFlags": "None",
  "MailboxMoveRemoteHostName": "",
  "MailboxMoveSourceMDB": null,
  "MailboxMoveStatus": "None",
  "MailboxMoveTargetMDB": null,
  "MailboxProvisioningConstraint": null,
  "MailboxProvisioningPreferences": [],
  "MailboxRegion": null,
  "MailboxRegionLastUpdateTime": null,
  "MailboxRegionSuffix": "None",
  "MailboxRelease": "",
  "ManagedFolderMailboxPolicy": null,
  "MaxBlockedSenders": null,
  "MaxSafeSenders": null,
  "MessageCopyForSMTPClientSubmissionEnabled": true,
  "MessageCopyForSendOnBehalfEnabled": false,
  "MessageCopyForSentAsEnabled": false,
  "MessageRecallProcessingEnabled": true,
  "MessageTrackingReadStatusEnabled": true,
  "NetID": "10032005B18E4C45",
  "NonCompliantDevices": [],
  "Office": "",
  "OfflineAddressBook": null,
  "OrganizationalUnitRoot": "contoso.onmicrosoft.com",
  "OrphanSoftDeleteTrackingTime": null,
  "PersistedCapabilities": [
    "BPOS_S_Standard"
  ],
  "PitrCopyIntervalInSeconds": 0,
  "PitrEnabled": false,
  "PitrOffboardedTimestamp": null,
  "PitrPaused": false,
  "PitrPausedTimestamp": null,
  "PitrState": "None",
  "PoliciesExcluded": [
    "{26491cfc-9e50-4857-861b-0cb8df22b5d7}"
  ],
  "PoliciesIncluded": [],
  "ProtocolSettings": [
    "OWA§1",
    "HTTP§1§1§§§§§§",
    "ECP§1",
    "POP3§1§§§§§§§§§§§§1",
    "IMAP4§1§§§§§§§§§§§§",
    "PublicFolderClientAccess§0",
    "MAPI§1§0§§§0§§§§§0",
    "RemotePowerShell§1"
  ],
  "QueryBaseDN": null,
  "QueryBaseDNRestrictionEnabled": false,
  "RecipientSoftDeletedStatus": 0,
  "RecipientThrottlingThreshold": "Standard",
  "ReconciliationId": null,
  "RemoteAccountPolicy": null,
  "RemoteRecipientType": "None",
  "ResetPasswordOnNextLogon": false,
  "ResourceProvisioningOptions": [],
  "RetainDeletedItemsUntilBackup": false,
  "RetentionComment": "",
  "RetentionUrl": "",
  "RoleAssignmentPolicy": "Default Role Assignment Policy",
  "RoomMailboxAccountEnabled": null,
  "RulesQuota": "256 KB (262,144 bytes)",
  "SCLDeleteEnabled": null,
  "SCLDeleteThreshold": null,
  "SCLJunkEnabled": null,
  "SCLJunkThreshold": null,
  "SCLQuarantineEnabled": null,
  "SCLQuarantineThreshold": null,
  "SCLRejectEnabled": null,
  "SCLRejectThreshold": null,
  "SKUAssigned": false,
  "ServerLegacyDN": "/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=VI1PR02MB4655",
  "SharedEmailDomainState": "None",
  "SharedEmailDomainStateLastModified": null,
  "SharedEmailDomainTenant": "",
  "SharedWithTargetSmtpAddress": "",
  "SharingAnonymousIdentities": "",
  "SharingPolicy": "Default Sharing Policy",
  "SourceAnchor": "",
  "StsRefreshTokensValidFrom": "2026-03-16T17:46:02+02:00",
  "ThrottlingPolicy": null,
  "UMDtmfMap": [],
  "UnifiedMailbox": null,
  "UniqueRecipientsCountLimitLevel": "Level0",
  "UniqueUnrestrictedGroupsLimitEnabled": true,
  "UsageLocation": null,
  "UseDatabaseRetentionDefaults": false,
  "UserCertificate": [],
  "UserIdentityParent": "",
  "UserSMimeCertificate": [],
  "WasInactiveMailbox": false,
  "CalendarProcessing": null,
  "Forwarding": null,
  "AutoReply": null
}

Related: GET /exchange/v1.0/users/{key}, GET /exchange/v1.0/users/{key}/memberOf, GET /exchange/v1.0/mailboxes/{key}

GET /exchange/v1.0/users/{key}/memberOf

GET /users/{key}/memberOf - reverse navigation, Graph-style.

Two-step lookup: resolve the user’s DistinguishedName via Get-User, then Get-Recipient -Filter “Members -eq ‘<DN>’” - the only way EXO exposes “what groups contain this user”. The returned recipients are polymorphic groups (Distribution / Unified / Dynamic / MailUniversalSecurity); PolymorphicTypeRegistry dispatches each row to the right subtype.

Backing cmdlet: Get-Recipient. Role: User.Read (Community).

Parameter	In	Type	Required	Description
all	query	bool (switch)		Return all group memberships instead of the EXO default cap of 1000 (a heavily-grouped user can exceed it). Maps -ResultSize Unlimited on the underlying Get-Recipient.

List the groups a user is a member of

Sub-resource of the user at GET /users/{key} - returns the polymorphic groups (distribution, mail-enabled security, dynamic, and Microsoft 365 groups) that contain this user. Resolves the user’s distinguished name, then queries recipients filtered on group membership.

GET /exchange/v1.0/users/{key}/memberOf HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#groups",
  "value": []
}

Related: GET /exchange/v1.0/users/{key}, GET /exchange/v1.0/users/{key}/mailbox

?dryRun=true previews of any write stay on Community.