Hello Thomas,

For the users that go through Okta (AD mastered or Okta mastered) into Office 365, the option would be extend the schema. However for the Cloud users, if they do not go through Okta there is not much we can do as we do not manage them. If these users are only on Office side we would recommend to reach out to Office for further assistance.

If you have additional questions on this matter, don't hesitate to open a case with Support and we will be more then happy to assist you further.

Thank You,

Paul Stiniguta

Technical Support Engineer

Okta Global Customer Care

Below is a modified version of what I do in PowerShell when after a user leaves the organization. The attribute in Active Directory is msExchHideFromAddressLists. If this is set to True, the user will be hidden from the global address book (GAL) in the next 24 hours unless your GAL updates more frequently than this. I have not tested the modified version but I believe this will work.

  # Write-Host "$loginName Hidden From GAL" ($userProp.msExchHideFromAddressLists -eq $true)

The line above should indicate true or false, as to whether the user attribute is now set to hidden. If you have multiple domain controllers, it will take time for the value to be propagated depending on your replication cycle.

If you need to hide the non-AD users in O365 from the GAL, you'll need to manually do this in O365 per user or using PowerShell, which can also be done in batches much like what was done in AD.

Hopefully, that helps,

W.

Import-module ActiveDirectory

Function Get-UserProperties( $loginName )

{

   $userProperties   = $null

   $adPropertiesList = "DisplayName", "Title", "CanonicalName", "Department", "CN", "Description", "Manager", "DistinguishedName"

   $adPropertiesList += "mail", "userPrincipalName", "samaccountname", "MemberOf", "msExchHideFromAddressLists", "Enabled" ,"passwordLastSet"

   Try {

       $userProperties = Get-Aduser -Identity $loginName -Properties * | Select-Object $adPropertiesList

       # We must select the properties that we need from the User object for this to work.

   } Catch {

       Write-Warning "($($loginName)) - Error obtaining user properties. $_."

       $userProperties = $null

   }

   return $userProperties

}

Function Hide-UserFromAddressBook( $userProperties )

{

   Try {

       Set-ADUser $userProperties.DistinguishedName -replace @{msExchHideFromAddressLists=$true}

   } Catch {

       Write-Warning "Error occured with hiding user from gloabal address book. $_"

   }

}

$userArray = "jdoe1","jdoe2","jdoe3","jdoe4" # users login (SAM, sAMAccountName)

foreach ($loginName in $userArray)

{

   $userProp = Get-UserProperties $loginName

   Hide-UserFromAddressBook $userProp

   # Write-Host "$loginName Hidden From GAL" ($userProp.msExchHideFromAddressLists -eq $true)

}