How to Resolve Microsoft 365 Duplicate Proxy Address Errors When Sharing SMTP Between Accounts

You have two Microsoft 365 accounts. The regular user account holds the mailbox. The elevated admin account needs to send from the same address for SSO with a third-party vendor. You try to add the address as an alias on the elevated account. Microsoft 365 refuses: duplicate proxy address.

The error message is not lying. The address is already taken. The problem is that the elevated account claimed it without you noticing, and removing the license does not give it back.

Why this happens

Exchange Online treats certain email addresses as properties of the recipient object itself, not as properties of the license. The primary SMTP address is stored as an immutable attribute on the directory object. When you remove an Exchange license, the services disappear but these attributes stay.

This means an account that had an Exchange license for five minutes during a trial or onboarding still holds its email addresses in the directory. The address is locked to that object. No other account in the tenant can use it.

This commonly surfaces in two situations. First, elevated admin accounts that had an Exchange license assigned during provisioning even though they were never meant to hold mail. Second, accounts that went through a licensing change where Exchange was removed but the directory entry was not cleaned up.

Note: some organizations also see this error after migrating from on-premises Exchange to Microsoft 365. In that case the source of truth for proxy addresses is the on-premises Active Directory, not the cloud directory, and the fix must be applied there first.

How to fix it

Step 1 - Find what addresses the source account is holding

Run this in Exchange Online PowerShell:

Get-Recipient -Identity "elevated-account@yourdomain.com" | Select-Object -ExpandProperty EmailAddresses

Look for the address causing the conflict. Capital SMTP marks the primary address. Lowercase smtp marks a secondary alias.

Step 2 - Remove the Exchange license

In the Microsoft 365 admin center, remove the Exchange license from the elevated account. If the account has never had an Exchange license, skip to Step 3.

Step 3 - Remove the conflicting address

Start with the Exchange admin center (https://admin.exchange.microsoft.com). Find the elevated account, open its mailbox settings, and look for the email addresses section. Try to remove the conflicting address there. If the admin center refuses with a duplicate error, use PowerShell:

Set-Mailbox -Identity "elevated-account@yourdomain.com" -EmailAddresses @{remove="smtp:shared-address@yourdomain.com"}

If this fails, the account is under litigation hold and you cannot modify its proxy addresses until the hold is cleared.

Step 4 - Check for litigation hold

Get-Mailbox -Identity "elevated-account@yourdomain.com" | Select-Object LitigationHoldEnabled, LitigationHoldDate

If LitigationHoldEnabled is true, the proxy address removal will fail. The hold must be cleared before you can proceed.

Step 5 - Work around litigation hold

If the account is under hold and you cannot clear it, you have three realistic options:

1. Remove the hold if compliance requirements no longer justify it. Check with your compliance or legal team. If the hold was set with no end date, get explicit approval before clearing it.
2. Wait for the hold to expire if a retention label defines an end date.
3. Route mail through a shared mailbox instead. The elevated account sends to the shared mailbox, and the shared mailbox sends externally using the shared address. This avoids the duplicate proxy address problem entirely but adds a routing hop.

To remove a litigation hold via PowerShell:

Set-Mailbox -Identity "elevated-account@yourdomain.com" -LitigationHoldEnabled $false

After removing the hold, wait a few minutes for the change to propagate, then retry Step 3.

Step 6 - Add the address to the target account

Set-Mailbox -Identity "regular-account@yourdomain.com" -EmailAddresses @{add="smtp:shared-address@yourdomain.com"}

Step 7 - Verify

Send a test message from the regular account to an external address. Confirm the from address is what you expect. Then test whatever vendor SSO mechanism the elevated account is using with that address.

What this approach does not fix

This process assumes cloud-only accounts where the conflict lives in Microsoft 365 itself. If the elevated account is synchronized from an on-premises Active Directory, the proxy address is set by the on-prem Exchange server and any change made only in Exchange Online will be overwritten on the next directory sync. Fix the on-premises account first.

If the account has been converted to a shared mailbox, the proxy address is managed by a different mechanism and this approach will not apply in the same way.

Cross-tenant scenarios are outside scope. If the address you need is registered in a different Microsoft 365 tenant, you cannot clear it from your own tenant.

How to avoid this problem

Do not assign an Exchange license to any account that does not need to send mail directly. Elevated admin accounts, service accounts, and automation accounts almost never need an Exchange license. Use Azure AD application permissions for automation that sends mail.

If your account provisioning workflow assigns Exchange licenses by default, add a step that checks whether the account needs mail before assigning it. The license assignment costs money and creates the proxy address conflict problem described above.

When you do remove an Exchange license from an account that previously had mail, clean up its proxy addresses at the same time rather than leaving stale entries behind. This takes 30 seconds and prevents problems months later when someone tries to reuse an address.

FAQ

Does removing the Exchange license automatically clear the proxy address?

No. The license controls service entitlements, not directory attributes. The proxy addresses remain on the recipient object until you explicitly remove them, and they cannot be removed while the account is under litigation hold.

Can I use the same SMTP address on two Microsoft 365 accounts?

No. Proxy addresses must be unique within a tenant. The directory enforces this as a hard constraint. The only workarounds are routing mail through a shared mailbox or sending on behalf of rather than as.

What is the difference between a proxy address and an alias?

Proxy address is the technical name for any email address registered on a mailbox. The primary SMTP address is the default from and reply-to. Secondary addresses are sometimes called aliases, but both live in the same EmailAddresses attribute. All of them must be unique within the tenant.

How do I check if an account is under litigation hold before trying to remove its proxy address?

Run Get-Mailbox -Identity "account@yourdomain.com" | Select-Object LitigationHoldEnabled. If true, the proxy address cannot be removed while hold is active. You must clear the hold or use a workaround first.

Can I resolve this from the Microsoft 365 admin center or do I need PowerShell?

You can view and sometimes remove proxy addresses from the Microsoft 365 admin center. PowerShell gives more control when the admin center refuses a removal due to a conflict or hold, or when you need to operate on multiple accounts at once.