This one will probably be of value to few Microsoft 365 tenants only, but it is on my to do list, so here goes. In June 2026, the MC1420903 message center post informed us about upcoming changes to Dynamic Distribution Group (DDGs) provisioning in Exchange Online. The changes aim to address some “duplication” scenarios and promote reuse of existing DDGs, which is admirable, I suppose. Given the specifics, I doubt many tenants will be impacted by this, and my guess is that the new policy is largely aimed to address “stress testing” scenarios… but I digress.
Dynamic Distribution Groups have been around since the launch of Office 365 and still do their intended job quite well. The planned replacement via dynamic membership Microsoft 365 Groups never materialized, and in the recent years we’ve seen some attempts to optimize DDGs story, by providing us the modern DDG experience, membership cmdlets and reporting in the EAC. Apparently Microsoft is not done with the optimization effort, which brings us to MC1420903.
Unlike some other examples of message center posts, Microsoft has done a good job detailing the planned changes as well as outlining the potential impact they can have. The only thing missing from the post is how the error message will look like, so after waiting for the rollout to hit my tenant, I can now share the details on this. I’m also taking a opportunity to spread word around, as changes that are announced only via message center posts tend to be overlooked by the Microsoft 365 userbase.
So, with the new changes in place, Exchange Online will run some additional checks when admins try to create new dynamic distribution groups. Note that we are not talking about matching alias/name here, which is a separate uniqueness condition. Instead, the following set of properties will be evaluated as part of the DDG creation process:
- Recipient filter
- Delivery management settings
- Message approval (moderation) settings
- Delegation settings
- Message visibility settings
Now, experienced administrators will likely point out that not all of the settings/properties listed above can actually be set as part of the DDG creation process (i.e. via the New-DynamicDistributionGroup cmdlet), and they will be correct. So, I’ll take back some of the praise above with regards to the completeness of the message center posts. Another thing to remember is that from the list above, only the recipient filter parameter (-RecipientFilter) is mandatory, and even here there are caveats.
But we will clear some of the confusion with specific examples. First, here’s the error message you will get if a duplicate DDG is detected upon execution of the New-DynamicDistributionGroup cmdlet:
New-DynamicDistributionGroup -Name Title1 -RecipientFilter "Title -eq 'WC'" Write-ErrorMessage : ||The existing dynamic distribution group title@michev.onmicrosoft.com already uses the same recipient filter and the same delivery management, message approval (moderation), delegation, and message visibility settings. Duplicate dynamic distribution groups can't be created. Use this group instead of creating a new one.
As you can see from the above, the error message will even tell you which existing DDG was detected as duplicate. Helpful.
Another important note is that the detection will trigger even when you run the cmdlet with the -WhatIf switch. It is sad that Exchange Online remains the only workload within Microsoft 365, where basic PowerShell goodness such as this is properly implemented. Oh well.
Now, the example above illustrates the simplest possible scenario, where we only configure a recipient filter. In other words, none of the other properties listed in the message center post are configured on the “original” DDG. Let’s also examine some more complicated scenarios, for example where delegation is at play. Here’s what happens when the original DDG has Send As permissions granted:
#Check for delegates (Send As only to keep it simple)
Get-RecipientPermission Title
#Add a delegate
Add-RecipientPermission Title -Trustee vasil -AccessRights SendAs -Confirm:$false
Identity Trustee AccessControlType AccessRights Inherited
-------- ------- ----------------- ------------ ---------
title vasil Allow {SendAs} False
#Try creating a DDG with matching recipient filter
New-DynamicDistributionGroup -Name Title1 -RecipientFilter "Title -eq 'WC'" -WhatIf
Write-ErrorMessage : ||The existing dynamic distribution group title@michev.onmicrosoft.com already uses the same recipient filter and the same delivery management, message approval (moderation),
delegation, and message visibility settings. Duplicate dynamic distribution groups can't be created. Use this group instead of creating a new one.
Well, color me surprised. While there is always the matter of replication, we see that delegation settings do not seem to have any effect here. Which only confirms my suspicion that the list provided within the message center post is in fact not entirely correct, and properties that can only be configured after the DDG is created are not taken into consideration.
To further confirm this, let’s instead examine a scenario with moderation in play. The moderation settings can indeed be set upon DDG creation, as the New-DynamicDistributionGroup cmdlet exposes the relevant parameters. In the example below, we take the existing DDG and configure its moderation settings. We then try to provision a new DDG with the same recipient filter, both when also setting the same moderation configuration, and without configuring moderation.
#Fetch the moderation settings
Get-DynamicDistributionGroup Title | ft Moder*
ModeratedByWithDisplayNames ModeratedBy ModerationEnabled
--------------------------- ----------- -----------------
{} {} False
#Set the moderation settings
Set-DynamicDistributionGroup Title -ModerationEnabled $true -ModeratedBy vasil
#Try creating a DDG with matching recipient filter AND moderation settings
New-DynamicDistributionGroup -Name Title1 -RecipientFilter "Title -eq 'WC'" -ModerationEnabled $true -ModeratedBy vasil -WhatIf
#Try creating a DDG with matching recipient filter only
New-DynamicDistributionGroup -Name Title1 -RecipientFilter "Title -eq 'WC'" -WhatIf
As you can see from the output above, trying to create a new DDG with matching recipient filter and delegate settings results in the expected error message. In contrast, omitting the moderation settings does not trigger the duplication detection and is a success (or would be, if we didn’t use the –WhatIf switch). So, now we can confirm that moderation settings are indeed part of the duplicate DDG detection.
In summary, duplicate Dynamic Distribution Group creation is now a thing, and you should account for it when provisioning new DDGs within your tenant. Keep an eye out for the corresponding error message, which unfortunately is without its own category, so you have to handle it by matching the text. Which is another thing I will bring to the relevant engineering team, apart from the somewhat misleading information within the message center post.