This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(115.19999999999999, 0%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERH%3C/text%3E%3C/svg%3E)
I work for an eDiscovery vendor that processes data archived from Exchange for our clients. We recently noticed that these archiving tools (e.g. Digital Safe, Connected Archive, etc.) no longer populate the BCC field for emails which contain BCC recipients. Instead, the BCC info gets populated to X-MS-Exchange-Organization-BCC.
We initially thought this was an issue with the archiving tools themselves, however we have since been informed that this issue is due to a change made by Microsoft and affects ALL archiving / journaling software. Can you please provide details as to when this change was made so that we can identify any processed data that may be impacted?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 67%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJS%3C/text%3E%3C/svg%3E)
Hi @Ryan Hemmel
According to my research, I haven't found any official document provided by Micorsoft to introduce such change may lead to the archive tools not working for BCC.
And the BCC recipients populated to the message header X-MS-Exchange-Organization-BCC is not added/changed recently as well. This article published in 2018 introduced the way: Exchange Server: Prevent users from sending to BCC (blind carbon copy) using Transport Rule which is using The header line : X-MS-Exchange-Organization-BCC
Hi @Ryan Hemmel
Have you checked if the built-in feature journaling in exchange server work properly for your sceanrio?
I have tested the built-in journaling feature and confirmed that this issue exists.
Here is the original email in the sender's mailbox:
Notice that the Ryan Test account correctly shows up on the BCC line.
Here is the copy of the email attached to the journal report. Notice that Ryan Test is not visible on the BCC line:
Here is the properties of the email from the journal report. Notice that we have to look at X-MS-Exchange-Organization-BCC in the headers to find that Ryan Test was BCC'd:
The journal report itself does correctly show that Ryan Test was BCC'd, so it is odd that this is not properly captured in the attached / forwarded message:
As noted, it appears that this behavior has changed from the past, as we were previously able to see the BCC info on the attached journaled messages.
Hi,
Thanks for providing more information here, I did a test in my environment as well. In on-prem Exchange server, the BCC field will be filled both in the mail and the attached mail. However in online is just like the scenario you shared above, we are not able to get the bcc information directly from the attached mail.
If you want to know more details about the backend changes, I would suggest you open a service request with o365 to feedback this situation. And for the lost BCC filed, we may need to find the last email with BCC field correctly filled, manually record thm after then.
https://learn.microsoft.com/en-us/microsoft-365/business-video/get-help-support?view=o365-worldwide
This information is not stored in headers, but there is a copy of it within the sender's mailbox. Read here for details: https://learn.microsoft.com/en-us/microsoft-365/compliance/preserve-bcc-and-expanded-distribution-group-recipients-for-ediscovery?view=o365-worldwide
Hi michev,
We are aware that BCC information is preserved within the sender's mailbox for email that has not been archived / journaled. However, it appears that this is no longer properly preserved (or at least preserved in an unexpected header) when emails are journaled to an external mailbox / archiving solution.
For example, if we have an email sent from john@ssss .com with sally@ssss .com BCC'd, we are able to find the copy of the email in the sender's (john@ssss .com) mailbox. That copy of the email correctly shows sally@ssss .com on the BCC line.
However, if the same message is then journaled, when opening the journaled copy of the message, we do not see sally@ssss .com on the BCC line. We have to look into the headers of that message to find sally@ssss .com within X-MS-Exchange-Organization-BCC. Previously, this information was available within the BCC field.
Now that we know to do this, we can correctly process these messages going forwards by including the X-MS-Exchange-Organization-BCC header in our hierarchy for populating BCC. However, because we weren't previously aware of this change, we have processed data that may be missing BCC information. Thus, we are looking for additional information as to when / why this change was implemented. As noted, we initially thought this was an issue with the archiving tools themselves, but we have noticed this same issue with two different tools, and the developers of those tools have indicated this was due to a change that Microsoft made to Exchange.