Forum Discussion
BCC Foldering Agent
- May 22, 2018
Not well documented, but this looks like expected behavior:
"Engineering confirmed that the behavior is expected and by design. The design stems from users who complained that when someone replies to a message on a DL and moves the DL to the BCC line (e.g. to discourage members of the DL from sending more replies), that BCC'd reply lands in the recipients' Inboxes, instead of landing in the same folder as the rest of the messages for that DL. The BCC Transport agent provides this functionality. The BCC agent detects BCC messages, looks at the In-Reply-To header, searches for the message identified by the In-Reply-To header, and delivers the BCC message to the same folder as the replied-to message." (source)Were not able to repro the folder movement; messages did have an extra header, X-MS-Exchange-Processed-By-BccFoldering
mderooij
One way to stop the automatic move I found is to create a Transport Rule with
-SetHeaderName X-MS-Exchange-Organization-Recipient-P2-Type
-SetHeaderValue To
This will pre-stamp the email with an x-header before getting to BCC foldering agent. Changing the above header value from 'Bcc' to 'To' will fool the BCC foldering agent into thinking the email was not Bcc'd.
However, the only viable message filtering parameter you can use with this rule is keywords in subject and message body. Bcc'd recipient and groups addresses are not detectable by transport rule, so they can't be used in filter. You can't filter on the bcc related x-header, because that is stamped AFTER BCC folder agent has touched the email.
Also with this rule, even if email is not Bcc'd, triggered email will have the "X-MS-Exchange-Organization-Recipient-P2-Type", and the "X-MS-ExchangeProcessed-By-BccFoldering" headers stamped because of this transport rule. From header, this email is going to look like it was Bcc'd to the trained eyes of Exchange admins. Other then that, I don't see any downsides with this rule.
J_Tsai Hey, I know that this thread is old but it is the only reliable thread I have found on this subject. About a month ago we discovered this exact same issue happening with one of our clients - User A BCCs User B on an email. User B then moves that email into a sub folder. User A then goes into their sent items and Reply All's the original email. That email then goes directly into User B's sub folder where they moved the original email. I was able to put the transport rule in place to modify the 'X-MS-Exchange-Organization-Recipient-P2-Type' message header to avoid this issue and it was working perfectly. That is until yesterday. Now the mail flow rule does not seem to be applying and changing the message header. Is anyone else seeing this behavior with a recent Exchange patch? This is happening for my client and when I test in our own environment. We are both running Exchange Version - 1713.5.
- J_TsaiJul 12, 2019Copper Contributor
I have the exact same version of Exchange (2016 CU12? With latest Exchange security patch). I just tested it and it’s still working.
Try raising the priority on that rule so it runs first? On my transport rule I also added subject keywords because I only need to modify header for specific messages.
Here’s the read out on the rule I am running. Hope this help!
ManuallyModified : False
ActivationDate :
ExpiryDate :
Description : If the message:
Includes these words in the message subject: 'Comp Committee' or
'Lateral' or 'CONFIDENTIAL' or 'Test BCC'
Take the following actions:
set message header 'X-MS-Exchange-Organization-Recipient-P2-Type'
with the value 'To'
RuleVersion : 14.0.0.0
Conditions : {SubjectContains}
Exceptions :
Actions : {SetHeader}
State : Enabled
Mode : Enforce
RuleErrorAction : Ignore
SenderAddressLocation : Header
RuleSubType : None
UseLegacyRegex : False
From :
FromMemberOf :
FromScope :
SentTo :
SentToMemberOf :
SentToScope :
BetweenMemberOf1 :
BetweenMemberOf2 :
ManagerAddresses :
ManagerForEvaluatedUser :
SenderManagementRelationship :
ADComparisonAttribute :
ADComparisonOperator :
SenderADAttributeContainsWords :
SenderADAttributeMatchesPatterns :
RecipientADAttributeContainsWords :
RecipientADAttributeMatchesPatterns :
AnyOfToHeader :
AnyOfToHeaderMemberOf :
AnyOfCcHeader :
AnyOfCcHeaderMemberOf :
AnyOfToCcHeader :
AnyOfToCcHeaderMemberOf :
HasClassification :
HasNoClassification : False
SubjectContainsWords : {Comp Committee, Lateral, CONFIDENTIAL, Test BCC}
SubjectOrBodyContainsWords :
HeaderContainsMessageHeader :
HeaderContainsWords :
FromAddressContainsWords :
SenderDomainIs :
RecipientDomainIs :
SubjectMatchesPatterns :
SubjectOrBodyMatchesPatterns :
HeaderMatchesMessageHeader :
HeaderMatchesPatterns :
FromAddressMatchesPatterns :
AttachmentNameMatchesPatterns :
AttachmentExtensionMatchesWords :
AttachmentPropertyContainsWords :
ContentCharacterSetContainsWords :
HasSenderOverride : False
MessageContainsDataClassifications :
MessageContainsAllDataClassifications :
SenderIpRanges :
SCLOver :
AttachmentSizeOver :
MessageSizeOver :
WithImportance :
MessageTypeMatches :
RecipientAddressContainsWords :
RecipientAddressMatchesPatterns :
SenderInRecipientList :
RecipientInSenderList :
AttachmentContainsWords :
AttachmentMatchesPatterns :
AttachmentIsUnsupported : False
AttachmentProcessingLimitExceeded : False
AttachmentHasExecutableContent : False
AttachmentIsPasswordProtected : False
AnyOfRecipientAddressContainsWords :
AnyOfRecipientAddressMatchesPatterns :
ExceptIfFrom :
ExceptIfFromMemberOf :
ExceptIfFromScope :
ExceptIfSentTo :
ExceptIfSentToMemberOf :
ExceptIfSentToScope :
ExceptIfBetweenMemberOf1 :
ExceptIfBetweenMemberOf2 :
ExceptIfManagerAddresses :
ExceptIfManagerForEvaluatedUser :
ExceptIfSenderManagementRelationship :
ExceptIfADComparisonAttribute :
ExceptIfADComparisonOperator :
ExceptIfSenderADAttributeContainsWords :
ExceptIfSenderADAttributeMatchesPatterns :
ExceptIfRecipientADAttributeContainsWords :
ExceptIfRecipientADAttributeMatchesPatterns :
ExceptIfAnyOfToHeader :
ExceptIfAnyOfToHeaderMemberOf :
ExceptIfAnyOfCcHeader :
ExceptIfAnyOfCcHeaderMemberOf :
ExceptIfAnyOfToCcHeader :
ExceptIfAnyOfToCcHeaderMemberOf :
ExceptIfHasClassification :
ExceptIfHasNoClassification : False
ExceptIfSubjectContainsWords :
ExceptIfSubjectOrBodyContainsWords :
ExceptIfHeaderContainsMessageHeader :
ExceptIfHeaderContainsWords :
ExceptIfFromAddressContainsWords :
ExceptIfSenderDomainIs :
ExceptIfRecipientDomainIs :
ExceptIfSubjectMatchesPatterns :
ExceptIfSubjectOrBodyMatchesPatterns :
ExceptIfHeaderMatchesMessageHeader :
ExceptIfHeaderMatchesPatterns :
ExceptIfFromAddressMatchesPatterns :
ExceptIfAttachmentNameMatchesPatterns :
ExceptIfAttachmentExtensionMatchesWords :
ExceptIfAttachmentPropertyContainsWords :
ExceptIfContentCharacterSetContainsWords :
ExceptIfSCLOver :
ExceptIfAttachmentSizeOver :
ExceptIfMessageSizeOver :
ExceptIfWithImportance :
ExceptIfMessageTypeMatches :
ExceptIfRecipientAddressContainsWords :
ExceptIfRecipientAddressMatchesPatterns :
ExceptIfSenderInRecipientList :
ExceptIfRecipientInSenderList :
ExceptIfAttachmentContainsWords :
ExceptIfAttachmentMatchesPatterns :
ExceptIfAttachmentIsUnsupported : False
ExceptIfAttachmentProcessingLimitExceeded : False
ExceptIfAttachmentHasExecutableContent : False
ExceptIfAttachmentIsPasswordProtected : False
ExceptIfAnyOfRecipientAddressContainsWords :
ExceptIfAnyOfRecipientAddressMatchesPatterns :
ExceptIfHasSenderOverride : False
ExceptIfMessageContainsDataClassifications :
ExceptIfMessageContainsAllDataClassifications :
ExceptIfSenderIpRanges :
PrependSubject :
SetAuditSeverity :
ApplyClassification :
ApplyHtmlDisclaimerLocation :
ApplyHtmlDisclaimerText :
ApplyHtmlDisclaimerFallbackAction :
ApplyRightsProtectionTemplate :
SetSCL :
SetHeaderName : X-MS-Exchange-Organization-Recipient-P2-Type
SetHeaderValue : To
RemoveHeader :
AddToRecipients :
CopyTo :
BlindCopyTo :
AddManagerAsRecipientType :
ModerateMessageByUser :
ModerateMessageByManager : False
RedirectMessageTo :
RejectMessageEnhancedStatusCode :
RejectMessageReasonText :
DeleteMessage : False
Disconnect : False
Quarantine : False
SmtpRejectMessageRejectText :
SmtpRejectMessageRejectStatusCode :
LogEventText :
StopRuleProcessing : False
SenderNotificationType :
GenerateIncidentReport :
IncidentReportContent :
RouteMessageOutboundConnector :
RouteMessageOutboundRequireTls : False
ApplyOME : False
RemoveOME : False
OMEExpiryDays : 0
GenerateNotification :
Identity : Disable BCC Foldering Agent