Microsoft 365 Groups, Send As, and the Missing NDRs

Senders Left Without Notice When Send As Messages Fail

Updated: May 20, 2021

The Microsoft 365 Groups Send As and Send on Behalf feature allows group members to send email for group mailboxes in the same manner as used for personal mailboxes. The Send As permission allows someone to impersonate the group so that messages sent with this permission seem to come from the group. The Send on Behalf of permission allows someone to send as the group, but the message is stamped to show that the sender is not the group but rather its representative. It’s the equivalent of a p.p. (per procurationem) signature on a paper document. Interestingly, you don’t need to be a group member to be assigned Send As or Send on Behalf of permission for the group.

The Problem Report

The first indication of a problem came in a discussion in the Microsoft Technical Community where the question was posed why people who send as a Microsoft 365 group didn’t receive Non-delivery Reports (NDRs). As it happens, after a lot of engineering effort, the NDRs generated by Office 365 are more clearer in terms of telling the sender why their message failed to be delivered and what they must do to fix the problem. Clearly, no action can be taken if a NDR is never received and the original message has literally gone into a black hole.

Investigations proved that:

• Messages sent from a Microsoft 365 Group using the Send on Behalf of permission to a bad address resulted in a NDR being delivered to the sender.
• Messages sent to a bad address from a personal mailbox also resulted in an NDR (as expected, but good to check anyway).
• Messages sent from a Microsoft 365 Group using the Send As permission to a bad address resulted in no NDR being delivered to either the group or the sender.
• A message trace showed that an NDR was processed, but that the Microsoft Agent agent handling the NDR delivered the NDR to the Deletions sub-folder in the Recoverable Items folder of the group mailbox “because of an inbox role the recipient set up” (Figure 1).

Apart from a reference to a “group escalation agent,” the PowerShell version of the message trace didn’t turn up any more detail.

# Get message trace information for a message
 Get-MessageTraceDetail  -MessageTraceId 0941762f-0e0b-4165-d4e7-08d740d4322f -RecipientAddress exchangemvps@xxx.com | Format-List

Message Trace ID : 0941762f-0e0b-4165-d4e7-08d740d4322f
Message ID       : <bf8c2cba-748a-437d-b953-4c7e84b42d7a@am6pr04mb5255.eurprd04.prod.outlook.com>
Date             : 24 Sep 2019 09:47:22
Event            : Deliver
Action           :
Detail           : The message was successfully delivered to the folder:
                   DefaultFolderType:RecoverableItemsDeletions
Data             : <root>
<name="SourceContext" string="08D73FD41D42EEF6;2019-09-24T09:47:21.847Z;ClientSubmitTime:">
<name="MailboxServer" string="VI1PR04MB3214">
<name="DeliveryPriority" string="Normal">
<name="TotalLatency" integer="1"><mep name="ReturnPath" string="">
<name="ClientName" string="AM6PR04MB5255.eurprd04.prod.outlook.com">
<name="CustomData" blob="S:OriginalFromAddress=ExchangeMVPs@xxx.com">
<name="SequenceNumber" long="0">
<name="RecipientStatus" string="DefaultFolderType:RecoverableItemsDeletions-Group Escalation Agent">
<name="RecipientReference" string="">
</bf8c2cba-748a-437d-b953-4c7e84b42d7a@am6pr04mb5255.eurprd04.prod.outlook.com>

Rules in an Microsoft 365 Group?

There’s no easy way to create an inbox rule in a Microsoft 365 group mailbox so the explanation offered in the message trace is unlikely to be true. What’s more likely is that some condition causes the Exchange transport service to automatically route NDRs to Recoverable Items. It’s possible that an engineer thought that it would be best to suppress NDRs for messages sent as a Microsoft 365 Group, but it’s hard to understand the logic. In any case, the messages do end up in Deletions (perhaps thanks to that “group escalation agent”). That fact can be confirmed by running the Get-MailboxFolderStatistics cmdlet against the group mailbox:

# Check number of messages in the Deletions folder 
Get-MailboxFolderStatistics exchangegoms -FolderScope RecoverableItems | ?{$_.Name -eq "Deletions"}| Select Name, ItemsInFolder

Name      ItemsInFolder
----      -------------
Deletions             4

Questions, Always Questions

The big question is why Microsoft decided to route NDRs for messages sent as a Microsoft 365 Group to the Deletions folder in Recoverable Items. You might also ask why leaving the sender in perfect ignorance of their failed message was deemed to be a good idea? And then ask why the message trace report says that an inbox rule processed the NDR when it’s palpably the case that this didn’t happen. So many questions. Maybe we can get an answer at Ignite.

---

Need more information about Microsoft 365 Groups? We explain many of the mysteries in the Office 365 for IT Pros eBook. Uncloud your mind with the best and most comprehensive guide to Office 365 available anywhere.