Archiving Communications with Plus Address Recipients

Microsoft Exchange Online allows senders to address recipients using a plus sub-address format username+<sub-address>@domain.com, where:

  • username is the recipient's username

  • sub-address is any text that the recipient wants to add to their username

  • domain.com is the recipient's domain name

This is known as plus addressing and for the recipient jdoe@contoso.com, jdoe+newsletters@contoso.com and jdoe+creditcardstatements@contoso.com are both valid plus addresses. For further details on plus addressing in Exchange Online, see the official documentation. Here are some more examples of valid plus addresses:

  • jane.smith+creditcardstatements@example.com

  • peter.jones+work@example.com

  • susan.williams+personal@example.com

Enterprise Archive supports archival of communications containing plus address recipients. This feature improves the usability by making it easier for eDiscovery and Conduct users to review communications containing plus address recipients . W hile archiving communications with plus address recipients, it's important to note that:

  • Participants will not be automatically created for recipients with plus addresses.

  • The participant count will only include the mapped recipients for plus addresses.

To search for emails received by plus address recipients, click on the Find button to look for the internal participant and trigger a search. EA will show email communications where the participant's plus addresses were used.

images/download/attachments/173965705/plusaddressing2.png

When the message is reviewed, the original plus address recipient that the email was sent to will be visible:

images/download/attachments/173965705/PlusAddressReview.png

Note

Plus Address archiving is currently supported only for Microsoft Exchange Online journal mails and not for Google Workspace journal mails.

Use cases

This feature can be used in the following use cases:

  • Conduct reviewers can use this feature to review plus address email communications flagged for violation policies by participant count, participant groups, participant, or direction. This allows them to view the content of communications to either mark them as a false positive, a true violation, or escalate them to reviewers at higher levels for further review.

  • Case reviewers can use this feature to review plus address email communications collected into a case for custodians or custodian groups. This allows them to view the content of communications to either mark them as responsive, non-responsive, or under a different tag category such as attorney-client privilege. These communications can then be produced in the court of law or exported externally into a different eDiscovery system.

  • Archive administrators can use this feature to have EA apply retention policies on plus address email communications by participant, participant groups, or participant demographics such as department, division, location, or country. This allows EA to purge such communications on expiry of the retention period.

  • All users can use this feature to see the original plus address recipients when they download or export the message (Zip/EML, PST/MSG etc). This information is available when opened from the desktop or when consumed by a 3rd party system.

Limitations

The following are some limitations of this feature:

  • Participant endpoint-ids, Distribution Lists, and Shared mailboxes may include the "+" character as part of their journal traffic or historical data that was imported from a different system. This can cause unpredictable behavior, and communications may be archived with incorrect participants.

  • For existing customers, this change will only affect email communications archived from the date this feature is enabled .

  • This feature is currently behind a feature flag. Contact Smarsh support to enable this feature.

  • Employee email addresses containing a "+" character may not be correctly recognized as plus addresses, as indicated in Microsoft's documentation.