Diagnosing The Problem

Prerequisite:

Before starting, Open Exchange Online PowerShell to run cmdlets.

• Click Start
• Search for PowerShell
• Right‑click Windows PowerShell
• Select Run as administrator

Ensure you have:

• Exchange Online administrative permissions (e.g., Exchange Admin, Global Admin)
• Exchange Online PowerShell Module installed
• Network access to Microsoft 365
• Open Exchange Online PowerShell
• Open Windows PowerShell as Administrator
• Connect to Exchange Online by running:

Connect-ExchangeOnline

• Sign in using your Microsoft 365 admin credentials.

Cause 1: Diagnosing:

Diagnostic Steps

1. Run the below cmdlet:

Get-DistributionGroupMember -Identity "GroupName"

or using its expanded content version:

Get-Recipient -RecipientPreviewFilter (Get-DynamicDistributionGroup "GroupName").RecipientFilter

• Review the output for nested groups
• If another group is listed, users may inherit membership

2. Run the Diagnostic Cmdlet

• Execute the following command, replacing GroupName with the actual distribution group name or email address:
• Example:

Get-DistributionGroupMember -Identity "GroupName"

Get-DistributionGroupMember -Identity "IT-Alerts"

3. Example Output:

Name                                     RecipientType

----------                           -------------

John Smith                              UserMailbox
Helpdesk-Team                      MailUniversalDistributionGroup
HR-Notifications                     MailUniversalDistributionGroup

Important
If you see any group objects listed, this confirms nested membership.

To view members of the nested group, run:

Get-DistributionGroupMember -Identity "Helpdesk-Team"
 

or using its expanded content version:

Get-Recipient -RecipientPreviewFilter (Get-DynamicDistributionGroup "GroupName").RecipientFilter 

Repeat this step if multiple layers of nesting exist.

Cause 2: Diagnosing:

Diagnostic Steps

1. Run the below cmdlets:

Get-DistributionGroupMember -Identity "GroupName

2. Or recursive validation:

function Get-GroupMembersRecursive {

    param ([string]$Group)

    Get-DistributionGroupMember -Identity $Group | ForEach-Object {

        if ($_.RecipientType -like 'Group') {

            Get-GroupMembersRecursive $.Name

        } else {

            $_

        }

    }

}

Get-GroupMembersRecursive "GroupName"

Prerequisites

• Please consider the same prerequisites as the Cause 1.
• Please repeat the same step 1 as well as the Cause 1.
• Run the Diagnostic Cmdlet
• Please repeat the same step 2 as well as the Cause 1.

3. Example Output
   Name                        RecipientType

----                          -------------

John Smith                 UserMailbox

IT-Support-Level2     MailUniversalDistributionGroup

4. Interpretation

• John Smith is a direct member
• IT-Support-Level2 is a nested distribution group
• All users inside IT-Support-Level2 inherit membership

5. Define the Recursive Function:

Function Get-GroupMembersRecursive {
param (
[string]$Group
)

Get-DistributionGroupMember -Identity $Group | ForEach-Object {
if ($.RecipientType -like 'Group') {
Get-GroupMembersRecursive $.Name
} else {
$_
}
}
}

Get-GroupMembersRecursive "GroupName"

6. What This Function Does:

7. Example Recursive Output

Name              RecipientType

----              -------------

John Smith        UserMailbox

Linda Wu          UserMailbox

Olivia Mitchell   UserMailbox

Interpretation

• Users Linda Wu and Olivia Mitchell are not direct members
• They are members of nested groups
• They inherit membership in Helpdesk-Team

Helpdesk-Team

├── John Smith

└── IT-Support-Level2

              ├── Linda Wu

              └── Olivia Mitchell

7. Why Recursive Validation Is Required:

Nested groups may contain:

• Other distribution groups
• Security groups
• Multiple layers of nesting

Recursive validation expands all nested layers

8. Common Findings & Root Causes:

Cause 3: Diagnosing

Prerequisites

• Please consider the same prerequisites as Cause 1.
• Please repeat the same step as Cause 1.

Diagnostic Steps

Run the below cmdlets:

Get-DynamicDistributionGroup -Identity "GroupName" | Format-List Name,RecipientFilter

Check user attribute match:

Get-Recipient user@domain.com | fl Department,Title,Office,CustomAttribute*

Identify Whether the Group Is Dynamic

Run the Command:

Get-DynamicDistributionGroup -Identity "GroupName

Expected Output (Example)

Name : Management-DDG
RecipientFilter : ((Department -eq 'Management'))
RecipientTypeDetails : UserMailbox
``

How to Interpret

If the command returns output → the group is Dynamic
If the command fails → the group is static (use DG diagnostics instead)

Cause 4: Diagnosing.

Prerequisites

• Please consider the same prerequisites as Cause 1.
• Please repeat the same step as Cause 1.

Important:
Get-UnifiedGroupLinks works only for Microsoft 365 Groups, not Distribution Groups.

Is it feasible to list group members and owners by using the Get-UnifiedGroupLinks cmdlet:

Diagnostic Steps

Run the below cmdlet:

Get-UnifiedGroupLinks -Identity "GroupName" -LinkType Members

Example 1:

Get-UnifiedGroupLinks -Identity "MarketingTeam" -LinkType Members

Example Output (Partial)

This confirms the group is a Microsoft 365 Group, and membership must be checked using Unified Group cmdlets.

Expected Result

Command returns group details → this is a Microsoft 365 Group
Command fails → group is not Unified (use DG or DDG diagnostics instead)

How to Interpret

• Each entry represents a direct member of the Microsoft 365 Group
• If the affected user appears in this list, email delivery is expected
• Microsoft 365 Groups do not support nested groups, so membership is always direct. Users can receive messages due to subscription settings, even if not actively viewing group membership.

Run the cmdlet:

Get-UnifiedGroupLinks -Identity "GroupName" -LinkType Subscribers

Cause 5: Diagnosing.

Prerequisites:

Same prerequisites as previous causes, including:

Exchange Online PowerShell connected
Permissions: Organization Management or Compliance Management
Affected user’s email address
Sample email with full message headers

Diagnostic Steps

Run the below cmdlet:

Get-TransportRule | Select Name,State,Mode,Priority

Message header indicators:

• X-MS-Exchange-Organization-TransportRules

List All Transport (Mail Flow) Rules
 

Example Output (Partial)

Name       : Add BCC for Compliance
Conditions : SenderAddressLocation -eq 'Header'
Actions    : BlindCopyTo recipients@domain.com

Name       : Redirect Vendor Messages
Conditions : FromAddressMatchesPatterns vendor@partner.com
Actions    : RedirectMessageTo audit@domain.com

Second Sample Outputs:

How to Interpret the Output:

Focus on Actions, especially:

If the affected user or a group they belong to appears here, email delivery is expected.

Example Hidden redirection:

Cause 6: Diagnosing.

Diagnostic Steps

Run the below cmdlets:

Get-InboxRule -Mailbox user@domain.com

Get-Mailbox user@domain.com | fl ForwardingAddress,DeliverToMailboxAndForward

Prerequisites:

Same prerequisites as previous causes, including:

• Exchange Online PowerShell connected

• Exchange Administrator or appropriate mailbox permissions

• Affected user’s email address

Sample email for correlation (recommended)

 Step 1: Check Inbox Rules for the User Mailbox

Diagnostic Command

Get-InboxRule -Mailbox user@domain.com

Example Output (Partial)

Name                              :             Forward invoices

Enabled                          :             True

Description                   :             Forward invoice emails

RedirectTo                    :             accounting@domain.com

ForwardTo                     :             manager@domain.com

SubjectContainsWords : Invoice

How to Interpret the Output

Review the following properties carefully:

If the affected user appears in ForwardTo or RedirectTo, email delivery is expected.

Step 2: Identify Rules Likely to Trigger Unexpected Delivery

Pay close attention to:

• Rules with no sender restriction
• Rules using SubjectContainsWords
• Rules forwarding to groups or shared mailboxes

Example Risky Rule

Name                :             Forward all external email

Enabled            :             True

ForwardTo       :             teamlead@domain.com

Every inbound message is forwarded, regardless of original recipient.

Step 3: Check Mailbox‑Level Forwarding Configuration

Inbox rules are not the only forwarding mechanism. Mailbox‑level forwarding applies globally to the mailbox.

Diagnostic Command

Get-Mailbox user@domain.com | fl ForwardingAddress,DeliverToMailboxAndForward

Example Output (Forwarding Enabled)

ForwardingAddress                                :              sharedmailbox@domain.com

DeliverToMailboxAndForward            :             True

How to Interpret

If forwarding is configured, the user may receive email without being a direct recipient.

Cause 7: Diagnosing.

Diagnostic Steps

Run the below cmdlet:

Get-MessageTrace -RecipientAddress user@domain.com | Select MessageId,SenderAddress,Received

Prerequisites

Same prerequisites as previous causes:

• Exchange Online PowerShell connected

• Permissions: View-Only Recipients, Message Tracking, or higher

• Affected user’s SMTP address

• Approximate time the email was received (recommended)

Step 1: Run Message Trace for the Affected User

Diagnostic Command:

Get-MessageTrace -RecipientAddress user@domain.com |

Select MessageId, SenderAddress, Received

Step 2: Understand the Output

Example Output

MessageId                                          SenderAddress                                     Received

---------                                         -------------                                     --------

<CAEPx12345@sender.com>            alerts@partner.com                              3/16/2026 14:22

<BNYQx67890@domain.com>         hr@domain.com                                    3/16/2026 09:10

Field Explanation

If the message appears here, Exchange successfully delivered or routed it to the mailbox.

Step 3: Correlate with the Reported Email

Match the trace output with:

• Sender address
• Approximate delivery time
• Message subject (if needed, via extended trace)

This step confirms you are troubleshooting the correct message.

Step 4: Expand the Investigation (When needed)

If multiple messages appear or additional details are required:

Diagnostic Command:

Get-MessageTrace -RecipientAddress user@domain.com -StartDate 03/16/2026 -EndDate 03/17/2026

Narrows delivery dates

Reduces noise for high‑volume mailboxes

Important note:

• Get-MessageTrace cmdlet only shows last 10 days (standard)
• Older traces require:

Start-HistoricalSearch

Step 5: Interpret Message Trace Results

Scenario 1: Message appears in Message Trace

Exchange intentionally delivered the message

Next steps:

• Correlate with:

  • Group Expansion (Causes 1–4)

  • Dynamic Distribution Groups (Cause 3)

  • Transport Rules (Cause 5)

  • Inbox Rules / Forwarding (Cause 6)

Use message headers to determine why

Scenario 2: Message does NOT appear in Message Trace

Exchange did not process delivery to this mailbox

Possible causes:

• Client‑side rule (Outlook only)

• External forwarding after delivery

• User misidentified the message

• Incorrect recipient address used

Cause 8: Diagnosing:

Step 1: Collect Full Message Headers (Source of Truth)

Outlook (Windows / Mac):

1. Open the message
2. Select File → Properties
3. Copy everything under Internet headers

Outlook on the Web:

1. Open the message
2. Select ⋯ (More actions) → View → View message details
3. Copy the full header text

Step 1 – Collect Full Message Headers (Source of Truth)

Why This Step Is Critical

Full message headers are the single authoritative source to determine:

Whether Exchange Online expanded a group

Whether a Dynamic Distribution Group was evaluated

Whether a transport (mail flow) rule modified delivery

Whether forwarding or redirection occurred

The exact recipient and routing path

Partial headers are not sufficient.

Screenshots of the email body, “View source” snippets, or copied lines from Outlook do not provide reliable diagnostic evidence.

Prerequisites:

• Access to the affected mailbox

• The exact email exhibiting unexpected delivery

• Desktop Outlook or Outlook on the Web (OWA)

Step‑by‑Step Procedure

1. Open the Affected Email

Open Outlook

Double‑click the email so it opens its own window

Do not use the preview pane!!

2. Access Message Properties

Windows Outlook

1. Select File

2. Select Properties

MACOS Outlook

1. Select Message

2. Select Properties (or View Source, depending on version)

3. Locate the Internet Headers Section

In the Properties window, find the field labeled:

Internet headers

This field contains all routing, policy, and expansion metadata.

4. Copy the Entire Header Block

• Click inside the Internet headers text box
• Press Ctrl + A (or Cmd + A on Mac)
• Press Ctrl + C (or Cmd + C)

Ensure the copied text starts with headers such as:

Received:

Return-Path:

Authentication-Results:

and ends with the final routing entry.

Example (What a Valid Header Block Looks Like)

Received: from NAM11-MW2-obe.outbound.protection.outlook.com

X-MS-Exchange-Organization-ExpandedMembers:

X-MS-Exchange-Organization-TransportRules:

X-MS-Exchange-Organization-DynamicGroupExpansion: True

This confirms the header capture is complete and valid.

Common Mistakes (Desktop Outlook)

Outlook on the Web (OWA)

Objective

Capture headers directly from the Exchange Online service.

Step‑by‑Step Procedure

1. Open the Email in OWA

• Sign in to https://outlook.office.com
• Open the affected message

2. Open Message Details

1. Select ⋯ (More actions) in the email toolbar
2. Select View
3. Select View message details

3. Copy the Full Header Text

A new pane opens titled Message details.

• Select all text in the window
• Copy the full contents

The text should include:

Received:

To:

X-MS-Exchange-Organization-*

Example (OWA Header Snippet)

X-MS-Exchange-Organization-Recipient-Expanded: True

X-MS-Exchange-Organization-TransportRules:

RuleName: Add_BCC_Compliance;

Confirms header collection was successful.

Once collected, these headers will be analyzed to diagnose.

Cause 9: Proxy Address / Alternate Address Matching

Please validate the alternate email address by using this cmdlet:

Get-Recipient user@domain.com | fl EmailAddresses

Possible Output Examples:

EmailAddresses : {SMTP:user@domain.com, smtp:user.alias@domain.com, smtp:firstname.lastname@domain.com}

where:

• SMTP: (uppercase) means Primary SMTP address
• smtp: (lowercase) means Secondary/alias addresses

EmailAddresses : {SMTP:user@domain.com,

                smtp:user.alias@domain.com,

                SIP:user@domain.com,

                X500:/o=ExchangeLabs/ou=Exchange Administrative Group/cn=Recipients/cn=user123}