Exchange Server: Accessing BCC Recipients

TL;DR

Someone forwarded an Exchange Server email to you and you need to see who was on the original BCC list? It’s not directly visible in most clients. This guide shows how to find it using PowerShell, eSpeak (if enabled), or by requesting access from the sender.

Finding BCC Recipients

1. Understand the Problem: When an email is forwarded, the original recipient list (including the BCC list) isn’t automatically included. This is a privacy feature.
   • Standard email clients like Outlook don’t display BCC recipients of forwarded messages.
   • You need to access the Exchange Server itself or use tools that can read the message headers.
2. Using PowerShell (Most Reliable): This requires you have appropriate permissions on the Exchange Server.
   1. Connect to Exchange Online PowerShell: Open PowerShell as an administrator and run:

      Connect-ExchangeOnline

      You’ll be prompted for your credentials.

   2. Find the Message ID: You need the unique identifier of the original email.
      • If you have access to the sender’s mailbox, search for the email and copy its Message-ID header (see Step 3).
      • Alternatively, ask the sender to provide it.
   3. Get the Full Email Details: Use the following command, replacing <Message ID> with the actual message ID:

      Get-Message -Identity "<Message ID>" | Select-Object Subject, From, To, CC, BCC

      This will display the email details, including the BCC recipients.

   4. Example: If the Message ID is ‘abcdef1234567890…’, the command would be:

      Get-Message -Identity "abcdef1234567890..." | Select-Object Subject, From, To, CC, BCC

3. Checking Message Headers (If you have the original forwarded email): This method is less reliable but can sometimes work.
   1. Open the Forwarded Email in Outlook: Double-click to open it.
   2. Access Properties: Go to File > Info > Properties.
   3. Internet Headers Tab: Click on the Internet Headers tab.
   4. Search for ‘Received:’ lines: Look through the headers for multiple ‘Received:’ lines. These show the path the email took.
      • The BCC list isn’t directly visible, but you might find clues about the original sender’s server and potentially identify other recipients if they were on the To or CC line.
4. Using eSpeak (If Enabled): Some organisations use eSpeak to archive emails.
   1. Access eSpeak: Log in to your organisation’s eSpeak system.
   2. Search for the Email: Find the original email by subject, sender, or date.
   3. View Full Message Details: eSpeak typically displays all recipient lists, including BCC.
      • Contact your IT department if you don’t have access to eSpeak.
5. Request Access from the Sender (Simplest Method): The easiest solution is often to ask the original sender to provide the BCC list.
   • Explain why you need the information.
   • They can use PowerShell as described in Step 2 to retrieve it quickly.