Outlook’s Dislike for Moderated Distribution Lists

Recipient Moderation Works for All Mail-Enabled Objects

A discussion about moderated distribution lists was a throwback to the past. You hardly hear much about recipient moderation these days, but it was a big thing when Microsoft added it to Exchange 2010. Moderation works for both on-premises and cloud recipients, and it works in hybrid deployments too (there’s a good write-up about troubleshooting moderation on the EHLO blog).

Moderation works for all kinds of mail-enabled objects: mailboxes, dynamic and normal distribution lists, mail users and contacts, public folders, and Microsoft 365 groups. It’s a good feature to use to protect sensitive recipients from receiving emails from all and sundry.

A typical deployment scenario is to moderate messages sent to senior executives by forcing a review by an executive assistant before Exchange can deliver the messages to the target mailboxes. Moderation supports bypassing, meaning that you can define sets of users or distribution lists whose messages are not subject to checks. When an email comes from bypass senders, Exchange delivers it directly.

Moderation in Action

When moderation happens, an arbitration mailbox sends details of the email to the designated reviewers (moderators), who can approve or reject the message (Figure 1).

The response goes back to the arbitration mailbox, which releases the message for final delivery if the response is positive. If the response is negative, the arbitration mailbox returns the email to the original sender with a note to tell them that a moderator rejected its delivery. If a moderator doesn’t process the message within two days, it’s returned to the original sender to tell them that moderation didn’t happen.

Moderators have full access to messages awaiting approval, even if sensitivity labels encrypt message content and they wouldn’t normally have the right to read it. Because it needs to be able to check messages as they pass through the transport pipeline, the Exchange transport service has super-user access to all encrypted content. The transport service can decrypt the protected message when it sends the copy for approval, which is how the moderator can review the email.

You can even have a situation where a moderator reads a message, approves it for delivery, and the final recipient can’t read the email because the sensitivity label doesn’t grant them the right to access it. This underlines the point that senders should always know what rights a sensitivity label applied to email grants to recipients.

The Problem with Outlook

Coming back to the problem under discussion, the query was about why OWA can expand the membership of a moderated distribution list and Outlook for Windows cannot. On the surface, there’s no good reason why this should be so. Unlike a dynamic distribution list whose membership depends on directory attributes, the membership of a moderated distribution list is static and known. Even the Outlook address book agrees and is perfectly willing to display a list’s members (Figure 2).

When a user asks OWA to expand the membership of a moderated distribution list, it’s happy to do so (Figure 3).

But Outlook refuses point-blank, even if the plus sign appears to show that the client supports the expansion of a distribution list (Figure 4). Normally, if you click the plus sign, Outlook warns that if you expand the list, Outlook replaces the distribution list with the individual addresses of its members. Once this happens, you can’t collapse the individual members back to the list. I don’t know what Outlook means by a moderated public group either (as noted in the comments, this turns out to be a Microsoft 365 group…)

For the record, Outlook mobile avoids the issue by not offering the option to expand the membership for any distribution list.

One Outlook

Inconsistencies like this in client families madden users. In this case, it’s probably a small issue that affects very few users and an obvious and viable workaround exists, all of which means that Microsoft is unlikely to fix whatever is causing Outlook to fail to deal with moderated distribution lists. Maybe the fabled Project Monarch (aka “One Outlook”) app, apparently due to enter public preview soon, will address the inconsistency. But I wouldn’t hold your breath!

---

Learn about protecting Exchange Online and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s importance and how best to protect your tenant.