Hi Mike,

As stated here:
https://techcommunity.microsoft.com/t5/exchange-team-blog/journaling-in-hybrid-scenarios/ba-p/3821516

What happens when Send From Aliases is enabled?
When this feature is enabled, the Exchange Online address resolution from contoso.mail.onmicrosoft.com to consoso.com does not happen (to preserve the alias) and there will be no change in the email address. So, with Send From Alias feature enabled, journaling by Exchange Online does not happen when email originated from or was routed through on-premises.

That’s seems to be true according to my Tests.

Kind Regards
Andres

I have Send As Alias enabled, so an email from an on-premise mailbox to an EOL mailbox does not get journaled by the journaling rule in Exchange online.

Thanks to your article, through pipeline tracing I could see the “X-MS-Exchange-Organization-Processed-By-Journaling: Journal Agent” header was added to the email.

I created a Transport Rule to remove the header, but it’s still not journaling, and does not appear to be removing the “X-MS-Exchange-Organization-Processed-By-Journaling: Journal Agent” header.

From the look of it, the “X-MS-Exchange-Organization-Processed-By-Journaling: Journal Agent” header gets added in the Routing0022.eml file.

X-MessageSnapshot-UTC-Time: 2024-07-17T13:42:16.802Z
X-MessageSnapshot-Source: OnRoutedMessage,Journal Agent

While the Transport Rules get processed in the Routing0013.eml file, and occurs about a second before the header gets added.

X-MessageSnapshot-UTC-Time: 2024-07-17T13:42:15.826Z
X-MessageSnapshot-Source: OnResolvedMessage,Transport Rule Agent

I tested removing a header that exists in the Original.eml file, so before the Transport Rules get processed, and that gets removed.

I also found that the Journal Agent is mentioned in the Routing0009.eml file, so before the Transport Rules, but doesn’t add the header.

X-MessageSnapshot-UTC-Time: 2024-07-17T13:42:15.806Z
X-MessageSnapshot-Source: OnSubmittedMessage,Journal Agent

For some context, I have Standard Journaling enabled on all databases, but have also setup Premium Journaling on my test mailboxes to see if that results in the “X-MS-Exchange-Organization-Processed-By-Journaling: Journal Agent” header been added in the Routing0009.eml file, so before the Transport Rules are processes, but it doesn’t seem to.

Are you able to offer any advice on how I can remove the “X-MS-Exchange-Organization-Processed-By-Journaling: Journal Agent” header, so that I can journal the email in EOL?

Thanks
Mike

As documented by Microsoft here: https://techcommunity.microsoft.com/t5/exchange-team-blog/journaling-in-hybrid-scenarios/ba-p/3821516

Scenario 1: MX record points to on-premises
When email is processed by on-premises first, a header called X-MS-Exchange-Organization-Processed-By-Journaling is added to indicate that the journaling agent touched the message (this is an internal header and won’t be visible to the recipient). Regardless of whether any on-premises journaling rule exists, the journaling agent will always touch a message on-premises, and the header will be added. It is not possible to disable the on-premises journaling agent. This header will be promoted on the email to Exchange Online, and once in Exchange Online, the service won’t journal the email again to prevent duplicate journaling.

Kind Regards
Andres

If that journal header is not visible in EXO, why create a rule to remove it?

I would think that the header is maintained, since Exchange on-premises and Exchange Online treat hybrid messages as internal because the email addresses have the same accepted domain. Does removing that header force the other Exchange environment to journal it again?