Detecting Plus Email Addressing in Exchange Online

I’ve always found plus email addressing to be a clever way to manage my inbox. By appending a + and a custom tag to my email, I can filter messages, track campaigns, or just organize emails automatically.

The challenge is that while Exchange Online preserves the plus sign when I send outbound messages, it does not expose it in inbound message traces. This makes it tricky to see who inside the organization is using plus addressing, especially when I want to monitor patterns across the team. To solve this, I wrote two PowerShell scripts: one that queries messages from a specific user, and another that queries messages from all users over a configurable window.

Understanding Message Trace in Exchange Online

To check the status of message tracing in your tenant, you can use the Get-MessageTraceV2 cmdlet. By default, message tracing is available in all Exchange Online tenants, but you can control auditing or tracing policies with Set-TransportConfig or PowerShell auditing commands if needed. While turning off message tracing completely is uncommon, it can be managed by adjusting transport rules or trace retention policies.

It’s important to understand that plus addressing is only visible on outbound messages. Trying to detect it on inbound messages won’t work, because Exchange resolves the address before logging it in Message Trace.

Enabling, Disabling, and Checking Plus Addressing

Plus addressing lets users append a + and a tag to their email addresses (e.g., user+tag@company.com). By default, this feature may be off in your tenant, so if you want to track its usage, you first need to ensure it’s enabled.

To check if plus addressing is enabled in your tenant:

# Connect to Exchange Online first
Connect-ExchangeOnline -UserPrincipalName <user-upn>

# Check if plus addressing is enabled
Get-OrganizationConfig | Select-Object -Property AllowPlusAddressInRecipients

This returns True if plus addressing is allowed, False if not.

To enable plus addressing:

Set-OrganizationConfig -AllowPlusAddressInRecipients $true

To disable plus addressing:

Set-OrganizationConfig -AllowPlusAddressInRecipients $false

Exhange plus addressing is enabled by default,  you need to disable it manually if not required, you can use the scripts below to track which internal users are sending outbound messages with + in the recipient address. This is the only reliable way to audit usage.

Note : Inbound messages will not show the + in message traces — Exchange resolves the address before logging it.

Script 1: Querying a Specific User

This script is designed to analyze the plus addressing usage of a single user. It filters for messages sent externally that contain a + in the recipient address, while excluding system addresses and internal routing addresses.

param (
    [Parameter(Mandatory=$true)]
    [string]$UserEmail,
    [int]$HoursBack = 1
)

$EndDate   = Get-Date
$StartDate = $EndDate.AddHours(-$HoursBack)

Write-Host "Analysing outbound plus-addressing usage for $UserEmail"
Write-Host "Time window: $StartDate -> $EndDate"
Write-Host ""

$results = Get-MessageTraceV2 `
    -StartDate $StartDate `
    -EndDate   $EndDate `
    -SenderAddress $UserEmail `
    -ResultSize 5000 |
Where-Object {
    $_.RecipientAddress -match '\+' -and
    $_.RecipientAddress -notlike "*@company.com" -and
    $_.RecipientAddress -notmatch '^IMCEAEX-'
}

if (-not $results) {
    Write-Host "No outbound plus-addressed messages found for $UserEmail in the last $HoursBack hour(s)."
    return
}

Write-Host "Found $($results.Count) outbound plus-addressed message(s) for $UserEmail."

$results | Select-Object Timestamp, SenderAddress, RecipientAddress, Subject | Format-Table -AutoSize

This script gives me a clear view of how a particular user is sending messages with plus addressing and shows the exact external recipients and timestamps.

Script 2: Querying All Users

For broader visibility, I built a script that can query all users for plus-addressed outbound messages. The query window is configurable with -HoursBack, allowing 1, 2, 4, or 6 hours. The script slices the time internally in one-hour increments to prevent timeouts or incomplete results. It also excludes system addresses and IMCEAEX routing addresses.

param (
    [ValidateSet(1,2,4,6)]
    [int]$HoursBack
)

$EndDate   = Get-Date
$StartDate = $EndDate.AddHours(-$HoursBack)

Write-Host "Analysing outbound plus-addressing usage"
Write-Host "Time window: $StartDate -> $EndDate"
Write-Host ""

$results = @()

$currentStart = $StartDate
while ($currentStart -lt $EndDate) {

    $currentEnd = $currentStart.AddHours(1)
    if ($currentEnd -gt $EndDate) { $currentEnd = $EndDate }

    Write-Host "Querying slice $currentStart -> $currentEnd"

    try {
        $slice = Get-MessageTraceV2 `
            -StartDate $currentStart `
            -EndDate   $currentEnd `
            -ResultSize 5000 |
        Where-Object {
            $_.SenderAddress -notlike "postmaster*" -and
            $_.RecipientAddress -match '\+' -and
            $_.RecipientAddress -notlike "*@company.com" -and
            $_.RecipientAddress -notmatch '^IMCEAEX-'
        }

        if ($slice) { $results += $slice }
    }
    catch {
        Write-Warning "Failed to retrieve slice $currentStart -> $currentEnd"
    }

    $currentStart = $currentEnd
}

if (-not $results) {
    Write-Host "No outbound plus-addressed messages found in the last $HoursBack hour(s)."
    return
}

Write-Host "Found $($results.Count) outbound plus-addressed message(s)."

$senderStats = $results |
    Group-Object SenderAddress |
    Sort-Object Count -Descending |
    ForEach-Object {
        [PSCustomObject]@{
            Sender           = $_.Name
            PlusMessageCount = $_.Count
            RecipientAddresses = ($_.Group.RecipientAddress | Sort-Object -Unique) -join ", "
        }
    }

Write-Host ""
Write-Host "=== Outbound Plus Addressing Usage (External Recipients) ==="
$senderStats | Format-Table -AutoSize

This second script is particularly useful for tenant-wide audits, letting me see which users are sending external messages with plus addressing, which external recipients are receiving them, and how frequently it’s being used. By limiting the query to a maximum of six hours and slicing hourly, it remains performant and reliable.

Conclusion

Using plus addressing in outbound emails is a powerful feature, but it isn’t something you can detect in inbound message traces. By combining targeted scripts with Exchange Online’s message trace tools, I can monitor usage effectively and understand how employees are leveraging this functionality.

The first script allows a deep dive into a single user’s behavior, while the second provides a broader view across multiple users over a configurable window. These tools let me produce accurate, actionable data about plus addressing in my organization without overloading Exchange or relying on incomplete reports.