When a message is send a message to a typical moderated distribution list, the moderator gets the familiar Approve / Reject buttons and this works for the test group I setup as part of a "your decision is requested" e-mail. This message comes from "Microsoft Exchange on behalf of ". This e-mail cannot be forwarded until a decision is made.
However when I enabled moderation on all other groups, the moderator gets the "your decision is requested" e-mail but it doesn't contain the approve / reject group even though they are also both the moderator and the owner of the group. This message comes from "Microsoft Exchange Approval Assistant on behalf of ". This e-mail can be forwarded.
According to the message headers the failing group is X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem and the working group is X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
That said using the exchange management console I can run get-distributiongroup on both groups with no visible relevant differences. Both groups show in ECP and office 365 portal.
Is it just the case that I mail enabled the security group today and the whole environment hasn't caught up, or how do I diagnose the issue further?
Best Answer
After the weekend the issue resolved itself, one possibly theory is that after the global address list updated the security groups are now routed as local.