We have Office 365 E1 - with Forefront for spam/virus filtering. My problem is that I need to see all e-mails coming into a specific user, and there doesn't seem to be a way to do that. I can search e-mails in Forefront if I know the domain of the person sending, and the e-mail address of the recipient, but what if I don't know the sender?
Example: Someone sends a marketing e-mail with a spoofed address (blah@spoofed.com) to my user (user@mydomain.com). I can see the e-mail in their Inbox - however if I search Forefront for anything from spoofed.com to user@mydomain.com, no e-mails show up in the message trace. So where did the e-mail originally come from?
I'd like to be able to see all e-mails coming into user@mydomain.com so I can find out who some e-mails are really coming from - then I can set policy/rules on it.