Within an Endpoint incident the Recipient of an email that violated a policy is displayed as the entered name, not as the email that it would resolve to.

Under normal circumstances, any recipient within incident details is shown as fully resolved emails.

For example: If a user will send an email and enters in the recipient field a username, the email client (outlook, domino) the email it will resolve to will be displayed.
If a user enters "First LastName <[email protected]>", it will be displayed in an incident in the same way. That is - "First LastName <[email protected]>".

However, in the following scenarios, the recipient field will display "First LastName" in the way it has been entered:

• Recipient string is the distribution group. Agent can’t resolve the group.
• User has specified display name, and the MTA (e.g., an on-premises Exchange server) is not accessible when the user is off the corporate network)
• Not able to resolve the username for some reason. It could be the case of a partial or wrong recipient.