If you have a double hop smg then no issue. But, another way is to make the last content filter in your policies the following:
For all messages, inbound,
Action: forward a copy to "mailbox"
Theory is that if no other policy is triggered, the last one will be. But all policies above the last have to bypass the previous. A double hop is perfect. Another way is on your exchange server do a transport rule: this transport rule should work as all email has made it to Exchange.