LDAP integration, as set up in Setup->User Lookups and employed from Setup->Domain Mappings will automatically detect regular user aliases. It does this by creating stream names using the sAMAccountName (Active Directory) or uid (Generic LDAP) for that user. Thus a user with multiple ProxyAddresses (AD) or "mail" (Generic) addresses associated with that account will be treated as a single billable user.
Group addresses generally don't have an associated sAMAccountName and therefore will not be treated as legitimate addresses. For these you can use Setup->Address-to-Stream Mappings to force CanIt to accept mail and place it in whatever stream you like (see below).
It is also possible to create a sAMAccountName or uid for these addresses, or to change the "List of attributes to use for stream name" within the LDAP setup to a variable that does exist for these group addresses. The only viable options by default generally break regular aliases. Since most users don't want to treat these addresses as unique streams anyways, it is best to use the Address-to-Stream Mappings.
CanIt allows for Address-to-Stream Mappings and aliases to be used only within the same realm (and excluding sub-realms). If you have multiple domains with the same users, you will want to ensure that both belong to the same exact realm. Once this is done, CanIt will require a Setup->Domain Mapping method which will cause the same user from each domain to use a common stream. LDAP will handle this if both domains use the same LDAP source.
If LDAP is unavailable, the ChopDomain method generally makes this quite easy. This will cause the stream used to be just the user portion of the email address (ie. firstname.lastname@example.org and email@example.com would both use the stream "user"). For additional aliases that are not identified by this method, you will need to manually define the aliases as below.
Address-to-Stream Mappings and CanIt Aliases
For organizations without LDAP, regular user aliases must be defined. Using SMTP for Verification will identify distribution lists and shared mailboxes as valid address if they are configured to accept external mail, but they will be treated as unique users. Note that distribution lists do not accept external mail by default in exchange 2007 and 2010, this must be enabled if you want them to, as mentioned here:
Any address can be consolidated into any other existing user's stream in a couple of ways. The easiest way to do this is to simply direct mail to a responsible party within that list, for example:
Address Stream firstname.lastname@example.org email@example.com
This would allow Alice to review any pending message for sales as if it had been sent to her, but CanIt will still deliver that message to firstname.lastname@example.org after it passes through.
Alternatively, you may instead choose to push all group mail through a single stream that will be monitored by the administrator, increasing your user count by only one for all group addresses.
CanIt also has the Setup->Aliases page which serves the same function as Address-to-Stream Mappings, except that the mail is actually re-written to the target address. In the above example, this would deliver all mail for email@example.com to ONLY firstname.lastname@example.org. This is not very useful for groups, but can allow you to accept mail for addresses that don't actually exist on the back-end.
Alias Creation by End-Users
End-users can create these mappings by using Preferences->My Addresses and Preferences->Aliases, respectively. Each requires that a recipient at the alias address confirm that request (this means that aliases for non-existent addresses cannot be added using this method).