Block External Mail Forwarding in Microsoft 365 (and Find Existing Rules)

Why the default is not enough

Automatic forwarding to external addresses is controlled by the outbound anti-spam policy in Exchange Online Protection. It has three settings: 'Automatic - System-controlled' (the default), 'On - Forwarding is enabled' and 'Off - Forwarding is disabled'.

'Automatic' does not reliably mean off. Microsoft changed it to block forwarding for new tenants and for tenants that were not using forwarding, but in tenants that already used it, it can still behave like On. Microsoft's own advice is to set it to Off explicitly.

When forwarding is blocked, the forwarded message is rejected with the error 5.7.520 Access denied, so a business process that relies on forwarding shows up quickly.

How to check

1. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-spam. Open 'Anti-spam outbound policy (Default)' and look at Protection settings > Forwarding rules > Automatic forwarding rules. Check any custom outbound policies too.
2. Find mailboxes that already forward, and inbox rules that forward or redirect. With Exchange Online PowerShell:

Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
  Select-Object UserPrincipalName, ForwardingSmtpAddress, DeliverToMailboxAndForward

Get-Mailbox -ResultSize Unlimited | ForEach-Object {
  Get-InboxRule -Mailbox $_.UserPrincipalName |
    Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } |
    Select-Object MailboxOwnerId, Name, ForwardTo, RedirectTo
}

Look closely at inbox rules with odd names (a single dot, a few letters) and rules that move or delete messages containing words like invoice, payment or bank. Attackers use them to hide the conversation from the real user.

How to fix it

1. Set Automatic forwarding rules to 'Off - Forwarding is disabled' in the default outbound policy, or run Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off.
2. If a mailbox has a real business need, create a separate outbound policy with forwarding On for just that mailbox, and record why.
3. Remove forwarding and inbox rules you cannot explain, and treat each one as a possible compromise: reset the password, revoke sessions and check the sign-in logs for that user.
4. Check that the default alert policies 'Suspicious email forwarding activity' and 'Creation of forwarding/redirect rule' are on, under Policies & rules > Alert policy, and that someone actually receives the alerts.

Frequently asked