Blocking Auto-Forwarding Rules Before an Attacker Creates One
A Microsoft 365 account is compromised.
The attacker does not immediately send thousands of phishing emails.
Instead, they create a forwarding rule.
Incoming messages are quietly copied to an external mailbox.
The employee continues using Outlook normally.
Nothing obvious appears broken.
Meanwhile, the attacker may be reading:
customer conversations
password-reset emails
supplier invoices
payment discussions
internal documents
authentication messages
That is why external automatic forwarding deserves much more attention than it often receives.
The safest default for most businesses is simple:
Do not allow users to automatically forward company email to external addresses unless there is a genuine business requirement.
Microsoft 365 already moves in that direction.
Its current outbound spam policy blocks automatic external forwarding by default.
Why Attackers Create Forwarding Rules
A stolen password gives an attacker temporary access.
A forwarding rule can create persistence.
Even if the employee later:
changes their password
signs out
notices suspicious activity
the malicious rule may continue copying new messages unless somebody finds and removes it.
Forwarding can also help an attacker monitor conversations before committing fraud.
Imagine an attacker watching:
supplier sends invoice
↓
finance employee discusses payment internally
↓
attacker waits for the right moment
↓
fake bank details are introduced
This is one reason mailbox compromise can turn into business email compromise.
There Are Several Types of Forwarding
Not all forwarding is configured in the same place.
Microsoft 365 supports at least two common mechanisms.
Inbox Rules
A user can create rules such as:
When mail arrives → forward it to attacker@example.com
These can be created from Outlook or Outlook on the web.
Attackers can also create rules that:
move messages
delete them
mark them as read
hide replies
so the victim sees less evidence of the compromise.
Mailbox-Level Forwarding
Exchange Online can also configure forwarding directly on the mailbox.
Microsoft describes this as mailbox or SMTP forwarding.
An attacker with sufficient privileges may attempt to abuse either mechanism.
That is why checking only:
Outlook > Rules
is not enough during an investigation.
Microsoft 365 Blocks External Auto-Forwarding by Default
This is the most important 2026 clarification.
In Microsoft Defender’s outbound spam policy, the Automatic forwarding rules setting can be:
Automatic – System-controlled
On – Forwarding is enabled
Off – Forwarding is disabled
Microsoft now states that:
Automatic – System-controlled = effectively Off
for all customers.
That means the secure default is already:
automatic forwarding to external recipients blocked.
Internal forwarding is not affected.
So your first job is to verify that nobody has weakened that configuration.
Check the Outbound Spam Policy
In the Microsoft Defender portal, go to the outbound anti-spam policy.
Review:
Automatic forwarding rules
For most organisations I would expect:
Automatic – System-controlled
or:
Off – Forwarding is disabled
Microsoft explicitly recommends either of those values for blocking automatic forwarding to external recipients.
If you see:
On – Forwarding is enabled
ask:
Why?
There may be a legitimate reason.
But it should be deliberate, documented and scoped.
What Does Blocking Actually Stop?
Microsoft says disabling automatic forwarding through the outbound spam policy blocks external forwarding created through:
Inbox rules
mailbox forwarding / SMTP forwarding
for affected users.
That is important because it gives administrators one central control over two commonly abused forwarding mechanisms.
Do Not Enable Forwarding Tenant-Wide Just for One Exception
Suppose one business process genuinely requires:
accounts@company.co.uk
to forward mail to an external specialist service.
Do not respond by setting:
Automatic forwarding = On
for everybody.
Instead, create a narrow custom outbound spam policy for only the users who genuinely require external forwarding.
Microsoft supports custom outbound spam policies scoped to specific:
users
groups
domains.
The principle should be:
default deny → explicit exception
rather than:
allow everybody → hope they use it safely.
Remote Domains Can Provide Additional Control
Exchange Online also provides Remote Domains.
These can influence whether automatic forwarding is permitted towards particular external domains.
Microsoft explains that multiple forwarding controls can coexist and that where one control allows forwarding but another blocks it, the block normally wins.
That means you can build a layered approach.
For example:
Outbound spam policy
→ external forwarding generally blocked.
Then, where absolutely required:
specific custom policy / remote-domain control
→ tightly controlled exception.
Do not assume one setting is the only layer available.
Mail Flow Rules Can Add Another Layer
Exchange mail-flow rules can also detect or control automatically forwarded messages.
This can be useful for organisations that need more granular policy or reporting.
For example, you might use transport rules to:
identify automatically forwarded messages
block particular destinations
add auditing information
generate reporting data
Microsoft specifically documents mail-flow rules and remote-domain settings as additional controls alongside outbound spam policies.
Again, avoid building three overlapping systems unless you understand which one is authoritative.
Security controls should be layered.
They should not be incomprehensible.
How to Check Whether Users Are Already Forwarding Externally
Microsoft provides an:
Auto forwarded messages report
for cloud mailboxes.
This can help identify users whose messages are being automatically forwarded to external recipients.
That is useful even if you believe forwarding is blocked.
You may discover:
historic configurations
exceptions
unexpected behaviour
Security configuration should be verified.
Not assumed.
Check Mailbox-Level Forwarding With PowerShell
During an investigation, Microsoft recommends checking the mailbox directly.
For example:
Get-Mailbox -Identity user@company.co.uk |
Format-List ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward
Microsoft specifically includes this check in its current compromised-account response process.
Look for:
unknown external addresses
unexpected forwarding targets
DeliverToMailboxAndForward behaviour you did not configure
If suspicious forwarding exists:
remove it as part of the compromise response.
Check Inbox Rules Too
Use Exchange Online PowerShell:
Get-InboxRule -Mailbox user@company.co.uk
Review rules for actions involving:
ForwardTo
RedirectTo
ForwardAsAttachmentTo
MoveToFolder
DeleteMessage
MarkAsRead
Do not look only for a rule conveniently named:
Forward all mail to hacker.
Attackers may use vague or misleading names.
They may also create rules designed primarily to hide:
replies
security alerts
payment emails
rather than forwarding everything.
Use Purview Audit to Find Who Changed the Rules
Current Microsoft Purview guidance provides a supported process for identifying:
mailbox rule creation
modification
deletion
through the audit log.
That is valuable because:
current state tells you what exists now
while:
audit history tells you what happened.
During an incident, ask:
When was the rule created?
Which account created it?
What IP/session was involved?
Was it later deleted?
Were other mailbox changes made at the same time?
That gives you a much stronger investigation than simply removing the rule and moving on.
Defender Can Detect Suspicious Forwarding Behaviour
Microsoft Defender for Cloud Apps and Defender XDR can also detect suspicious email-forwarding behaviour.
Microsoft’s current anomaly-detection documentation includes suspicious email forwarding rules as a recognised account-compromise indicator.
Depending on licensing and configuration, security teams may be alerted when a user creates a forwarding rule that is unusual for them.
That is useful because blocking and detection solve different problems:
Blocking
→ prevents common forwarding abuse.
Detection
→ helps reveal suspicious mailbox behaviour.
You want both where appropriate.
Don't Forget OAuth and Delegated Access
A forwarding rule is only one way an attacker can maintain access.
A compromised Microsoft 365 account may also have:
suspicious OAuth applications
added delegates
altered MFA methods
active sessions
malicious inbox rules
So if you discover unauthorised forwarding, do not stop at:
Delete rule.
Treat it as evidence of a wider account compromise.
Microsoft’s compromised-account guidance includes reviewing forwarding as one step within a broader containment and recovery process.
The Correct Compromised-Mailbox Response
If you find a malicious forwarding rule, I would investigate in this order:
1. Block or secure the compromised account.
2. Reset credentials.
3. Revoke active sessions.
4. Review MFA/authentication methods.
5. Check mailbox forwarding.
6. Review Inbox rules.
7. Check mailbox delegates.
8. Review suspicious OAuth consent.
9. Review sign-in history.
10. Use audit logs to establish when the changes occurred.
11. Determine what information may have been exposed.
12. Monitor for further suspicious activity.
Removing the forwarding rule fixes the persistence mechanism.
It does not explain:
how the attacker got in.
Why Password Changes Alone Are Not Enough
Suppose an attacker:
1. steals the password
2. signs in
3. creates an external forwarding rule
4. user changes their password
If the rule remains, incoming mail may continue to be forwarded.
This is why a compromised Microsoft 365 mailbox should always trigger a review of:
forwarding
rules
delegates
apps
authentication
not merely:
Change password and close ticket.
What About Legitimate Business Forwarding?
Some businesses genuinely need external forwarding.
Examples may include:
ticketing platforms
specialist archive systems
external CRM processing
legacy workflows
Do not simply prohibit a valid process without understanding it.
Instead:
1. Verify the business requirement.
2. Confirm the receiving service.
3. Scope the exception narrowly.
4. Document it.
5. Monitor it.
6. Review whether a safer integration exists.
Sometimes a proper:
connector
API integration
shared mailbox
vendor integration
is better than ordinary automatic forwarding.
External Forwarding Is Also a Data-Loss Risk
The danger is not limited to compromised accounts.
An employee could deliberately or accidentally forward company mail to:
personal Gmail
personal Outlook
another employer
unmanaged service
That may expose:
personal data
confidential contracts
customer information
internal communications
Microsoft explicitly describes external automatic forwarding as a potential information-disclosure risk.
Blocking it is therefore both:
security control
and:
data-governance control.
Watch for NDR 5.7.520
When outbound forwarding is blocked, you may encounter an NDR such as:
5.7.520 – Your organization does not allow external forwarding.
That is normally evidence the Microsoft 365 policy is doing its job.
Do not immediately switch external forwarding on tenant-wide just to remove the error.
Instead ask:
Why is this mailbox attempting to forward externally?
It may be:
legitimate business configuration
forgotten old rule
user mistake
malicious activity
Investigate first.
A Practical Secure Configuration
For many SMEs, I would aim for:
Tenant default
External automatic forwarding blocked.
Exceptions
Only specific users/workflows where justified.
MFA
Enabled and appropriately hardened.
Monitoring
Microsoft Defender alerts reviewed.
Audit
Mailbox-rule changes available for investigation.
Incident response
Compromised-mailbox process includes forwarding and rule checks.
That is much stronger than relying on users to notice strange Outlook behaviour.
The Quick Admin Checklist
For Microsoft 365:
1. Open the outbound spam policy.
2. Verify Automatic forwarding rules is Automatic/System-controlled or Off.
3. Review any custom policies allowing forwarding.
4. Confirm every exception is still required.
5. Check the Auto forwarded messages report.
6. Review mailbox-level forwarding.
7. Review Inbox rules.
8. Confirm audit logging can identify rule changes.
9. Monitor Defender alerts.
10. Include forwarding checks in every compromised-account investigation.
The key principle is:
Block automatic external forwarding by default, then treat every exception as something that needs justification and monitoring.
How Hamilton Group Can Help
Hamilton Group can help businesses secure Microsoft 365 against mailbox compromise and business email fraud.
We can assist with:
Microsoft 365 security
external forwarding controls
Exchange Online
Inbox rules
mailbox forwarding
Microsoft Defender
Microsoft Purview auditing
MFA
Conditional Access
compromised-mailbox investigation
business email compromise
The objective is not merely to remove malicious rules after an attacker creates them.
It is to make sure external forwarding is blocked by default, legitimate exceptions are controlled and suspicious mailbox changes are visible quickly.
Visit hgmssp.com or call 0330 043 0069.