Blocking Auto-Forwarding Rules Before an Attacker Creates One
A compromised Microsoft 365 mailbox does not always trigger an obvious alert.
An attacker may sign in quietly, create an automatic forwarding rule and wait while copies of sensitive messages are delivered to an external address. The employee continues using Outlook normally, while invoices, password resets, customer conversations and internal documents leave the organisation in the background.
Changing the user’s password later may not undo that forwarding configuration.
The safer approach is to block automatic external forwarding before an attacker has the opportunity to create it.
Microsoft 365 provides several controls for doing this, but the most important is the outbound spam policy in Microsoft Defender. When automatic forwarding is disabled there, external forwarding through inbox rules and administrator-configured mailbox forwarding is blocked for the users covered by the policy. Internal forwarding is not affected.
This guide explains why automatic forwarding is dangerous, how to block it across Microsoft 365 and how to manage the small number of legitimate exceptions without reopening the whole tenant.
Why Attackers Create Forwarding Rules
After compromising a mailbox, an attacker may want continued visibility without repeatedly signing in.
An external forwarding rule can send copies of future messages to an address controlled by the attacker. This can expose:
- Supplier invoices
- Bank-detail changes
- Password-reset messages
- Customer correspondence
- Legal documents
- Internal security alerts
- Authentication emails
- Confidential attachments
Forwarding is particularly useful during business email compromise because the attacker can monitor genuine conversations and intervene when a payment or sensitive decision is expected.
The rule may also be designed to hide evidence. An attacker can combine forwarding with inbox rules that mark messages as read, move replies into obscure folders or delete security warnings.
Automatic Forwarding Is Not the Same as Manual Forwarding
Blocking automatic forwarding does not normally stop an employee from manually selecting an email and forwarding it to an external recipient.
It targets automatic mechanisms such as:
- Outlook inbox rules
- Outlook on the web rules
- Administrator-configured mailbox forwarding
- SMTP forwarding from the mailbox
- Some forwarding from hybrid or on-premises systems routed through Microsoft 365
Microsoft states that users whose on-premises mail systems forward through Microsoft 365 remain subject to the same outbound spam policy controls.
This distinction matters because the policy is intended to stop silent, persistent forwarding rather than prevent every legitimate external email.
Check Your Current Outbound Spam Policy
The main control is located in the Microsoft Defender portal.
Go to:
Email & collaboration → Policies & rules → Threat policies → Anti-spam
Open the outbound spam policy that applies to your users and locate the automatic forwarding setting.
Microsoft currently provides three options:
- Automatic – System-controlled
- On – Forwarding is enabled
- Off – Forwarding is disabled
For clarity and predictable enforcement, use Off – Forwarding is disabled when your business does not require automatic external forwarding.
Microsoft documents that selecting Off disables external forwarding through both user-created inbox rules and administrator-configured mailbox forwarding.
Do Not Rely on “Automatic – System-Controlled”
The wording sounds as though Microsoft will make a flexible risk-based decision, but the behaviour has changed over time.
Microsoft’s current guidance states that Automatic – System-controlled now operates like Off in all organisations. However, Microsoft recommends selecting an explicit value when you need clarity about the intended configuration.
An explicitly configured Off setting is easier to:
- Audit
- Explain
- Document
- Troubleshoot
- Test during security reviews
Security controls should not depend on administrators remembering what “system-controlled” happens to mean this year.
Create a Dedicated Blocking Policy
You can change the default outbound spam policy or create a dedicated custom policy.
A clearly named policy might be:
SEC – Block External Auto-Forwarding – All Users
Assign it broadly across the organisation.
Document:
- Included users
- Excluded users
- Policy priority
- Business owner
- Reason for the control
- Review date
- Exception process
Outbound spam settings are separate from Microsoft’s Standard and Strict preset security policies, so enabling those presets does not remove the need to review your outbound forwarding configuration.
What Happens When Forwarding Is Blocked?
When Microsoft identifies a message as automatically forwarded and the applicable outbound spam policy blocks that behaviour, the message is rejected.
The sender may receive a non-delivery report containing an error similar to:
5.7.520 Access denied.
Your organisation does not allow external forwarding.
Microsoft documents this behaviour so administrators can distinguish an intentional policy block from an ordinary mail-delivery failure.
Test the policy before broad enforcement so your support team recognises the message and knows how to handle legitimate requests.
Find Existing Forwarding Before You Enforce
Blocking future forwarding is essential, but you should also identify what already exists.
Review:
- User inbox rules
- Administrator-configured mailbox forwarding
- Shared mailboxes
- Mail-flow rules
- Remote-domain settings
- Hybrid forwarding arrangements
- Known forwarding to ticketing or archival services
Check mailboxes for forwarding with Exchange Online PowerShell:
Get-Mailbox -ResultSize Unlimited |
Where-Object {
$_.ForwardingAddress -ne $null -or
$_.ForwardingSmtpAddress -ne $null
} |
Select-Object DisplayName,
PrimarySmtpAddress,
ForwardingAddress,
ForwardingSmtpAddress,
DeliverToMailboxAndForward
You should also inspect inbox rules separately because mailbox-level forwarding and user-created rules are different mechanisms.
For a specific mailbox:
Get-InboxRule -Mailbox user@company.co.uk |
Select-Object Name,
Enabled,
ForwardTo,
ForwardAsAttachmentTo,
RedirectTo
Investigate any destination the business does not recognise.
Review the Auto-Forwarded Messages Report
Microsoft 365 provides reporting that can help identify users automatically forwarding messages to external recipients.
Use the relevant email-security or mail-flow reports in the Defender or Exchange administration experience to look for:
- Users generating forwarded messages
- New external destination domains
- Sudden forwarding volume
- Unexpected shared-mailbox forwarding
- Repeated forwarding failures
Microsoft also provides a mail-flow insight for new domains receiving forwarded email, helping administrators identify unexpected forwarding destinations.
A new destination domain should trigger questions:
- Who configured it?
- What business process requires it?
- Was the mailbox recently compromised?
- Is the external organisation approved?
- Does the forwarding contain personal or confidential data?
Understand How Remote Domains Interact
Exchange Online remote domains can allow or prevent automatic forwarding to selected external domains.
For example, an organisation might:
- Disable forwarding to all external domains
- Create one approved remote domain
- Allow forwarding only to that trusted destination
However, the outbound spam policy remains the stronger control when it is configured to block forwarding.
Microsoft explains that when a remote domain allows forwarding but the outbound spam policy is set to Off, the forwarding is still blocked. When one control allows the action and another blocks it, the block generally wins.
This prevents a remote-domain configuration from silently bypassing your main tenant-wide protection.
Avoid Broad Mail-Flow Exceptions
Mail-flow rules can detect or block certain automatically forwarded messages, but they should not be used as a casual replacement for the outbound spam policy.
Rules can become fragile when they depend on:
- Sender-controlled headers
- Large domain lists
- Subject wording
- Broad user exceptions
- Complex conditions nobody reviews
Use the outbound spam policy as the primary security control.
Use mail-flow or remote-domain controls only when you need additional, carefully documented restrictions or routing behaviour.
Handling Legitimate Business Exceptions
Some organisations have genuine forwarding requirements.
Examples include:
- A shared mailbox feeding an approved ticketing platform
- Messages routed to an external archive
- A regulated journaling workflow
- A temporary migration arrangement
- A monitored service operated by a trusted supplier
Do not enable forwarding for the whole organisation to support one mailbox.
Instead, create a custom outbound spam policy scoped only to the approved account or group and set automatic forwarding to On for that narrow population.
Then apply additional controls:
- Use a dedicated shared or service mailbox.
- Allow only the required destination.
- Document the business owner.
- Review the provider’s security.
- Avoid forwarding unnecessary sensitive content.
- Monitor the mailbox and destination.
- Add an expiry or review date.
Exceptions should remain small enough that an administrator can explain every account included.
Use Groups to Manage Exceptions
Create a dedicated group such as:
EXC – Approved External Auto-Forwarding
Scope the exception policy to that group.
For every member, record:
- Mailbox
- Destination address
- Business purpose
- Approver
- Data involved
- Date approved
- Review date
- Planned removal date
Do not add ordinary employees merely because forwarding is convenient.
A narrowly scoped group makes periodic reviews and removals much easier.
Protect Shared Mailboxes
Shared mailboxes are common forwarding targets because they receive:
- Invoices
- Supplier requests
- Customer enquiries
- Recruitment documents
- Support messages
Review addresses such as:
accounts@company.co.uk
finance@company.co.uk
hr@company.co.uk
support@company.co.uk
Confirm that no shared mailbox forwards externally unless the arrangement is approved.
Also review:
- Full Access permissions
- Send As permissions
- Inbox rules
- Mailbox forwarding
- Delegates
- Recent audit events
Several employees may access a shared mailbox, which can make unauthorised configuration harder to attribute without audit logging.
Alert on Forwarding Changes
Blocking forwarding prevents many attacks, but monitoring remains valuable.
Generate or monitor alerts for:
- New inbox forwarding rules
- Changes to mailbox forwarding
- New external destinations
- Suspicious administrator activity
- Unusual mailbox-rule creation
- Forwarding created after a risky sign-in
Microsoft Purview Audit can help identify mailbox-rule and administrative changes during investigations.
Your incident-response procedure should explain:
- Who investigates the alert
- How the user’s identity is verified
- How sessions are revoked
- How rules and forwarding are removed
- How sign-in and mailbox activity are reviewed
- Whether recipients need warning
What to Do When You Find a Suspicious Rule
Treat unexplained external forwarding as a possible mailbox compromise.
Immediately:
- Record the rule and destination.
- Block the user’s sign-in if malicious activity is ongoing.
- Revoke active sessions.
- Reset the password securely.
- Review and remove unknown MFA methods.
- Delete malicious forwarding and inbox rules.
- Review OAuth application consent.
- Examine Entra sign-in logs.
- Search Purview Audit.
- Identify messages exposed or forwarded.
Do not simply remove the rule and close the ticket.
The attacker may still have an active token or another persistence mechanism.
Common Mistakes
Blocking Only User-Created Inbox Rules
Administrator-level mailbox forwarding may remain.
Allowing Forwarding Tenant-Wide for One Application
A narrow business requirement creates an organisation-wide data-leak path.
Never Reviewing Existing Rules
The policy blocks future delivery, but suspicious configuration remains undiscovered.
Ignoring Shared Mailboxes
Finance and support mailboxes may contain the organisation’s most valuable communications.
Creating Permanent Exceptions
A temporary migration rule stays enabled for years.
Assuming Password Reset Removes Forwarding
Mailbox settings can remain after the password changes.
External Auto-Forwarding Checklist
Before enforcement:
- Review the default outbound spam policy.
- Set automatic forwarding explicitly to Off.
- Identify existing mailbox forwarding.
- Review user inbox rules.
- Check shared mailboxes.
- Review remote domains and mail-flow rules.
- Document legitimate dependencies.
For exceptions:
- Use a separate custom policy.
- Scope it to a dedicated group.
- Limit forwarding to approved destinations.
- Assign a business owner.
- Set a review date.
- Monitor forwarding activity.
Ongoing:
- Review auto-forwarded message reports.
- Monitor new destination domains.
- Alert on forwarding changes.
- Audit exception-group membership.
- Investigate unexplained rules as potential compromises.
- Remove expired exceptions.
Final Thoughts
Automatic external forwarding is convenient, but it also gives attackers a quiet way to maintain access to business communications.
The strongest default is simple:
Block automatic forwarding to external recipients unless a specific, approved business process requires it.
Use the Microsoft Defender outbound spam policy to enforce that rule across the tenant. Review existing mailbox and inbox-rule forwarding, protect shared mailboxes and create narrowly scoped exceptions only where the business can justify them.
Most importantly, treat unexpected forwarding as evidence of possible compromise—not merely an Outlook configuration problem.
Stopping the rule before an attacker creates it is far easier than investigating months of silently forwarded email.
Need Help Blocking External Email Forwarding?
Hamilton Group can help you secure Microsoft 365 mail flow and reduce the risk of mailbox data theft.
Our experts can help you:
- Review outbound spam policies
- Block external automatic forwarding
- Find existing mailbox and inbox-rule forwarding
- Audit shared mailboxes
- Investigate suspicious forwarding destinations
- Create controlled business exceptions
- Configure forwarding alerts and reports
- Review Microsoft Purview audit activity
- Respond to compromised mailboxes
- Strengthen Microsoft 365 email security
Visit hgmssp.com, call Hamilton Group on 0330 043 0069, or book a meeting with one of our experts to stop unauthorised forwarding before sensitive email leaves your organisation.