How to block automatic email forwarding in Microsoft 365

What this check looks at

Checks the default outbound spam policy, and the default remote domain, for whether mailboxes may forward mail automatically to outside addresses, and the mail flow rules for any that redirect or copy mail to one.

Mail can leave the organisation automatically in three ways: an inbox rule a user creates to forward or redirect messages, a forwarding address set on the mailbox, and a mail flow (transport) rule an administrator creates. The outbound spam policy controls the first two through its automatic forwarding setting, which can be Automatic (now the same as Off), Off or On, and the default remote domain can also block automatic forwarding. Mail flow rules are affected by neither and have to be checked separately.

This check reads the default outbound spam policy, the default remote domain and the mail flow rules. The check fails when the default outbound policy is set to On, or when any enabled mail flow rule redirects, copies or adds a recipient outside the organisation’s verified domains. It warns when blocking cannot be confirmed or the mail flow rules could not be read or compared, and passes when forwarding is blocked and no rule sends mail outside.

A forwarding rule to an outside address is one of the first things an attacker sets up in a compromised mailbox: it keeps copying mail after the password is changed, and often hides itself by moving the originals to an obscure folder. Departing staff use the same trick to take customer mail with them. Blocking automatic forwarding at the organisation stops every such rule at once, including ones nobody has found.

Why it matters

An attacker’s first move in a compromised mailbox is a rule forwarding everything to an outside address; it keeps working after the password is changed. Blocking automatic forwarding at the organisation stops every such rule at once, including ones nobody has found yet.

The accounts payable mailbox of a 70-person wholesaler is compromised through a phishing page. The attacker adds a rule forwarding every message mentioning invoices or payments to an outside address and deletes the copies, watches the supplier conversations for five weeks, then sends one perfectly timed change-of-bank-details email. With forwarding blocked, the rule would have failed on day one.

Genuine needs are rare and can be allowed for named mailboxes with their own outbound policy, so blocking for everyone else costs nothing.

CIS Microsoft 365 Foundations Benchmark 6.2.1 asks for all forms of mail forwarding to be blocked or disabled, and CISA SCuBA MS.EXO.1.1 asks for automatic forwarding to external domains to be disabled. CIS Controls v8 safeguard 3.13, ISO 27001 A.5.14 and A.8.12 (data leakage prevention), the NCSC 10 Steps data security guidance and the NCSC CAF data in transit outcome support it.

How to fix it

Where: Microsoft Defender portal → Policies → Anti-spam → Outbound policy

Before you start

• Check the "Mail forwarded outside the organisation" finding and the outbound spam report for anyone who forwards automatically today.
• For a genuine need, create an outbound policy allowing it for that mailbox only before changing the default.

Step by step

1. 1Find who forwards today. In Exchange Online PowerShell, list mailboxes with forwarding set: Get-Mailbox -ResultSize Unlimited | Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } | Format-List Name, ForwardingSmtpAddress, ForwardingAddress. In the Microsoft Defender portal, Reports > Email & collaboration, the Auto-forwarded messages report shows forwarding by inbox rules. Agree with the client which, if any, are legitimate.
2. 2Create an exception for genuine needs. For a mailbox that must forward outside, in the Defender portal go to Email & collaboration > Policies & rules > Threat policies > Anti-spam, select Create policy > Outbound, apply it to that mailbox only, and set automatic forwarding rules to On - Forwarding is enabled. Name it to explain why.
3. 3Turn forwarding off in the default outbound policy. Open Anti-spam outbound policy (Default), select Edit protection settings and, under Forwarding rules, set Automatic forwarding rules to Off - Forwarding is disabled. Save. Or run Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off.
4. 4Block it on the default remote domain too. In the Exchange admin centre, Mail flow > Remote domains, open Default and turn off automatic forwarding, or run Set-RemoteDomain Default -AutoForwardEnabled $false, as a second layer.
5. 5Disable mail flow rules that send outside. In the Exchange admin centre, Mail flow > Rules, review each rule that redirects messages, adds To or Bcc recipients or copies mail, and disable any that send to outside addresses without a documented reason. In PowerShell: Get-TransportRule | Where-Object { $_.RedirectMessageTo -or $_.BlindCopyTo -or $_.AddToRecipients -or $_.CopyTo } | Format-List Name, State, RedirectMessageTo, BlindCopyTo, AddToRecipients, CopyTo, then Disable-TransportRule -Identity "<rule name>".
6. 6Clean up existing forwarding. Remove forwarding addresses and forwarding inbox rules that are not approved (Set-Mailbox -Identity <upn> -ForwardingSmtpAddress $null, Remove-InboxRule), and treat any that forward to unknown outside addresses as a possible compromise to investigate.
7. 7Confirm forwarding is blocked. Run Get-HostedOutboundSpamFilterPolicy -Identity Default | Format-List AutoForwardingMode: it should show Off. Create a test inbox rule forwarding to an outside address: the forwarded copy should be refused with a non-delivery report. The finding clears at the next assessment.

With PowerShell

Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off

What users will notice

Inbox rules and mailbox forwarding to outside addresses stop delivering; senders get a non-delivery report.

How to confirm it worked

Get-HostedOutboundSpamFilterPolicy -Identity Default shows AutoForwardingMode as Off; a test rule forwarding outside the organisation fails.

Frameworks and controls

This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Control automatic external forwarding (Microsoft Learn)

Related checks

• How to find inbox rules forwarding mail outside the company
• How to check DKIM keys are published for each mail domain
• How to limit Exchange calendar sharing with other domains
• How to remove allowed domains from anti-spam policies

The full Microsoft 365 security checklist, worst first