How to find inbox rules forwarding mail outside the company

What this check looks at

Finds enabled inbox rules that forward or redirect mail to addresses outside the organisation's domains.

People can create inbox rules in Outlook that forward, redirect or forward as an attachment every message, or messages matching conditions, to any address. Whether that forwarding to outside addresses actually works is decided by the outbound anti-spam policy: Automatic - System-controlled, the default, blocks it today, but the setting is often switched to On when someone asks to forward to a personal address. A rule can exist even where forwarding is blocked, and it still points to a past compromise or a request someone made.

The check reads the inbox rules in each mailbox in scope and fails when any enabled rule forwards or redirects mail to an address outside the organisation’s domains, counting the mailboxes affected and listing up to 25 rules with their destinations. If some mailboxes could not be read and none of the rest forwards, it warns rather than passes. Forwarding set on the mailbox itself by an administrator is a separate route this check does not read.

An external forwarding rule is one of the first things an attacker sets after taking over a mailbox: it keeps copies of every message flowing even after the password is changed, because the rule belongs to the mailbox, not the session. Attackers often pair it with a rule that moves or deletes replies so the owner does not notice. Well-meaning staff create the same leak by forwarding work mail to a personal Gmail account.

Why it matters

An inbox rule quietly forwarding mail to a personal or unknown address is one of the most common signs of a compromised mailbox, and a direct route for sensitive information to leave the business unnoticed.

A typical case: an attacker phishes a sales director and adds a rule forwarding anything containing invoice, payment or remittance to a lookalike address. The client resets the password a week later and believes that has ended it, but the rule keeps feeding the attacker live payment conversations for months, until a customer pays a fraudulent invoice.

Forwarding also moves personal data and commercially sensitive mail outside the organisation’s control with no record of who reads it. Under UK GDPR, mail forwarded to an unauthorised address is a personal data breach that may need reporting to the ICO within 72 hours, and to the people affected where the risk to them is high.

CIS Microsoft 365 Foundations Benchmark 6.2.1 asks for all forms of mail forwarding to be blocked or disabled, and CISA SCuBA MS.EXO.1.1 for automatic forwarding to external domains to be disabled. ISO 27001 A.8.12 (data leakage prevention) and A.5.14 (information transfer), CIS Controls v8 3.13, NIST CSF 2.0 PR.DS-02 and NCSC CAF B3.b (data in transit) cover the same ground.

How to fix it

Where: Microsoft Defender portal → Policies → Anti-spam → Outbound spam filter policy

Before you start

• Talk to each mailbox owner; some forwarding is approved, much is left from an attack or an old habit.
• Decide on the outbound spam policy setting for automatic forwarding (Off is safest).

Step by step

1. 1Confirm each rule with its owner. Take the rules in the evidence (mailbox, rule name, destination) and ask each owner whether they created the rule and why. Treat any rule the owner does not recognise, or one sending to an unfamiliar or lookalike address, as a sign of compromise and deal with it in the next step before removing anything.
2. 2Handle a suspected compromise first. For a mailbox whose rule nobody recognises: in the Microsoft Entra admin centre open the user under Entra ID > Users, select Revoke sessions and reset the password, and check Authentication methods for methods the person did not add. In the Microsoft Purview portal, search Solutions > Audit for New-InboxRule and Set-InboxRule activity on the mailbox to see when, and from where, the rule was created.
3. 3Inspect the rules in Exchange Online PowerShell. Connect with Connect-ExchangeOnline and run Get-InboxRule -Mailbox user@contoso.com -IncludeHidden | Format-List Name, Identity, Enabled, ForwardTo, RedirectTo, ForwardAsAttachmentTo, MoveToFolder, DeleteMessage. Note any companion rule that moves or deletes messages, as attackers often add one to hide replies.
4. 4Remove the unapproved rules. Run Remove-InboxRule -Mailbox user@contoso.com -Identity "<rule name>" for each rule that is not approved, or Disable-InboxRule if the owner wants to keep it while you agree an alternative. Users can also delete their own rules in Outlook under Settings > Mail > Rules. Record each rule and its destination for the incident log.
5. 5Check mailbox-level forwarding as well. Run Get-EXOMailbox -ResultSize Unlimited -Properties ForwardingSmtpAddress, ForwardingAddress | Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } | Format-Table UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress, and clear any that are not approved with Set-Mailbox -Identity user@contoso.com -ForwardingSmtpAddress $null -ForwardingAddress $null.
6. 6Turn off automatic external forwarding. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-spam, select Anti-spam outbound policy (Default) and Edit protection settings. Under Forwarding rules set Automatic forwarding rules to Off - Forwarding is disabled and save. For a forward the business has approved, create a separate outbound policy (Create policy > Outbound) that applies only to those mailboxes, with forwarding On.
7. 7Confirm forwarding is blocked. Run Get-HostedOutboundSpamFilterPolicy -Identity Default | Format-List AutoForwardingMode and check it shows Off. From a test mailbox, create a rule forwarding to an external address and send the mailbox a message: the forward should bounce with a 5.7.520 access denied error. The next assessment passes when no enabled inbox rule forwards mail outside the organisation.

With PowerShell

Get-InboxRule -Mailbox <user> | Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo }

What users will notice

Removed rules stop copying mail outside the organisation. With automatic forwarding off, new external forwarding rules do not work.

How to confirm it worked

The forwarding rule list in the evidence is empty at the next assessment, and the outbound spam policy shows automatic forwarding Off.

Frameworks and controls

This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Control automatic external email forwarding (Microsoft Learn)

Related checks

• How to block automatic email forwarding in Microsoft 365
• How to find mail flow rules that skip spam filtering
• How to make DLP rules block sharing, not just report it
• How to turn on alert policies for compromised mailboxes

The full Microsoft 365 security checklist, worst first