Microsoft 365 External Email Forwarding: How to Block Auto-Forward by Default and Allow Only Named Exceptions

The short version: Microsoft 365 external email forwarding happens through three main paths: a forwarding address set on the mailbox, an inbox rule that forwards or redirects, and a mail flow rule written by an administrator. The outbound anti-spam policy and the remote domain settings control the first two; mail flow rules need their own review. Block automatic external forwarding for everyone, allow it only for named mailboxes with a business reason, and check the existing forwards before you switch anything off.

Automatic forwarding to an outside address is one of the quietest ways company email leaves a Microsoft 365 tenant. Sometimes it is a staff member forwarding work mail to a personal address "to read on the train". Sometimes it is a rule an attacker created after stealing a password, sending every message about invoices to a mailbox they control. Either way, the content is gone, and the sender's mail system recorded nothing unusual.

This article is about prevention: how Microsoft 365 external email forwarding works, how to see what is forwarding today, and how to set a "blocked by default, allowed by exception" policy that holds. If you already suspect a mailbox has been compromised and want to know what traces to look for, read our companion guide on finding malicious inbox rules after business email compromise first; containment comes before policy.

How does email get forwarded out of Microsoft 365?

There are three paths that matter for most organisations, and they are controlled in different places. That is why "we blocked forwarding" is so often only partly true.

• Mailbox forwarding. An address set on the mailbox itself, in the Microsoft 365 admin center under the user's mail settings or in the Exchange admin center under the mailbox's mail flow settings. In PowerShell it appears as ForwardingSmtpAddress (usually set by the user or an admin to an external address) or ForwardingAddress (set by an admin to a recipient object). DeliverToMailboxAndForward decides whether a copy also stays in the mailbox.
• Inbox rules. Rules that a user, or anyone signed in as the user, creates in Outlook or Outlook on the web with a "forward to", "forward as attachment" or "redirect to" action. They can be narrow (only messages with "invoice" in the subject) and are easy to miss.
• Mail flow rules. Transport rules written by an administrator in the Exchange admin center that redirect, forward or blind-copy messages to another address. They are usually legitimate, such as a journaling or compliance copy, but they are powerful and rarely reviewed.

Other automation can also send copies out, for example a flow built in Power Automate that forwards new mail. Those are governed by Power Platform settings rather than Exchange, so list them separately.

Which settings actually block automatic forwarding?

Microsoft's documentation on controlling automatic external email forwarding describes the outbound spam policy and remote domains as the two controls, and it is precise about how they interact: if either one blocks automatic forwarding to a recipient, the message is blocked. Mail flow rules are a separate configuration, so treat them as their own item rather than assuming these settings cover them.

The outbound spam filter policy

In the Microsoft Defender portal, go to Email & collaboration, Policies & rules, Threat policies, Anti-spam, and open the outbound policy. Under forwarding rules, the automatic forwarding setting has three values:

• Automatic - System-controlled. The default. Microsoft now treats this as forwarding disabled, so automatic external forwarding is blocked.
• On - Forwarding is enabled. Automatic external forwarding is allowed for the users the policy covers.
• Off - Forwarding is disabled. Automatic external forwarding is blocked, and the sender receives a non-delivery report, typically with code 550 5.7.520.

Microsoft's guidance is to leave the default policy blocking forwarding and create a separate custom outbound policy set to On, scoped to the specific users who need it. In PowerShell that is New-HostedOutboundSpamFilterPolicy with -AutoForwardingMode On, plus New-HostedOutboundSpamFilterRule to scope it with -From to named addresses. Setting the default to Off explicitly, with Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off, removes any doubt about what "system-controlled" means in future.

Remote domains

In the Exchange admin center under Mail flow and Remote domains, each remote domain, including the Default entry that covers every domain not listed, has an "allow automatic forwarding" option. In PowerShell it is the AutoForwardEnabled parameter of Set-RemoteDomain. Because a block in either control wins, remote domains are useful in two ways: as a second layer, and for an exception that should only ever reach one partner domain. Allowing a user in the outbound policy while allowing only that partner's domain in remote domains limits the exception to that destination.

A mail flow rule for auto-forwarded messages

Many organisations add a mail flow rule as a belt-and-braces measure: messages sent from inside the organisation, to recipients outside it, where the message type is auto-forward, are rejected with an explanation. In PowerShell this is New-TransportRule with -FromScope InOrganization, -SentToScope NotInOrganization, -MessageTypeMatches AutoForward and -RejectMessageReasonText. Add exceptions for the same named mailboxes as your custom outbound policy so the two do not contradict each other.

How do you find what is forwarding today?

Before you block anything, list what is already forwarding. Some of it will be legitimate, and cutting off a director's assistant without warning is how a security change gets reversed the same afternoon.

1. Check the auto-forwarded messages report. In the Exchange admin center, under Reports and Mail flow, the auto-forwarded messages report shows mail that was automatically forwarded to external recipients, with the forwarding method. It tells you who is forwarding and roughly how much.
2. List mailbox-level forwarding. Get-Mailbox -ResultSize Unlimited | Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } | Select-Object DisplayName, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward returns every mailbox with a forwarding address set.
3. List inbox rules that forward. Run Get-InboxRule against each mailbox and keep the ones where ForwardTo, ForwardAsAttachmentTo or RedirectTo is populated. In a larger tenant, pipe Get-Mailbox into a loop and export the result to a spreadsheet.
4. List mail flow rules. Get-TransportRule shows every rule; look for redirect, blind-copy or "add recipients" actions that point outside the organisation, and for any rule that nobody can explain.
5. Classify each one. For each forward, record the owner, the destination, the business reason and whether a better option exists. Most personal-address forwards are replaced by the Outlook mobile app; most "forward to the accountant" rules are replaced by sharing a mailbox or a folder.

Anything that appears with no owner and no reason should be handled as a possible compromise, not just a policy breach. That is where our guide to investigating inbox rules after business email compromise picks up.

Block-all, allow-list or allow-by-domain?

The three policies most organisations choose between, and when each fits.

Block-all, named-user allow-list or partner-domain allow-list?

• Block all automatic external forwarding. The default outbound policy blocks, no custom policy exists, and the mail flow rule rejects auto-forwards with no exceptions. Simplest to explain and audit. Suits most small and mid-sized firms, where genuine needs can be met by delegation or shared mailboxes.
• Allow-list of named mailboxes. A custom outbound policy set to On for a short list of users, each with an owner and a review date. Suits organisations with a real requirement, such as a ticketing system that receives mail through a forward, or a regulated role that must copy an external party.
• Allow-list by partner domain. The named users are allowed in the outbound policy, but remote domains only permit automatic forwarding to one or two partner domains. Suits outsourced functions, such as an external payroll provider, and limits the damage if one of those mailboxes is later compromised.

Whichever you choose, write it down. A one-paragraph forwarding standard that names the policy, the exceptions and who approves new ones is what turns a setting into a control.

How do you keep it blocked?

Settings drift. A new administrator creates a custom outbound policy to fix one user's problem and scopes it to a group that later grows. A remote domain entry is added for a project and never removed. Three habits keep forwarding under control.

• Turn on and route the alerts. Microsoft Defender includes default alert policies for suspicious forwarding activity and for the creation of forwarding or redirect rules. Make sure they are on and that their notifications reach a monitored mailbox rather than a former administrator.
• Review exceptions quarterly. Each allowed mailbox should still have an owner, a reason and a destination that makes sense.
• Recheck after any incident. After a phishing incident, list forwarding again across the whole tenant, not only on the affected mailbox. Attackers who get into one account often try others.

Our guide to Exchange Online Protection settings covers the rest of the outbound and inbound filtering settings around this one, and the Hong Kong supplier payment fraud case shows why forwarding and finance mail are such a common combination.

What does a Microsoft 365 security audit check here?

Forwarding is one of the email-security areas in Brocent's Microsoft 365 security audit. The review reads the outbound spam policies and their scope, remote domain settings, mail flow rules, mailbox forwarding addresses and forwarding inbox rules across every mailbox, and the state of the related alert policies. The report lists each external forward with its owner if known, flags the ones with no explanation, and recommends the policy model that fits the organisation.

The Microsoft 365 security audit sample report shows how findings like these are written up and placed into a phased fix plan. The audit is read-only and delivered remotely, with the report returned within 5 to 7 business days after read-only access is granted, and the debrief booked in your business hours, whether you are in the UK, Australia or Asia. Pricing is fixed by headcount, from US$450 for up to 10 users, as set out on the Microsoft 365 security audit pricing page.

For UK organisations, an uncontrolled forward of personal data to a private address is also a data protection question, and for many Australian and Asian firms it appears on cyber-insurance proposals. In both cases the audit report is designed to be used as evidence of how forwarding is controlled; it is not a legal opinion or a decision on cover. If you want the filtering, rules and alerts looked after continuously, Brocent's managed email security service does that.

Frequently asked questions

Does Microsoft 365 block external auto-forwarding by default?

The default outbound spam policy is set to "Automatic - System-controlled", which Microsoft now treats as forwarding disabled. Check your tenant anyway: a custom outbound policy set to On, or an earlier change to the default policy, overrides it for the users it covers.

Will blocking auto-forwarding stop users manually forwarding an email?

No. These controls apply to automatic forwarding through mailbox settings and inbox rules. A user who opens a message and presses Forward is sending a new message, which is governed by your data loss prevention and outbound filtering policies instead.

What error do users see when forwarding is blocked?

The sender of the original message, or the user whose rule fired, typically receives a non-delivery report with code 550 5.7.520, stating that the organisation does not allow external forwarding.

Do mail flow rules respect the outbound spam policy setting?

Treat them as separate. Microsoft documents the outbound policy and remote domains as the controls for automatic forwarding through mailbox settings and inbox rules. Review mail flow rules that redirect or copy mail externally on their own.

How do we allow one person to forward to an external system?

Create a custom outbound spam policy with automatic forwarding set to On, scoped to that one mailbox, and, if possible, allow forwarding in remote domains only for the destination domain. Record the owner and review date.

Is a forwarding rule always a sign of compromise?

No. Many are set up by staff for convenience. But a rule with no owner, an odd name, a narrow keyword condition or an external destination nobody recognises should be investigated as a possible compromise.

Where to start

Run the mailbox-forwarding and inbox-rule queries above this week and put the results in a spreadsheet. If the list is short and every row has an owner, setting the default policy to Off is a one-line change. If it is long, or some rows have no explanation, talk to a consultant before you change anything.