Control automated external email forwarding in Microsoft 365

  • Commodity
  • four minutes to read

Applies to

  • Commutation Online Protection
  • Microsoft Defender for Office 365 plan ane and plan ii
  • Microsoft 365 Defender

As an admin, yous might have company requirements to restrict or control automatically forwarded messages to external recipients (recipients exterior of your organization). E-mail forwarding tin be a useful, but can also pose a security risk due to the potential disclosure of information. Attackers might use this information to assail your organization or partners.

The following types of automatic forwarding are available in Microsoft 365:

  • Users can configure Inbox rules to automatically frontward messages to external senders (deliberately or as a result of a compromised account).
  • Admins can configure mailbox forwarding (as well known every bit SMTP forwarding) to automatically forward messages to external recipients. The admin tin cull whether to simply forrard messages, or keep copies of forwarded messages in the mailbox.

Note

Users with automatic forwarding from on-bounds email systems through Microsoft 365 volition be subject to the aforementioned policy controls as cloud mailboxes in an upcoming update. This update volition be communicated via Message Center post.

You can use outbound spam filter policies to control automatic forwarding to external recipients. 3 settings are bachelor:

  • Automatic - Organisation-controlled: This is the default setting. This setting is now the aforementioned equally Off. When this setting was originally introduced, it was equivalent to On. Over time, thanks to the principles of secure past default, this setting was gradually inverse to Off for all customers. For more information, see this blog postal service.
  • On: Automated external forwarding is allowed and non restricted.
  • Off: Automatic external forwarding is disabled and will result in a non-delivery report (also known as an NDR or bounce message) to the sender.

For instructions on how to configure these settings, see Configure outbound spam filtering in EOP.

Note

  • Disabling automated forwarding disables any Inbox rules (users) or mailbox forwarding (admins) that redirect letters to external addresses.

  • Automatic forwarding of letters between internal users isn't afflicted by the settings in outbound spam filter policies.

How the outbound spam filter policy settings piece of work with other automatic email forwarding controls

As an admin, you might have already configured other controls to let or cake automatic electronic mail forwarding. For example:

  • Remote domains to let or block automated email forwarding to some or all external domains.
  • Conditions and actions in Exchange mail menstruum rules (also known equally transport rules) to detect and block automatically forwarded messages to external recipients.

When i setting allows external forwarding, only another setting blocks external forwarding, the cake typically wins. Examples are described in the following table:

Scenario Issue
  • You configure remote domain settings to allow automatic forwarding.
  • Automatic forwarding in the outbound spam filter policy is set to Off.
 Automatically forwarded messages to recipients in the affected domains are blocked.
  • You configure remote domain settings to allow automatic forwarding.
  • Automatic forwarding in the outbound spam filter policy is set to Automatic - Organization-controlled.
 Automatically forwarded messages to recipients in the afflicted domains are blocked.

As described before, Automatic - System-controlled used to hateful On, but the setting has changed over time to mean Off in all organizations.

For absolute clarity, y'all should configure your outbound spam filter policy to On or Off.
  • Automatic forwarding in the outbound spam filter policy is set to On
  • You utilize mail service menstruum rules or remote domains to block automatically forwarded electronic mail.
 Automatically forwarded letters to afflicted recipients are blocked by postal service flow rules or remote domains.

Y'all can employ this behavior (for instance) to allow automated forwarding in outbound spam filter policies, but use remote domains to control the external domains that users can forward letters to.

How to find users that are automatically forwarding

You can run across information about users that are automatically forwarding letters to external recipients in the Automobile forwarded messages report for deject-based accounts. For on-premises users that automatically forwards from their on-bounds email organisation through Microsoft 365, y'all demand to create a mail flow rule to rails these users. For instructions on how to create a post flow dominion, run into Use the EAC to create a mail catamenia rule.

The following data is required to create the mail service flow rule in the Exchange admin middle (EAC):

  • Apply this rule if (condition): A message header > matches these text patterns. Note you lot might demand to click More options to see this option.

    • Header name: X-MS-Commutation-Inbox-Rules-Loop
    • Header value: .

    The status looks similar this: 'X-MS-Exchange-Inbox-Rules-Loop' header matches '.'

    This condition will match whatever value for the header.

  • (Optional) Do the following (activeness): You tin configure an optional action. For example, you lot can use the action Modify the bulletin properties > fix a message header, with the header name X-Forwarded and the value True. But, configuring an action is not required.

  • Prepare Audit this rue with severity level to the value Low, Medium, or High. This setting allows yous to utilise the Commutation transport rule study to get details of users that are forwarding.

The Mail flow rule properties in the EAC for a rule to identify forwarded messages

Blocked e-mail forwarding letters

When a message is detected as automatically forwarded, and the outbound spam filter policy blocks that activity, the message is returned to the sender in an NDR that contains the following information:

5.seven.520 Access denied, Your organisation does not let external forwarding. Please contact your administrator for further assistance. Every bit(7555)