Block automatic forwarding of mail to external recipients

Description

Exchange Online stops automatic forwarding of messages to recipients outside the organization, whatever the mechanism: Inbox rules, the mailbox forwarding setting (ForwardingSmtpAddress) and Outlook on the web forwarding. Two layers are set:

• every outbound spam filter policy, starting with the default one, has Automatic forwarding rules set to Off - Forwarding is disabled (AutoForwardingMode Off);
• the default remote domain (*) has Allow automatic forwarding turned off (AutoForwardEnabled $false).

Approved business cases (a partner mailbox, a ticketing service) are handled with a dedicated outbound spam policy scoped to the named senders, or a remote domain for the named destination domain, never by reopening forwarding for everyone.

The outbound spam policy controls forwarding that the user sets (Inbox rules, mailbox forwarding). Forwarding set by an administrator on the mailbox (ForwardingAddress to a mail contact) and mail flow rules that redirect messages are not blocked by it: review them as part of the audit.

Rationale

Forwarding rules are one of the first things an attacker sets after compromising a mailbox: the rule keeps feeding them mail after the password is reset, and it is used to watch invoice threads before a business email compromise fraud. Leaked data through forwarding is also a common insider risk. The Automatic default lets Microsoft decide and its behavior can change; an explicit Off makes the rule visible and auditable.

Impact

Users who forward their work mail to a personal address lose that ability and the forwarded messages bounce with an NDR (5.7.520). Inventory existing external forwarding before the change (see the audit) and create scoped exceptions for the legitimate cases. Forwarding inside the organization, delegates and mail flow rules set by administrators keep working.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Anti-spam. Open every outbound policy (Anti-spam outbound policy (Default) and any custom one) and check that Automatic forwarding rules is Off - Forwarding is disabled. A custom policy with On is acceptable only if it is scoped to named, approved senders.
3. Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a Global Reader. Browse to Mail flow > Remote domains, open Default and check that Allow automatic forwarding is cleared.
4. In Exchange Online PowerShell (read-only):

   Get-HostedOutboundSpamFilterPolicy | Format-Table Name, AutoForwardingMode
   Get-RemoteDomain | Format-Table Name, DomainName, AutoForwardEnabled
   Get-Mailbox -ResultSize Unlimited -Filter "ForwardingSmtpAddress -ne $null -or ForwardingAddress -ne $null" |
     Format-Table UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress
   

5. Fail if any outbound policy that applies to all users has AutoForwardingMode set to Automatic or On, if the * remote domain has AutoForwardEnabled set to True, or if a mailbox forwards to an external address that is not a documented exception.

Remediation

1. List the mailboxes that forward externally (audit step 4) and agree on the exceptions with their owners.
2. In the Defender portal, browse to Email & collaboration > Policies & rules > Threat policies > Anti-spam, open Anti-spam outbound policy (Default) > Edit protection settings and set Automatic forwarding rules to Off - Forwarding is disabled. Do the same in every custom outbound policy that is not a scoped exception.
3. For each approved exception, create a custom outbound policy that applies only to those senders with Automatic forwarding rules set to On - Forwarding is enabled.
4. In the Exchange admin center, browse to Mail flow > Remote domains > Default > Edit reply types and clear Allow automatic forwarding.
5. PowerShell equivalent (Security Administrator for the policy, Exchange Administrator for the remote domain):

   Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off
   Set-RemoteDomain -Identity Default -AutoForwardEnabled $false
   

6. Remove the ForwardingSmtpAddress of mailboxes that are not exceptions (Set-Mailbox -Identity <user> -ForwardingSmtpAddress $null).

Rollback

Set AutoForwardingMode back to Automatic on the default outbound policy, or add the sender to a scoped exception policy.

References

• Control automatic external email forwarding in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Remote domains in Exchange Online Microsoft, vendor-doc, accessed 2026-10-24
• Set-HostedOutboundSpamFilterPolicy Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Exchange Online baseline CISA, standard, accessed 2026-10-24
• ASD Blueprint for Secure Cloud - Remote domains Australian Signals Directorate, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-031 Set outbound sending limits and notify administrators of blocked senders
• related CB-M365-AUDIT-008 Turn on key Microsoft 365 alert policies and route them to a monitored destination

People and lifecycle