{
  "id": "CB-M365-MAIL-001",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-001",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-001.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-001.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-001",
    "title": "Block automatic forwarding of mail to external recipients",
    "finding": {
      "title": "Mailbox rules can forward company mail to external addresses",
      "description": "An attacker who takes over a mailbox, or a departing employee, can set a rule that silently copies every incoming message to an outside address."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "mail-flow",
      "forwarding",
      "exfiltration",
      "outbound-spam"
    ],
    "description": "Exchange Online stops automatic forwarding of messages to recipients outside the organization,\nwhatever the mechanism: Inbox rules, the mailbox forwarding setting (`ForwardingSmtpAddress`) and\nOutlook on the web forwarding. Two layers are set:\n\n- every outbound spam filter policy, starting with the default one, has **Automatic forwarding\n  rules** set to **Off - Forwarding is disabled** (`AutoForwardingMode Off`);\n- the default remote domain (`*`) has **Allow automatic forwarding** turned off\n  (`AutoForwardEnabled $false`).\n\nApproved business cases (a partner mailbox, a ticketing service) are handled with a dedicated\noutbound spam policy scoped to the named senders, or a remote domain for the named destination\ndomain, never by reopening forwarding for everyone.\n",
    "rationale": "Forwarding rules are one of the first things an attacker sets after compromising a mailbox:\nthe rule keeps feeding them mail after the password is reset, and it is used to watch invoice\nthreads before a business email compromise fraud. Leaked data through forwarding is also a common\ninsider risk. The `Automatic` default lets Microsoft decide and its behavior can change; an\nexplicit `Off` makes the rule visible and auditable.\n",
    "impact": "Users who forward their work mail to a personal address lose that ability and the forwarded\nmessages bounce with an NDR (5.7.520). Inventory existing external forwarding before the change\n(see the audit) and create scoped exceptions for the legitimate cases. Forwarding inside the\norganization, delegates and mail flow rules set by administrators keep working.\n",
    "notes": "The outbound spam policy controls forwarding that the user sets (Inbox rules, mailbox forwarding).\nForwarding set by an administrator on the mailbox (`ForwardingAddress` to a mail contact) and\nmail flow rules that redirect messages are not blocked by it: review them as part of the audit.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** >\n   **Anti-spam**. Open every outbound policy (**Anti-spam outbound policy (Default)** and any\n   custom one) and check that **Automatic forwarding rules** is **Off - Forwarding is disabled**.\n   A custom policy with **On** is acceptable only if it is scoped to named, approved senders.\n3. Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a\n   Global Reader. Browse to **Mail flow** > **Remote domains**, open **Default** and check that\n   **Allow automatic forwarding** is cleared.\n4. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-HostedOutboundSpamFilterPolicy | Format-Table Name, AutoForwardingMode\n   Get-RemoteDomain | Format-Table Name, DomainName, AutoForwardEnabled\n   Get-Mailbox -ResultSize Unlimited -Filter \"ForwardingSmtpAddress -ne $null -or ForwardingAddress -ne $null\" |\n     Format-Table UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress\n   ```\n5. Fail if any outbound policy that applies to all users has `AutoForwardingMode` set to\n   `Automatic` or `On`, if the `*` remote domain has `AutoForwardEnabled` set to `True`, or if\n   a mailbox forwards to an external address that is not a documented exception.\n"
    },
    "remediation": {
      "manual": "1. List the mailboxes that forward externally (audit step 4) and agree on the exceptions with\n   their owners.\n2. In the Defender portal, browse to **Email & collaboration** > **Policies & rules** >\n   **Threat policies** > **Anti-spam**, open **Anti-spam outbound policy (Default)** >\n   **Edit protection settings** and set **Automatic forwarding rules** to **Off - Forwarding is\n   disabled**. Do the same in every custom outbound policy that is not a scoped exception.\n3. For each approved exception, create a custom outbound policy that applies only to those\n   senders with **Automatic forwarding rules** set to **On - Forwarding is enabled**.\n4. In the Exchange admin center, browse to **Mail flow** > **Remote domains** > **Default** >\n   **Edit reply types** and clear **Allow automatic forwarding**.\n5. PowerShell equivalent (Security Administrator for the policy, Exchange Administrator for the\n   remote domain):\n   ```powershell\n   Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off\n   Set-RemoteDomain -Identity Default -AutoForwardEnabled $false\n   ```\n6. Remove the `ForwardingSmtpAddress` of mailboxes that are not exceptions\n   (`Set-Mailbox -Identity <user> -ForwardingSmtpAddress $null`).\n",
      "rollback": "Set `AutoForwardingMode` back to `Automatic` on the default outbound policy, or add the sender\nto a scoped exception policy.\n"
    },
    "references": [
      {
        "title": "Control automatic external email forwarding in Microsoft 365",
        "url": "https://learn.microsoft.com/defender-office-365/outbound-spam-policies-external-email-forwarding",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Remote domains in Exchange Online",
        "url": "https://learn.microsoft.com/exchange/mail-flow-best-practices/remote-domains/remote-domains",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-HostedOutboundSpamFilterPolicy",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-hostedoutboundspamfilterpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Exchange Online baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      },
      {
        "title": "ASD Blueprint for Secure Cloud - Remote domains",
        "url": "https://blueprint.asd.gov.au/configuration/exchange-online/mail-flow/remote-domains/",
        "publisher": "Australian Signals Directorate",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.EXO.1.1v2",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1114.003"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-031",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-008",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}