Automatic external forwarding in Exchange Online: three controls, and one value that tells you nothing

A security review of a Microsoft 365 tenant usually contains the line "automatic external forwarding: Automatic". It reads like a finding. It is not one: Microsoft documents that this value means On in some organisations and Off in others, and nothing in the tenant today says which. And that setting is only one of three controls that decide whether a message can leave by itself.

This analysis shows how to read all three, how to find what is already forwarding, and how to close the route while keeping the exceptions a business needs. It applies to Exchange Online. Microsoft's documentation was read on 12 November 2026, and each quotation names its page.

Why forwarding matters

Automatic forwarding is the simplest way to take mail out of an organisation without signing in again. Microsoft lists the two ways a mailbox forwards on its own in Control automatic external email forwarding from cloud mailboxes: users can configure Inbox rules that forward to external addresses, "deliberately or as a result of a compromised account", and administrators can configure mailbox forwarding, also called SMTP forwarding.

Forwarding is also a legitimate business function. The aim is not to switch it off blindly. It is to know what the tenant permits and to decide it on purpose.

Control one: the outbound spam filter policy

Every organisation has a default outbound spam filter policy, and may have custom ones scoped to users, groups or domains. Each carries an automatic forwarding setting with three values. Two say what they do. The third is the default:

Automatic - System-controlled: This value is the default. When this value was introduced, it was equivalent to On - Forwarding is enabled. In 2021, the value changed to Off - Forwarding is disabled for new organizations and for existing organizations that weren't actively using the Automatic - System-controlled value. For existing organizations that were already using the value, it can remain equivalent to On - Forwarding is enabled.

Two tenants that show the same word behave in opposite ways, depending on what each was doing in 2021. The same paragraph gives the instruction: "configure On - Forwarding is enabled or Off - Forwarding is disabled instead of Automatic - System-controlled".

Read every policy, not only the default. A custom policy decides for the senders it is scoped to.

Connect-ExchangeOnline

Get-HostedOutboundSpamFilterPolicy |
    Format-Table Name, IsDefault, AutoForwardingMode

AutoForwardingMode accepts Automatic, Off and On (Set-HostedOutboundSpamFilterPolicy). Any row that shows Automatic is a row whose behaviour cannot be read from the tenant.

Control two: remote domains

A remote domain decides whether automatically forwarded messages may be sent to that domain. Every organisation has a default remote domain that applies to all external domains without an entry of their own, and Remote domains in Exchange Online states: "The default is to allow automatic forwarding."

Get-RemoteDomain |
    Format-Table Name, DomainName, AutoForwardEnabled

The same page states the limit of this control, and it is the detail most often missed. A remote domain overrides forwarding that users configure. For forwarding that administrators configure, mailbox forwarding and mail flow rules, "messages are forwarded to recipients on the remote domain even if automatic forwards are disabled for the remote domain".

Control three: mail flow rules

A mail flow rule can redirect, copy or blind copy messages to any recipient, and it does so regardless of the two controls above. A rule can also be the control that blocks: Microsoft's page on mail flow rule conditions lists the message type AutoForward, which a rule can match and reject.

That condition has a documented blind spot. The same table says that if a message was forwarded using mailbox forwarding, "this condition/exception will not match during mail flow rule evaluation". A rule that rejects the AutoForward message type stops Inbox rules. It does not stop SMTP forwarding set on the mailbox.

How the three combine

Microsoft's summary is one sentence: "When one setting allows external forwarding, but another setting blocks external forwarding, the block typically wins." The examples on that page are worth reading as a table:

So a reviewer who checked one control and concluded that mail cannot leave has answered a third of the question.

What is forwarding today

Before changing a setting, find what would break. Two reads cover the two ways a mailbox forwards.

Mailbox forwarding is three properties on the mailbox. Microsoft's guidance on responding to a compromised email account describes them: a non-blank ForwardingSmtpAddress means mail is forwarded to an external recipient, a non-blank ForwardingAddress means an internal one, and DeliverToMailboxAndForward says whether a copy stays in the mailbox.

Get-Mailbox -ResultSize Unlimited |
    Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
    Select-Object PrimarySmtpAddress, ForwardingAddress,
                  ForwardingSmtpAddress, DeliverToMailboxAndForward

Inbox rules are read per mailbox. The same guidance gives the command, including hidden rules:

Get-InboxRule -Mailbox adele@contoso.com -IncludeHidden |
    Format-List Name, Enabled, RedirectTo, Forward*, Identity

Running that for every mailbox in a large tenant is slow, because it is one call per mailbox. For a view over time, Microsoft points to the Auto forwarded messages report in the Exchange admin center, which shows who is forwarding to external recipients without enumerating rules.

Deciding it: off by default, with named exceptions

The pattern that survives an audit is an explicit Off in the default policy and a custom policy that says On for the senders who need it.

# 1. The default policy states its answer.
Get-HostedOutboundSpamFilterPolicy |
    Where-Object IsDefault |
    ForEach-Object {
        Set-HostedOutboundSpamFilterPolicy -Identity $_.Identity -AutoForwardingMode Off
    }

# 2. A custom policy allows forwarding for one group.
New-HostedOutboundSpamFilterPolicy -Name "Forwarding allowed" -AutoForwardingMode On
New-HostedOutboundSpamFilterRule -Name "Forwarding allowed" `
    -HostedOutboundSpamFilterPolicy "Forwarding allowed" `
    -FromMemberOf "Approved external forwarding"

In PowerShell the policy and the rule that scopes it are separate objects, and a policy created without a rule is applied to nobody. Microsoft says so in Configure outbound spam policies: a new policy "isn't visible in the Microsoft Defender portal until you assign the policy to an outbound spam filter rule".

Then use remote domains to say where the allowed senders may forward. Microsoft describes exactly this combination: allow forwarding in the outbound policy, and "use remote domains to control the external domains that users can forward messages to".

Set-RemoteDomain -Identity Default -AutoForwardEnabled $false

A remote domain created for a partner's domain, with forwarding enabled, then acts as the list of permitted destinations.

What a user sees when it is blocked

When the outbound policy blocks a forwarded message, the sender receives a non-delivery report containing:

5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)

The configuration page adds when a report is generated: for messages from external senders with every forwarding method, and for messages from internal senders only when the method is mailbox forwarding. With an Inbox rule and an internal sender, no report is generated. A user whose rule silently stopped working may not find out from the system.

Limits

• This is Exchange Online. The outbound spam filter policy cmdlets are available only in the cloud service. Set-RemoteDomain exists on premises too, with its own defaults, and on-premises forwarding that passes through Microsoft 365 is subject to the cloud policy, as Microsoft notes on the forwarding page.
• Internal forwarding is untouched. "Automatic forwarding of messages between internal users isn't affected by the settings in outbound spam filter policies."
• An explicit Off is not proof that mail cannot leave. A mail flow rule that redirects or copies messages to an external address is a separate mechanism. Review the rules under Mail flow in the Exchange admin center as part of the same exercise.
• Forwarding is not the only automated exit. Power Automate flows that send or forward mail are a different path with their own controls.
• Reading needs a role. The configuration page lists Global Reader, Security Reader and View-Only Organization Management for read-only access to the policies, and Organization Management or Security Administrator to change them.

The short version

Read three things: AutoForwardingMode on every outbound spam filter policy, AutoForwardEnabled on every remote domain, and the mail flow rules. Replace Automatic with a decision. Find the mailboxes and rules that forward before you block them, and expect the Inbox rule case to fail without a message to the user.

Related reading

• Sending email from an application, without a single password: the application side of mail in Exchange Online.

Tags#security#governance#powershell#engineering#havecode