How to find inbox rules forwarding mail outside your organization

Creating a forwarding rule is the first thing an attacker does after taking over a mailbox. It means they keep reading the mail after the password is changed, and the user sees nothing unusual. It is also the setup step for invoice fraud: hide the real vendor's replies, and the victim never sees the warning that the bank details were wrong.

The complication is that forwarding hides in three separate places in Microsoft 365, and checking only the obvious one gives false confidence.

The three places forwarding hides

• Inbox rules — created by the user in Outlook, per mailbox. The most common, and what attackers use. Often named something innocuous like "." or "fwd" to escape notice in a list.
• Mailbox forwarding — a property on the mailbox itself (ForwardingSmtpAddress or ForwardingAddress), set by an administrator or by someone with admin access. Invisible to the user and not shown among their rules.
• Transport rules — organization-wide mail flow rules in the Exchange admin center. Rare, but the most damaging, because one rule can copy mail from every mailbox.

Check all three. An audit that covers only inbox rules will miss a mailbox-level forward entirely.

Audit all three with PowerShell

The portal cannot show you rules across every mailbox at once, so this is a job for Exchange Online PowerShell.

Connect-ExchangeOnline

# 1. Inbox rules that forward or redirect anywhere
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
  Get-InboxRule -Mailbox $_.UserPrincipalName -ErrorAction SilentlyContinue |
    Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } |
    Select-Object @{n='Mailbox';e={$_.MailboxOwnerId}}, Name, Enabled,
                  ForwardTo, RedirectTo
}

# 2. Mailbox-level forwarding
Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
  Select-Object UserPrincipalName, ForwardingSmtpAddress,
                ForwardingAddress, DeliverToMailboxAndForward

# 3. Transport rules that redirect or blind-copy
Get-TransportRule |
  Where-Object { $_.RedirectMessageTo -or $_.BlindCopyTo -or $_.CopyTo } |
  Select-Object Name, State, RedirectMessageTo, BlindCopyTo, CopyTo

Not every hit is malicious — people forward to personal addresses for convenience all the time. That is its own data-leak problem, but it is a conversation rather than an incident. What you are looking for is a rule the mailbox owner does not recognise.

Block external forwarding tenant-wide

Microsoft blocks automatic external forwarding by default on newer tenants, via the outbound spam filter policy. Confirm it rather than assume it:

1. Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam.
2. Open Anti-spam outbound policy (Default).
3. Check Automatic forwarding rules is set to Off - Forwarding is disabled.

If a specific mailbox legitimately needs to forward externally, create a separate outbound policy scoped to just that mailbox rather than loosening the default for everyone.

If you find a rule nobody created

Treat the account as compromised, and work in this order:

1. Reset the password.
2. Revoke active sessions — Entra admin center → Users → select the user → Revoke sessions. Without this, a stolen token keeps working after the password change.
3. Delete the rule, in Outlook on the web (Settings → Mail → Rules) or with Remove-InboxRule.
4. Check the sign-in logs for that account: unfamiliar locations, impossible travel, successful sign-ins from legacy clients.
5. Check for other changes — added MFA methods, mailbox permissions granted to other accounts, mailbox-level forwarding.
6. Look at what the mailbox could reach. If the user handles invoices or payroll, tell finance before you close the ticket.

Step 2 is the one most often skipped, and it is the one that decides whether the attacker is actually out.

Questions

Click paths verified October 2026. Microsoft renames things in the admin centers regularly; the underlying settings are stable even when the menus move.