learn.microsoft.com Open in urlscan Pro
23.200.198.188  Public Scan

Form analysis
3 forms found in the DOM

Name: nav-bar-search-form — GET /en-us/search/

<form class="nav-bar-search-form" method="GET" name="nav-bar-search-form" role="search" id="nav-bar-search-form" aria-label="Search" action="/en-us/search/">
  <div class="autocomplete" data-bi-name="autocomplete"><!---->
    <div class="field-body control ">
      <input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="site-search-input" data-test-id="site-search-input" class="autocomplete-input input input-sm
						
						" type="search" name="terms" aria-expanded="false" aria-owns="ax-87-listbox" aria-controls="ax-87-listbox" aria-activedescendant="" aria-label="Search" aria-describedby="ms--site-search-input-description" placeholder="Search" pattern=".*">
      <span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
      <span hidden="" id="ms--site-search-input-description"> Suggestions will filter as you type </span>
    </div>
    <ul role="listbox" id="ax-87-listbox" data-test-id="site-search-input-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
    </ul>
    <!---->
  </div>
  <!-- mobile safari will not dispatch submit event unless there's a submit button that is not display:none -->
  <button type="submit" class="visually-hidden" tabindex="-1" aria-hidden="true"></button>
  <input name="category" hidden="" value="">
</form>

Name: nav-bar-search-form — GET /en-us/search/

<form class="nav-bar-search-form" method="GET" name="nav-bar-search-form" role="search" id="nav-bar-search-form-desktop" aria-label="Search" action="/en-us/search/">
  <div class="autocomplete" data-bi-name="autocomplete"><!---->
    <div class="field-body control has-icons-left">
      <input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="site-search-input-desktop" data-test-id="site-search-input-desktop" class="autocomplete-input input input-sm
						control has-icons-left
						" type="search" name="terms" aria-expanded="false" aria-owns="ax-88-listbox" aria-controls="ax-88-listbox" aria-activedescendant="" aria-label="Search" aria-describedby="ms--site-search-input-desktop-description" placeholder="Search"
        pattern=".*">
      <span aria-hidden="true" class="icon is-small is-left">
        <span class="has-text-primary docon docon-search"></span>
      </span>
      <span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
      <span hidden="" id="ms--site-search-input-desktop-description"> Suggestions will filter as you type </span>
    </div>
    <ul role="listbox" id="ax-88-listbox" data-test-id="site-search-input-desktop-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
    </ul>
    <!---->
  </div>
  <!-- mobile safari will not dispatch submit event unless there's a submit button that is not display:none -->
  <button type="submit" class="visually-hidden" tabindex="-1" aria-hidden="true"></button>
  <input name="category" hidden="" value="">
</form>

javascript:

<form action="javascript:" role="search" aria-label="Search" class="margin-bottom-xxs"><label class="visually-hidden" for="ax-36">Search</label>
  <div class="autocomplete display-block" data-bi-name="autocomplete"><!---->
    <div class="field-body control has-icons-left">
      <input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="ax-36" data-test-id="ax-36" class="autocomplete-input input input-sm
						control has-icons-left
						width-full" type="text" aria-expanded="false" aria-owns="ax-37-listbox" aria-controls="ax-37-listbox" aria-activedescendant="" aria-describedby="ms--ax-36-description" placeholder="Filter by title" pattern=".*">
      <span aria-hidden="true" class="icon is-small is-left">
        <span class="has-text-primary docon docon-filter-settings"></span>
      </span>
      <span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
      <span hidden="" id="ms--ax-36-description"> Suggestions will filter as you type </span>
    </div>
    <ul role="listbox" id="ax-37-listbox" data-test-id="ax-36-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
    </ul>
    <!---->
  </div>
</form>

Text Content

Skip to main content

We use optional cookies to improve your experience on our websites, such as
through social media connections, and to display personalized advertising based
on your online activity. If you reject optional cookies, only cookies necessary
to provide you the services will be used. You may change your selection by
clicking “Manage Cookies” at the bottom of the page. Privacy Statement
Third-Party Cookies

Accept Reject Manage cookies

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security
updates, and technical support.

Download Microsoft Edge More info about Internet Explorer and Microsoft Edge

Documentation
Global navigation
 * Learn
   
 * Documentation
   
 * Training
   
 * Credentials
   
 * Q&A
   
 * Code Samples
   
 * Assessments
   
 * Shows
   
 * More
     
   * Documentation
     
   * Training
     
   * Credentials
     
   * Q&A
     
   * Code Samples
     
   * Assessments
     
   * Shows
     
   

Suggestions will filter as you type
Suggestions will filter as you type
Search
Sign in

 * Profile
 * Settings

Sign out
Microsoft 365
   
 * Solutions and architecture
     
   * Get started
     
   * Set up your infrastructure for hybrid work
     
   * Set up secure collaboration
     
   * Deploy threat protection
     
   * Data privacy and data protection
     
   * Microsoft 365 for smaller businesses and campaigns
     
   
 * Apps and services
     
   * Microsoft Teams
     
   * Microsoft 365 admin center
     
   * Microsoft 365 Apps
     
   * Microsoft Purview
     
   * Microsoft 365 security
     
   * SharePoint
     
   * OneDrive
     
   * All apps and services
     
   
 * Training
     
   * Training for IT Pros
     
   * Microsoft 365 certifications
     
   * Microsoft 365 learning pathways
     
   
 * Resources
     
   * Microsoft 365 support
     
   * FastTrack
     
   * Troubleshooting
     
   * Microsoft 365 tech community
     
   * Resources for developers
     
   
 * More
     
   * Solutions and architecture
       
     * Get started
       
     * Set up your infrastructure for hybrid work
       
     * Set up secure collaboration
       
     * Deploy threat protection
       
     * Data privacy and data protection
       
     * Microsoft 365 for smaller businesses and campaigns
       
     
   * Apps and services
       
     * Microsoft Teams
       
     * Microsoft 365 admin center
       
     * Microsoft 365 Apps
       
     * Microsoft Purview
       
     * Microsoft 365 security
       
     * SharePoint
       
     * OneDrive
       
     * All apps and services
       
     
   * Training
       
     * Training for IT Pros
       
     * Microsoft 365 certifications
       
     * Microsoft 365 learning pathways
       
     
   * Resources
       
     * Microsoft 365 support
       
     * FastTrack
       
     * Troubleshooting
       
     * Microsoft 365 tech community
       
     * Resources for developers
       
     
   

 1. Free Account

Table of contents Exit focus mode

Version
Microsoft 365
   
   
 * Office 365
   
   
   
 * Office 365 operated by 21Vianet (China)
   
   

Search
Suggestions will filter as you type
 * Office 365 security
 * Overview
 * Get started
 * Evaluate
 * Deploy
 * Migrate
 * Protect and Detect
   * Defender for Office 365 SecOps Guide
   * Defender for Office 365 in Microsoft Teams
   * Security recommendations for priority accounts
   * Usage card in Defender for Office 365
   * Protection policies
     * Preset security policies
     * Recommended settings for configuring EOP and Defender for Office 365
       Security
     * Configuration analyzer for protection policies
     * Anti-malware in EOP
     * Anti-spam in EOP
     * Anti-phishing in EOP and Defender for Office 365
     * Safe Attachments in Defender for Office 365
     * Safe Links in Defender for Office 365
     * Outbound spam protection in EOP
       * Outbound spam protection
       * Configure outbound spam policies
       * Control automatic external email forwarding
       * Outbound delivery pools
       * Restore restricted users
     * Connection filtering in EOP
   * Audit log search
   * Advanced delivery policy
   * Alert policies
   * Allow and block
   * Attack simulation training in Defender for Office 365
   * Connectors for mail flow
   * Delegated administration
   * Exchange mail flow rules (transport rules)
   * Message trace
   * Quarantine
   * Reports
   * Safe Documents in Microsoft 365 A5 or E5 Security
 * Investigate and Respond
 * Reference
 * Microsoft Defender XDR docs
 * Step-by-step guides

Download PDF
    
 1. Learn
    
    
 2. Microsoft 365
    
    
 3. Security
    
    
 4. Microsoft Defender for Office 365
    

    
 1. Learn
    
    
 2. Microsoft 365
    
    
 3. Security
    
    
 4. Microsoft Defender for Office 365
    

Read in English Add
Table of contents Read in English Add Edit Print

Twitter LinkedIn Facebook Email
Table of contents


CONTROL AUTOMATIC EXTERNAL EMAIL FORWARDING IN MICROSOFT 365

 * Article
 * 06/20/2023
 * 7 contributors
 * Applies to: ✅ Exchange Online Protection, ✅ Microsoft Defender for Office 365
   plan 1 and plan 2, ✅ Microsoft Defender XDR

Feedback



IN THIS ARTICLE

    
 1. How the outbound spam filter policy settings work with other automatic email
    forwarding controls
    
 2. How to find users that are automatically forwarding
    
 3. Blocked email forwarding messages
    

Tip

Did you know you can try the features in Microsoft Defender XDR for Office 365
Plan 2 for free? Use the 90-day Defender for Office 365 trial at the Microsoft
Defender portal trials hub. Learn about who can sign up and trial terms here.

As an admin, you might have company requirements to restrict or control
automatically forwarded messages to external recipients (recipients outside of
your organization). Email forwarding can be useful, but can also pose a security
risk due to the potential disclosure of information. Attackers might use this
information to attack your organization or partners.

The following types of automatic forwarding are available in Microsoft 365:

 * Users can configure Inbox rules to automatically forward messages to external
   senders (deliberately or as a result of a compromised account).
 * Admins can configure mailbox forwarding (also known as SMTP forwarding) to
   automatically forward messages to external recipients. The admin can choose
   whether to simply forward messages, or keep copies of forwarded messages in
   the mailbox.

Note

Users with automatic forwarding from on-premises email systems through Microsoft
365 will be subject to the same policy controls as cloud mailboxes in an
upcoming update. This update will be communicated via Message Center post.

You can use outbound spam filter policies to control automatic forwarding to
external recipients. Three settings are available:

 * Automatic - System-controlled: This is the default setting. This setting is
   now the same as Off. When this setting was originally introduced, it was
   equivalent to On. Over time, thanks to the principles of secure by default,
   this setting was gradually changed to Off for all customers. For more
   information, see this blog post.
 * On: Automatic external forwarding is allowed and not restricted.
 * Off: Automatic external forwarding is disabled and will result in a
   non-delivery report (also known as an NDR or bounce message) to the sender.

For instructions on how to configure these settings, see Configure outbound spam
filtering in EOP.

Note

 * Disabling automatic forwarding disables any Inbox rules (users) or mailbox
   forwarding (admins) that redirect messages to external addresses.
 * Automatic forwarding of messages between internal users isn't affected by the
   settings in outbound spam filter policies.


HOW THE OUTBOUND SPAM FILTER POLICY SETTINGS WORK WITH OTHER AUTOMATIC EMAIL
FORWARDING CONTROLS

As an admin, you might have already configured other controls to allow or block
automatic email forwarding. For example:

 * Remote domains to allow or block automatic email forwarding to some or all
   external domains.
 * Conditions and actions in Exchange mail flow rules (also known as transport
   rules) to detect and block automatically forwarded messages to external
   recipients.

When one setting allows external forwarding, but another setting blocks external
forwarding, the block typically wins. Examples are described in the following
table:

Expand table

Scenario Result
 * You configure remote domain settings to allow automatic forwarding.
 * Automatic forwarding in the outbound spam filter policy is set to Off.

Automatically forwarded messages to recipients in the affected domains are
blocked.
 * You configure remote domain settings to allow automatic forwarding.
 * Automatic forwarding in the outbound spam filter policy is set to Automatic -
   System-controlled.

Automatically forwarded messages to recipients in the affected domains are
blocked.

As described earlier, Automatic - System-controlled used to mean On, but the
setting has changed over time to mean Off in all organizations.

For absolute clarity, you should configure your outbound spam filter policy to
On or Off.

 * Automatic forwarding in the outbound spam filter policy is set to On
 * You use mail flow rules or remote domains to block automatically forwarded
   email.

Automatically forwarded messages to affected recipients are blocked by mail flow
rules or remote domains.

You can use this behavior (for example) to allow automatic forwarding in
outbound spam filter policies, but use remote domains to control the external
domains that users can forward messages to.


HOW TO FIND USERS THAT ARE AUTOMATICALLY FORWARDING

You can see information about users that are automatically forwarding messages
to external recipients in the Auto forwarded messages report for cloud-based
accounts. For on-premises users that automatically forward from their
on-premises email system through Microsoft 365, you need to create a mail flow
rule to track these users. For instructions on how to create a mail flow rule,
see Use the EAC to create a mail flow rule.

The following information is required to create the mail flow rule in the
Exchange admin center (EAC):

 * Apply this rule if (condition): A message header > matches these text
   patterns. Note you might need to click More options to see this option.
   
   * Header name: X-MS-Exchange-Inbox-Rules-Loop
   * Header value: .
   
   The condition looks like this: 'X-MS-Exchange-Inbox-Rules-Loop' header
   matches '.'
   
   This condition will match any value for the header.

 * (Optional) Do the following (action): You can configure an optional action.
   For example, you can use the action Modify the message properties > set a
   message header, with the header name X-Forwarded and the value True. But,
   configuring an action is not required.

 * Set Audit this rule with severity level to the value Low, Medium, or High.
   This setting allows you to use the Exchange transport rule report to get
   details of users that are forwarding.




BLOCKED EMAIL FORWARDING MESSAGES

When a message is detected as automatically forwarded, and the outbound spam
filter policy blocks that activity, the message is returned to the sender in an
NDR that contains the following information:

5.7.520 Access denied, Your organization does not allow external forwarding.
Please contact your administrator for further assistance. AS(7555)




--------------------------------------------------------------------------------


FEEDBACK

Was this page helpful?

Yes No
Provide product feedback


FEEDBACK

Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the
feedback mechanism for content and replacing it with a new feedback system. For
more information see: https://aka.ms/ContentUserFeedback.

Submit and view feedback for

This product This page
View all page feedback

--------------------------------------------------------------------------------


ADDITIONAL RESOURCES



--------------------------------------------------------------------------------

Training

Module

Troubleshoot message filtering in inboxes and Microsoft Defender for Office 365
- Training

Investigate and diagnose why emails are prevented from arriving at their
intended destination because of inbox rules, Microsoft Defender for Office 365,
spam filter policies, and other Exchange Online features. MS-220



English (United States)
California Consumer Privacy Act (CCPA) Opt-Out Icon Your Privacy Choices
Theme
 * Light
 * Dark
 * High contrast

 * Manage cookies
 * Previous Versions
 * Blog
 * Contribute
 * Privacy
 * Terms of Use
 * Trademarks
 * © Microsoft 2024


ADDITIONAL RESOURCES



--------------------------------------------------------------------------------

Training

Module

Troubleshoot message filtering in inboxes and Microsoft Defender for Office 365
- Training

Investigate and diagnose why emails are prevented from arriving at their
intended destination because of inbox rules, Microsoft Defender for Office 365,
spam filter policies, and other Exchange Online features. MS-220




IN THIS ARTICLE



English (United States)
California Consumer Privacy Act (CCPA) Opt-Out Icon Your Privacy Choices
Theme
 * Light
 * Dark
 * High contrast

 * Manage cookies
 * Previous Versions
 * Blog
 * Contribute
 * Privacy
 * Terms of Use
 * Trademarks
 * © Microsoft 2024