Attackers hide Microsoft 365 forwarding rules with misleading names, by targeting selected messages, or by creating rules that don’t appear in the standard rules list. After compromising an account, they can copy correspondence externally while moving or deleting messages that might expose the activity.
A password reset doesn’t remove these rules. Effective recovery requires checking inbox rules, mailbox forwarding, mail flow rules and account access separately.
Key takeaways
- Review forwarding at every level, not just the settings visible in Outlook.
- Preserve rule details and audit evidence before removing unauthorised changes.
- Block unapproved forwarding outside the organisation, but investigate how the attacker gained access and what information they accessed.
How attackers conceal Microsoft 365 forwarding rules
Ordinary rules can be difficult to notice
A malicious rule does not need advanced concealment to remain unnoticed. An uninformative name, narrow matching conditions or placement amongst existing rules can delay discovery.
Rules may target invoices, payment discussions or messages from particular suppliers rather than forwarding everything. Other actions can move matching messages into rarely reviewed folders, mark them as read or delete them.
This can support business email compromise, where an attacker monitors genuine correspondence before impersonating a participant or changing payment instructions. The mailbox may otherwise appear to work normally.
Stolen credentials are one route into an account, although stolen sessions and malicious application permissions also matter. Our guidance on leaked employee passwords explains why exposure requires investigation beyond changing a password.
Hidden rules require an administrative view
Some rules are hidden from the standard rules interface. A clean-looking rules list therefore does not establish that the mailbox is safe.
Administrators can inspect hidden inbox rules through Exchange Online PowerShell using the IncludeHidden parameter. This is a separate check from reviewing the forwarding address configured directly on the mailbox.
Rule names are weak evidence either way. Review the conditions, actions, destinations and creation history, then establish whether the business authorised them.
Where to inspect forwarding and mailbox changes
Review all forwarding locations
Microsoft 365 has several mechanisms that can send messages elsewhere. Checking only the user’s client settings leaves gaps.
Use the following comparison to structure the review.
| Mechanism | Where to inspect | What to establish |
|---|---|---|
| Inbox rules | User-facing mail client and Exchange Online PowerShell | Forwarding, redirection, deletion and folder actions |
| Hidden inbox rules | PowerShell with IncludeHidden | Rules absent from the normal client list |
| Mailbox forwarding | Microsoft 365 admin centre or Exchange administration | Destination and whether the source retains messages |
| Organisation-wide transport rules | Exchange admin centre, Mail flow, Rules | Organisation-level conditions, recipients and actions |
An unexpected destination warrants investigation, but an internal address can also belong to another compromised account.
Include shared mailboxes in the scope. Their access permissions and ownership require separate attention, as explained in our shared mailbox security guidance.
Use PowerShell alongside audit records
With authorised Exchange Online permissions, run Get-InboxRule -Mailbox $mailbox -IncludeHidden, where $mailbox contains the affected mailbox identity. Examine forwarding destinations, redirection, deletion, folder movement, priority and whether a rule stops subsequent processing.
Also inspect ForwardingAddress, ForwardingSmtpAddress and DeliverToMailboxAndForward through Get-Mailbox.
Search Microsoft Purview audit records for relevant rule and mailbox changes. Events can include New-InboxRule, Set-InboxRule, UpdateInboxRules and Set-Mailbox, depending on how the change occurred.
Correlate timestamps with Microsoft Entra sign-ins, application permissions and administrator activity. Available history depends on audit configuration, retention and licensing.
Contain the account without losing evidence
Preserve the configuration and establish exposure
Record the rule identity, conditions, actions, destination, mailbox and relevant timestamps before removal. Export available audit records and retain suspicious message headers.
Containment should not wait for a complete investigation, but deleting every suspicious item immediately can remove useful evidence.
Establish which messages matched the rule, whether forwarding succeeded and whether attachments contained personal or confidential information. A configured rule shows intent; it does not prove that every matching message reached its destination.
Review payment-related conversations for altered bank details or impersonation. Where fraud is suspected, involve the finance team and contact the bank promptly.
Remove persistence as well as access
Block sign-in where appropriate, revoke sessions and reset the account credentials. Session revocation does not guarantee that every existing access token stops working instantly.
Remove unauthorised rules and forwarding settings after preserving evidence. Review delegates, application consent, authentication methods and privileged access as well.
A password reset alone leaves configuration-based persistence untouched. Similarly, deleting a forwarding rule does not remove the access that allowed its creation.
Our Microsoft 365 security assessment can help identify configuration and access weaknesses. For ongoing managed detection and response, establish which identity, email and cloud events are monitored and who can authorise containment.
Why external forwarding is blocked
Microsoft 365 normally blocks automatic external email forwarding by default. Existing policies and exceptions affect the effective configuration, so a forwarding address alone doesn’t prove that messages are leaving the organisation.
The rejection can read:
Remote Server returned 550 5.7.520 Access denied, Your organization does not allow external forwarding
Microsoft’s external forwarding guidance explains how outbound spam policies restrict inbox-rule and administrator-configured mailbox forwarding to external addresses. Internal forwarding is treated differently.
In Microsoft Defender, open Email & collaboration, Policies & rules, Threat policies, then Anti-spam. Select the outbound policy and choose Edit protection settings.
Under Forwarding rules, inspect Automatic forwarding rules. Choose the explicit Off setting to disable automatic forwarding when messages must not be sent outside the organisation, rather than relying on the system-controlled option.
A blocked forwarding attempt doesn’t prove that the mailbox was protected throughout. The attacker may already have read messages directly, downloaded attachments or accessed another mailbox.
Review the rule’s lifetime and available activity records before determining the incident’s scope.
Troubleshoot approved forwarding without weakening protection
Start with the rejection message and the policy applied to the source mailbox. Check the label in older Office 365 accounts or runbooks before changing settings. Policy scope, priority and other mail-flow restrictions can explain why an enabled setting still fails.
For an authorised exception, enable external email forwarding by setting the outbound policy’s Automatic forwarding rules option to On - Forwarding is enabled. Apply the exception to the smallest necessary scope, rather than allowing forwarding across the organisation.
Microsoft’s outbound policy configuration instructions describe the policy settings and recipient scope. Permission under this policy doesn’t override every other restriction.
Re:amaze can’t receive automatically forwarded messages when Microsoft 365 blocks forwarding. Restore an approved route through a scoped exception; don’t treat the delivery failure as a reason to relax tenant-wide controls.
For GoDaddy-managed Microsoft 365, use Email & Office Dashboard, the Microsoft 365 Admin tab, then Email Forwarding. For an approved configuration, switch Forwarding Status to On, select Close, then confirm Forwarding Status remains On after saving.
After any change, send a controlled test message and use Exchange message trace to check the delivery outcome. Test attachments and source-mailbox retention separately.
Forwarding exceptions should sit alongside Microsoft 365 anti-phishing controls, not replace them.
Choose the right method for approved forwarding
Forwarding one mailbox
In the Microsoft 365 admin centre, open Users, Active users, select the account and choose Mail. Open email forwarding, enter the authorised destination and choose whether to keep a copy in the source mailbox.
If an older runbook uses an Office 365 label, check that it identifies the intended source mailbox.
External delivery remains subject to the relevant security policies. Saving the address doesn’t confirm successful delivery.
If colleagues need continuing access to correspondence, delegated access to a shared mailbox may be more appropriate. It avoids sending separate copies to several personal inboxes and provides a central working location.
Sending messages to multiple users
For organisation-level handling, open the Exchange admin centre, then Mail flow and Rules. Create a transport rule whose condition matches the source mailbox.
When multiple users need the same correspondence, a transport rule can forward emails from the source mailbox to approved users.
When the intended action is to add people to a message, select the target users as To recipients rather than CC or BCC. This adds recipients; redirecting the message is a different action with different delivery consequences.
Before you enable the rule, confirm its owner and intended effect. New mail flow rules are initially saved disabled. Enable the approved rule, refresh the list and confirm its status before testing delivery.
A distribution list is another option for delivering messages to several users. A rule may be easier for a small business with few users, while group membership is often easier to maintain as recipients change.
Document the owner, purpose and review date whichever method you use.
Frequently asked questions
Does forwarding differ from redirecting?
Forwarding sends the message onwards as a forwarded message. Redirecting preserves the original sender, so replies normally go to that sender rather than the redirecting mailbox. Whether the source retains a copy depends on the configuration.
Are attachments included?
Ordinary forwarding normally includes the message’s attachments. Message-size limits, filtering and destination restrictions can still prevent delivery. Test the approved route using non-sensitive content rather than assuming that successful delivery of a plain message proves attachments work.
Why is an enabled Outlook forwarding rule failing?
An outbound-forwarding policy, rule conditions, exceptions, ordering or another transport restriction may prevent delivery. A disabled mail flow rule is another common cause. Inspect the effective configuration and message trace rather than repeatedly recreating the rule.
Review forwarding as part of account recovery
Removing a suspicious rule addresses one persistence mechanism. Recovery also requires establishing how access was obtained, which information was exposed and whether other permissions remain.
Ask our team to review mailbox rules, forwarding exceptions and account protection through our Microsoft 365 email security services. We can help identify configuration gaps and establish practical controls for your organisation.
