You block it by using outbound mail flow controls and anti-spam policies that stop automatic forwarding to external recipients. Configure the organisation so only approved forwarding paths are allowed, then review any exceptions for business need. Monitor for mailbox rules and transport rules that redirect mail externally, because attackers often use forwarding to exfiltrate messages silently.
What Exchange Online is actually blocking when you stop automatic forwarding
Automatic forwarding is not the same as a user manually sending a message. The control point is policy, not inbox behavior: Exchange Online can prevent mail from being forwarded onward to external recipients by default, then allow only the exceptions your organisation explicitly approves. That matters because forwarding rules can quietly move sensitive mail out of tenant boundaries without changing the original mailbox.
For most organisations, the practical goal is to make external forwarding an exception path, not a normal user capability. That usually means aligning mail flow policy, anti-spam settings, and mailbox-level rule visibility so you can distinguish legitimate business forwarding from unauthorized redirection.
Microsoft’s broader hardening guidance for Exchange and Microsoft 365 is useful here, especially when you want the forwarding restriction to sit inside a wider tenant control baseline rather than as a one-off setting in isolation. Microsoft 365 Security Guide
Which Exchange Online controls usually stop the leak path
The main enforcement layers are outbound mail flow controls and anti-spam policies that disable or restrict automatic forwarding to external domains. In practice, organisations also review transport rules, mailbox rules, and any delegated mail-handling paths that can send messages outside the tenant. If a rule or connector can redirect mail externally, it deserves the same scrutiny as a forwarding setting.
Manual exceptions should be narrow and documented. If a business unit genuinely needs forwarding, the safer pattern is to permit a specific approved path rather than opening broad external forwarding across the tenant. That keeps the policy understandable during incident response and reduces the chance that a temporary exception becomes permanent drift.
Exchange forwarding controls are often part of a larger email security posture that also includes routing, authentication, and remediation capabilities. The better your email architecture, the easier it is to see whether a forwarded message is a legitimate workflow or a control bypass. Email Security Guide
Where forwarding is used as part of a legitimate delegation or cross-system workflow, token and delegation boundaries matter. The policy question is not only “can mail move,” but also “who or what is allowed to move it, under what authority, and with what limits.” OAuth Token Exchange and Delegation Guide
Why attackers care about external forwarding rules
External forwarding is attractive because it turns the mailbox into a passive exfiltration channel. An attacker who gains mailbox access does not always need to download everything immediately if they can silently relay future mail elsewhere. That gives them persistence, lowers detection pressure, and can expose invoices, resets, approvals, and other high-value mail without obvious mailbox tampering.
Forwarding abuse also creates a monitoring problem. If teams only watch for sign-in anomalies and not for new mailbox rules, transport rules, or forwarding exceptions, the attacker can keep receiving mail long after the initial compromise. In Microsoft 365 environments, that makes message redirection part of the compromise lifecycle, not just an administrative convenience.
Mailbox compromise and token abuse in Microsoft ecosystems can be particularly damaging when attackers can continue to read mail after initial access is lost. Historical Microsoft email compromise incidents show why message access and token trust deserve close attention, especially when forwarding rules are used to preserve access to inbound mail. Microsoft Storm-0558 key breach 2023
Risk and Threat Considerations
Automatic forwarding to external domains creates a direct data-exposure path. The main risk is not just accidental leakage, but silent exfiltration after mailbox compromise, because the attacker can keep receiving mail without repeatedly signing in.
Failure mechanism: A malicious or misconfigured mailbox rule, transport rule, or exception path forwards sensitive messages outside the tenant, bypassing normal user awareness and reducing the chance of timely detection.
Impact: Confidential mail, password resets, approval workflows, and other business-sensitive content can be exposed externally, which can extend compromise duration and increase the blast radius of a single mailbox takeover.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Stopping external forwarding is an account and access governance control. |
| Recommendation — Restrict account-based forwarding paths and review exceptions for unauthorized external mail movement. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | External forwarding exceptions should be tightly limited to approved need. |
| AU-6 — Audit Review, Analysis, and Reporting | Detecting forwarding abuse depends on reviewing mailbox and transport-rule activity. | |
| AC-4 — Information Flow Enforcement | Mail-flow controls enforce whether messages may leave the tenant externally. | |
| Recommendation — Limit forwarding permissions to the minimum approved recipients and mailboxes. Review mail-flow and mailbox-rule logs for unapproved external redirection. Enforce policies that block or constrain information flow to external domains. | ||
| ISO/IEC 27001:2022 | A.8.12 — Data Leakage Prevention | Blocking automatic external forwarding prevents unauthorised message exfiltration. |
| Recommendation — Apply leakage-prevention controls to stop unauthorized outbound mail forwarding. | ||
Practitioner Guidance
What to verify: Confirm whether external forwarding is blocked at the tenant level, then test the actual outcomes for mailbox rules, transport rules, and any approved exceptions. The policy is only effective if all practical forwarding paths are covered.
Decision rule: If the forwarding path is not clearly owned, justified, and auditable, treat it as a control gap rather than a convenience feature. If a business process truly needs external forwarding, narrow it to the smallest possible set of recipients and mailboxes.
What practitioners underestimate: A forwarding rule can be more dangerous than an obvious account compromise because it quietly preserves access to future mail. The right control objective is not merely stopping one setting, but making external message redirection visible, reviewable, and exception-based.
Practitioner takeaway: In Exchange Online, external forwarding should be managed like a controlled data-exfiltration path, not a harmless mail preference, because the security problem is usually persistence and invisibility as much as leakage.
Related resources from NHI Mgmt Group
- Who is accountable when sensitive email remains stored in Exchange Online too long?
- How can organisations control mailbox forwarding risk in Exchange Online?
- Why do native email controls often miss data exfiltration from Exchange Online and Gmail?
- What is the difference between basic email DLP and AI-powered DLP for Exchange Online?