What breaks when offboarding does not remove mailbox forwarding rules?

What Actually Breaks When Forwarding Survives Offboarding?

The failure is not just that one mailbox keeps receiving mail. A forwarding rule preserves an alternate delivery path after the user’s access should have ended, so offboarding no longer means the organisation controls where messages land. That breaks the assumption that deprovisioning fully severs access, and it weakens auditability, containment, and ownership of business communications.

Mailbox forwarding is especially dangerous because it sits outside the simple “account disabled” check that many teams rely on. If the rule is not removed, the mailbox can continue to route sensitive mail to an external destination even though the user can no longer sign in. That creates a standing communications channel that is invisible to normal session-based controls and can outlive the employment or contractor relationship.

Why This Becomes an Access-Control Problem, Not Just a Cleanup Task

Forwarding rules are a form of message authorization, because they decide where information is delivered. In Joiner-Mover-Leaver (JML) Guide, offboarding is treated as more than account disablement, it is also the removal of residual access paths that can keep acting after the person leaves. If that step is missed, the organisation has revoked interactive login without revoking downstream data flow.

This is why forwarding should be treated as part of identity and access governance, not mail administration alone. The rule may be configured in the mailbox, but the security consequence is privilege persistence: the former user still receives information they should no longer see. For that reason, IAM and IGA Basics is relevant here because it frames the need to govern entitlements and residual access, not only user accounts.

The issue is broader than email. A surviving forwarding rule can support data exfiltration, business process confusion, and unnoticed leakage of alerts, invoices, resets, or customer correspondence. The mailbox may be technically disabled as an interactive identity, yet still function as a delivery relay. That is why offboarding must be judged by what can still receive and redirect information, not just by whether the account is locked.

What Fails in Practice When the Rule Is Left Behind

At the operational level, the main failure is incomplete deprovisioning. The account lifecycle ends, but the message-routing lifecycle does not. That creates a gap between identity removal and data-path removal, which is exactly the kind of residual state that weak offboarding processes miss. In Ultimate Guide to NHIs, Lifecycle Processes for Managing NHIs, lifecycle control includes offboarding, visibility, and decommissioning of access paths; the same logic applies here even when the subject is a human mailbox.

The persistence risk is not theoretical. A forwarding rule can keep delivering mail after account disablement, which means an attacker, a departing employee, or simply an untrusted external inbox can continue to receive sensitive traffic. If the mailbox is used for password resets, approvals, HR notices, or finance workflows, the forwarding path can also become a silent dependency that keeps other systems reachable longer than intended.

This is also a detection problem. Teams often verify only the account state, while the rule lives in a separate control plane and may not trigger obvious user-facing alerts. The most useful way to think about the break is that offboarding has failed to terminate a secondary trust relationship. The account is gone, but the mail routing trust remains active.

Risk and Threat Considerations

Leaving forwarding rules in place creates an exposure path that can be abused for information theft, account recovery interception, and long-tail persistence after exit. It also increases the chance that sensitive internal mail continues to flow to an unmanaged destination, where the organisation loses both visibility and practical control.

Failure mechanism: The mailbox is disabled, but the forwarding rule still routes incoming mail to an external inbox or alternate recipient, so access to message content survives the user’s departure.

Impact: Confidential messages can be exposed outside the organisation, recovery workflows can be intercepted, and the offboarded identity may retain an indirect channel into business communications.

Practitioner Guidance

What to verify: Treat forwarding-rule removal as a required offboarding control, not an optional mailbox tidy-up. Verify both server-side and user-configured forwarding, plus any transport-rule or client-side redirection that can replicate the same outcome. If the organisation cannot prove the rule was removed, it should assume the delivery path still exists.

Decision rule: If the mailbox can still deliver messages to any external or non-owned destination, treat the offboarding as incomplete until the route is removed and the recipient is reviewed. If the mailbox was used for operational approvals, resets, or shared inbox workflows, validate those dependencies before disabling the final path.

Practitioner takeaway: The real control objective is not only to disable the account, but to terminate every surviving route by which the former identity can still receive protected information.

Related resources from NHI Mgmt Group

• What breaks when mailbox forwarding rules are not monitored as privileged changes?
• What breaks when offboarding does not fully remove directory access?
• What breaks when offboarding does not remove access across all SaaS systems?
• What breaks when attackers create mailbox rules after account takeover?