Check ID: defender_antispam_outbound_policy_forwarding_disabled
Provider: Microsoft 365
Service: defender
Severity: HIGH
Categories: email-security, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Defender for Office 365 outbound spam policies are evaluated to confirm that automatic mail forwarding is disabled in the default policy and in any custom policies applied to users, groups, or domains.

​
Risk

Allowing automatic forwarding enables covert data exfiltration, eroding confidentiality. Attackers or insiders can auto-route mail to external inboxes, persist access, evade monitoring, and harvest sensitive content (tickets, approvals, MFA codes), enabling lateral movement and fraud while reducing auditability.

​
Recommendation

Disable automatic forwarding globally in outbound spam policies to enforce least privilege on data flows. If exceptions are required, restrict to named senders or domains, document approvals, and review regularly. Add DLP, alerts on new forwarding rules, and mailbox auditing for defense in depth.

​
Remediation

Set-HostedOutboundSpamFilterPolicy -Identity <policyName> -AutoForwardingMode Off

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_antispam_outbound_policy_forwarding_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks