Check ID: exchange_transport_rules_mail_forwarding_disabled
Provider: Microsoft 365
Service: exchange
Severity: HIGH
Categories: email-security, e3
Resource type: NotDefined

​
What this check verifies

Microsoft 365 Exchange Online mail flow rules are assessed for actions that forward or redirect messages to external domains. The finding highlights rules that add external recipients during transport.

​
Risk

External auto-forwarding enables silent data exfiltration, bypassing DLP and retention, reducing confidentiality. A compromised mailbox can use forwarding for persistence and lateral movement, leaking sensitive content to untrusted domains and undermining communication integrity.

​
Recommendation

Block external auto-forwarding at the organization level and prefer internal controls for sharing. Apply least privilege with narrowly scoped, time-bound exceptions only when justified. Adopt defense in depth: pair with DLP, outbound filtering, and alerts on new forwarding rules. Review and attest rules regularly.

​
Remediation

Remove-TransportRule -Identity <example_rule_name>

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = exchange_transport_rules_mail_forwarding_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks