Enable External Email Forwarding in Microsoft 365

6.8K

External email forwarding is blocked by default in Microsoft 365. When a user tries to forward emails externally, they may receive an NDR with the error:

“Your organization does not allow external forwarding.”

This error occurs because outbound anti-spam policies block automatic forwarding.

What is Automatic Email Forwarding?

Automatic email forwarding is disabled by default in Microsoft 365 due to security risks. It allows users to redirect incoming emails to another address.

Microsoft 365 supports three values for the AutoForwardingMode setting: On, Off, and Automatic. Historically, the Automatic value allowed Microsoft to determine how forwarding should be handled. As Microsoft adopted a more secure-by-default approach, the effective behavior of Automatic was changed and now functions the same as Off for external forwarding cases. As a result, organizations that never explicitly configured this setting may still find that external forwarding is blocked until the value is changed to On.

Note that Microsoft 365 supports several forwarding methods, including mailbox-level forwarding and inbox rules. Outbound anti-spam policies primarily control automatic forwarding cases and may affect forwarding rules created in Outlook or Outlook on the web.

Why External Email Forwarding is Blocked?

Microsoft 365 offers a straightforward process to enable this feature, allowing users to forward emails to external addresses. On the other hand, external email forwarding can also be abused. So be mindful and consider all scenarios before allowing automatic forwarding in your tenant.

We recommend you restricting automatic forwarding because attackers frequently use forwarding rules to exfiltrate email from compromised accounts. External forwarding may also affect your Microsoft Secure Score recommendations.

Note. Keep in mind that to use this tutorial, you’ll need administrator permissions in order to modify anti-spam policies in Microsoft 365.

Option 1: Modify the Default Anti-Spam Outbound Policy in Microsoft 365 Defender (All Users)

External email forwarding is not allowed by default. The setting that controls this restriction is the default outbound anti-spam policy in Microsoft 365 Defender.

We must modify that setting to turn on automatic forwarding to enable it.

1. Sign in to the Microsoft Defender portal (defender.microsoft.com) using your administrative credentials.
2. Navigate to Email & collaboration → Policies & rules → Threat policies.
   

   

3. Under Policies, click Anti-spam.
   

   

4. Click Anti-spam outbound policy (Default) and Edit protection settings.
   

   

5. Under the Automatic forwarding rules, select “On – Forwarding is enabled” and click Save.
   

   

Now external forwarding is enabled for all users in your Microsoft 365 tenant.

Option 2: Create a New Anti-Spam Outbound Policy in Microsoft 365 Defender (Selected Users or Groups)

Instead of allowing automatic forwarding for all users, it would make sense to fine-tune it and control which users can automatically forward messages.

We can achieve this by creating a new outbound anti-spam policy in Microsoft 365 Defender. You can use this option if you want to allow forwarding only for specific users or groups.

1. Sign in to the Microsoft Defender portal (defender.microsoft.com) using your administrative credentials.
2. Navigate to Email & collaboration → Policies & rules → Threat policies.
   

   

3. Under Policies, click Anti-spam.
   

   

4. Click Create policy → Outbound.
   

   

5. Provide a descriptive name for your new Anti-Spam Outbound Policy. Choose a name that reflects the purpose or focus of the policy to identify it in the future quickly. Click Next.
   

   

6. Specify the users or groups you want this policy to apply. In this example, I have a group named Allow External Forwarding that I want to allow. Once you’ve specified the targets, click Next.
   

   

7. On the next step, set Automatic forwarding rules to “On – Forwarding is enabled” and click Next.
   

   

8. On the Review step, click Create to create the policy.
   

   

9. Finally, click Done.
   

   

External forwarding is now allowed for the members of the group. If multiple outbound anti-spam policies apply to the same user, Microsoft 365 evaluates them according to policy priority. You need to make sure that your custom forwarding policy has a higher priority than more restrictive policies if you want the forwarding setting to take effect.

Option 3: Configure External Forwarding via PowerShell

Command	Action
Get-HostedOutboundSpamFilterPolicy	Check current forwarding state
Set-HostedOutboundSpamFilterPolicy	Enable/Disable forwarding tenant-wide
New-HostedOutboundSpamFilterRule	Apply policy to specific users/groups

To enable external forwarding in the default outbound policy, use this command:

Connect-ExchangeOnline

Set-HostedOutboundSpamFilterPolicy -Identity Default `
-AutoForwardingMode On

Now you should check the setting. Use the command:

Get-HostedOutboundSpamFilterPolicy -Identity Default |
Select-Object Name,AutoForwardingMode

If you need to create a new policy for specific users, use the following:

New-HostedOutboundSpamFilterPolicy -Name "Allow External Forwarding" `
-AutoForwardingMode On

New-HostedOutboundSpamFilterRule -Name "Allow External Forwarding Rule" `
-HostedOutboundSpamFilterPolicy "Allow External Forwarding" `
-From "user@domain.com"

The example above applies the policy to a specific mailbox.

Now verify the setting:

Get-HostedOutboundSpamFilterPolicy `
-Identity "Allow External Forwarding" |
Select-Object Name,AutoForwardingMode

If you need to verify current forwarding settings, run the command:

Get-HostedOutboundSpamFilterPolicy | Select Name, AutoForwardingMode

Keep in mind that changes may take some time to propagate across Microsoft 365 services. In some environments, policy updates can take several minutes or longer before they become effective.

Tracking Auto Forwarded Messages Report

If you’re wondering how to get an insight into your organization’s automatic forwarding activities, it is available in the Exchange Admin Center. This report helps you to detect potential data leaks/suspicious forwarding activity.

All you need is to log in to the Exchange Admin Center, navigate to Reports → Mail Flow → Auto forwarded messages report.

And you’ll see the summary of the Auto forwarded message showing the Forwarding type, Recipient domain, and Forwarding users.

Scrolling further down, you’ll see the details that you can export. The reports range is available for 7, 30, and 90 days. You can also choose a custom start date.

Troubleshooting External Forwarding

If external email forwarding is still not working after enabling it, check the following:

• Verify that the outbound anti-spam policy is configured with AutoForwardingMode set to On.
• If multiple outbound anti-spam policies exist, you need to verify that the correct policy applies to the user and that policy priority is configured properly.
• Confirm that mailbox forwarding/inbox rules are configured correctly. Enabling forwarding in the anti-spam policy only allows forwarding; it does not create forwarding rules automatically.
• Allow time for Microsoft 365 policy changes to propagate across services. In some environments, changes may take several minutes or longer before they become effective.
• Review the Auto Forwarded Messages report and Message Trace to verify whether messages are being forwarded/blocked.
• Check Microsoft Defender alerts and audit logs for forwarding rule creation/suspicious mailbox activity.

Wrapping up

For security reasons, the external email forwarding is disabled by default in Microsoft 365.

You can enable external email forwarding:

• For all users through the default outbound policy
• Selectively using custom policies

Keep in mind that you need to always monitor forwarding activity and apply restrictions where needed to prevent data leaks.

Security Considerations

We recommend you:

• Enable email forwarding only for specific trusted users/groups — do not enable it tenant-wide
• Regularly review the Auto Forwarded Messages report in Exchange Admin Center
• Consider configuring alert policy in Microsoft Defender, this will notify you when new forwarding rules will be created
• Periodically audit mailbox forwarding rules, this will help you to detect compromised accounts