Exchange Online and email
Suspicious inbox rules and forwarding in Microsoft 365, explained
Suspicious inbox rules and forwarding in Microsoft 365: the signs Microsoft lists, where it checks for rules, and the forwarding settings it describes.
Where to start: checking for suspicious inbox rules
Inbox rules and the forwarding setting are part of Exchange Online, so these checks don't need an extra licence. The commands run in Exchange Online PowerShell; the forwarding setting is in the Microsoft Defender portal.
- Know the rules Microsoft lists as warning signsRules that forward email to unknown addresses, or move messages to the Notes, Junk Email or RSS Subscriptions folders, plus recently added external forwarding.All the signs Microsoft lists
- Check the mailbox's own forwardingRun Get-Mailbox -Identity <Identity> | Format-List Forwarding*Address,DeliverTo*. Microsoft says a ForwardingSmtpAddress value means mail goes to an external recipient.Full commands
- List every inbox rule, including hidden onesRun Get-InboxRule -Mailbox <Identity> -IncludeHidden and look at RedirectTo, ForwardTo and ForwardAsAttachmentTo. The -IncludeHidden parameter adds hidden rules to the results.Full commands
- Set automatic external forwarding to On or OffIn the Defender portal: Email & collaboration > Policies & rules > Threat policies > Anti-spam > Anti-spam outbound policy (Default) > Edit protection settings. Microsoft says to choose On or Off rather than Automatic.Full steps for the forwarding setting
- Treat a malicious rule as a possible compromised accountMicrosoft's response starts with disabling the account and revoking sessions, then reviewing MFA methods, app consents, admin roles and forwarding.Compromised account checklist
- If payments were discussed, check by phone and reportScamwatch's business email compromise guidance describes contacting the other business by phone on a number sourced independently. ASIC's guidance for scammed businesses also covers deleting forwarding rules you don't recognise.Where to report in Australia
Based on Microsoft Learn's compromised-account, external forwarding and outbound spam policy pages, Scamwatch's business email compromise page and ASIC's guidance for scammed businesses, checked 21 October 2026. Commands and menus can change.
Key points
- Microsoft's documentation notes that inbox rules can forward messages to external addresses deliberately or as a result of a compromised account.
- Microsoft explains that the default 'Automatic - System-controlled' forwarding setting became Off for new organisations in 2021, but can still behave as On for some existing ones.
- Microsoft says that when one setting allows external forwarding and another blocks it, the block typically wins.
Inbox rules run automatically on incoming mail, and Microsoft’s documentation lists suspicious inbox rules and newly added forwarding among the signs that a Microsoft 365 account may be compromised. A rule can move a message to another folder, mark it as read, delete it, or forward or redirect it to another address. Those features are useful, and the same features can be misused when someone other than the mailbox owner has access. This page explains the warning signs Microsoft lists, where its guide looks for rules and forwarding, and the forwarding settings it describes.
What Microsoft lists as signs of compromise
Microsoft’s guide to responding to a compromised email account lists these activities as possible signs:
- suspicious inbox rules, for example rules that automatically forward email to unknown addresses, or rules that move messages to the Notes, Junk Email or RSS Subscriptions folders
- recently added external email forwarding
- the mailbox being blocked from sending email
- missing or deleted email
- suspicious messages in Sent Items or Deleted Items
- frequent password changes or unexplained account lockouts
- suspicious email signatures
- changes to the user’s contact details in the Global Address List.
Microsoft’s forwarding documentation also notes that users can configure inbox rules to forward messages to external senders “deliberately or as a result of a compromised account”.
Where Microsoft’s guide checks for rules and forwarding
Microsoft’s compromised-account guide describes reviewing mail forwarding in two places, alongside the audit log and message trace:
| Where | What Microsoft’s guide describes |
|---|---|
| Mailbox forwarding (also called SMTP forwarding) | Set on the mailbox by an admin; the guide refers to the ForwardingAddress and ForwardingSmtpAddress properties |
| Inbox rules | Reviewed with Get-InboxRule -IncludeHidden, looking at the RedirectTo, ForwardTo and ForwardAsAttachmentTo properties |
| Audit logs | Reviewed from the start of the suspicious activity, using a date range that begins just before it (how the Microsoft 365 audit log works) |
| Message trace | Used to check what the account sent |
The -IncludeHidden parameter in Microsoft’s command includes hidden rules in the results.
How to list a mailbox’s forwarding and rules
Based on Microsoft’s instructions (checked October 2026), using Exchange Online PowerShell. Microsoft’s compromised-account guide has the latest commands.
-
Check mailbox (SMTP) forwarding:
Get-Mailbox -Identity <Identity> | Format-List Forwarding*Address,DeliverTo*Microsoft says a value in ForwardingSmtpAddress means email is forwarded to an external recipient, and ForwardingAddress to an internal one. If DeliverToMailboxAndForward is False, messages are forwarded and not delivered to the mailbox.
-
List every inbox rule, including hidden ones:
Get-InboxRule -Mailbox <Identity> -IncludeHidden | Format-List Name,Enabled,RedirectTo,Forward*,IdentityMicrosoft says a value in RedirectTo means messages are redirected and “aren’t delivered to this mailbox”; values in ForwardTo or ForwardAsAttachmentTo mean messages are forwarded.
-
Show the full details of one rule with
Get-InboxRule -Identity "<Identity>" -IncludeHidden | Format-List. ASIC’s guidance for businesses that have been scammed similarly includes reviewing account settings and rules “in case scammers have set up rules to forward emails or calls made to your business”, and says to “delete any forwarding rules you don’t recognise.”
The forwarding settings Microsoft describes
Automatic external forwarding
Microsoft’s documentation explains that the outbound spam filter policy controls automatic forwarding to external addresses, covering both inbox rules that users create and mailbox forwarding that admins set. Forwarding between internal users isn’t affected.
The policy has three values:
- Automatic - System-controlled, the default. Microsoft explains this was originally equivalent to On; in 2021 it changed to Off for new organisations and for existing organisations that weren’t actively using it, but for some existing organisations it can still behave as On.
- On - Forwarding is enabled, where automatic external forwarding isn’t restricted.
- Off - Forwarding is disabled, where forwarded messages are blocked and the sender receives a non-delivery report.
Because the behaviour can differ by organisation, Microsoft’s documentation says to configure On or Off instead of Automatic.
How to find the automatic forwarding setting
Based on Microsoft’s instructions (checked October 2026). Microsoft’s outbound spam policy page has the latest steps.
- In the Microsoft Defender portal (security.microsoft.com), go to Email & collaboration > Policies & rules > Threat policies > Anti-spam.
- Select Anti-spam outbound policy (Default) (or a custom outbound policy) by clicking its row.
- In the details flyout, select Edit in the protection settings section.
- Under Forwarding rules, the Automatic forwarding rules list shows Automatic, On or Off. Save any change.
Microsoft lists the roles that can change these policies, including membership of the Organization Management or Security Administrator role groups in Exchange Online. The Microsoft 365 security checklist places this setting alongside the other email protections Microsoft describes.
When forwarding is blocked by this policy, Microsoft states that the sender receives a bounce message containing 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance.
Remote domains and mail flow rules
Microsoft also describes remote domains, which can allow or block automatic forwarding to some or all external domains, and mail flow rules that can detect and block automatically forwarded messages. Microsoft says that when one setting allows external forwarding and another blocks it, the block typically wins, and gives the example of allowing forwarding in the outbound spam policy while using remote domains to limit which domains can receive forwarded mail.
Why a rule is treated as part of a wider incident
A malicious rule means someone may have had access to the mailbox, and Microsoft’s guide describes its steps as addressing “known methods that might allow the attacker to maintain persistence and regain control of the account later”. Its sequence starts with disabling the account and revoking sessions, before reviewing MFA methods, app consents (how consent phishing works), admin roles and forwarding. The compromised Microsoft 365 account checklist sets out those steps.
Where a rule involved payment conversations, Scamwatch’s business email compromise guidance describes contacting businesses by phone using a number sourced independently. Business email compromise explained covers that type of fraud, and the payment controls official guidance describes for payment redirection fraud covers checking changed bank details. The guide to where to report scams and cybercrime in Australia lists the reporting services.
Common questions
How do I check for suspicious inbox rules in Microsoft 365?
Microsoft’s compromised-account guide describes checking with Exchange Online PowerShell: Get-InboxRule with the -IncludeHidden parameter lists every rule, including hidden ones, and Get-Mailbox shows mailbox forwarding. Microsoft says values in RedirectTo, ForwardTo or ForwardAsAttachmentTo mean messages are redirected or forwarded. The guide also covers the audit log and message trace. How to list a mailbox’s forwarding and rules has Microsoft’s commands.
What does a suspicious inbox rule look like?
Microsoft’s examples include rules that automatically forward email to unknown addresses, and rules that move messages to the Notes, Junk Email or RSS Subscriptions folders. Microsoft lists these alongside other possible signs of compromise, such as recently added external forwarding, missing email, suspicious messages in Sent Items and unexplained lockouts. What Microsoft lists as signs of compromise has the full list.
What do I do if I find a forwarding rule I don’t recognise?
ASIC’s guidance for scammed businesses says to “delete any forwarding rules you don’t recognise.” Microsoft’s guide treats a malicious rule as part of a wider incident, with steps that start with disabling the account and revoking sessions, then reviewing MFA methods, app consents, admin roles and forwarding. Why a rule is treated as part of a wider incident links to the full checklist and reporting services.
How do I block automatic forwarding to external addresses?
Microsoft explains that the outbound spam filter policy controls automatic external forwarding, with values of Automatic (the default), On and Off. Because Automatic can behave differently by organisation, Microsoft’s documentation says to configure On or Off instead. The setting is in the Defender portal under Threat policies > Anti-spam > Anti-spam outbound policy. How to find the automatic forwarding setting has Microsoft’s steps.
What does “5.7.520 Access denied” mean in Microsoft 365?
Microsoft states that when the outbound spam policy blocks automatic external forwarding, the sender receives a bounce message containing “5.7.520 Access denied, Your organization does not allow external forwarding.” Forwarding between internal users isn’t affected by this policy. Microsoft also describes remote domains and mail flow rules that can block forwarding, noting the block typically wins. See automatic external forwarding.