A temporary email-forwarding arrangement can outlive the reason it was created. A staff member returns from leave, an outsourced service changes, or a personal address remains in a rule nobody reviews. An unexpected forwarding destination can also be a sign of account compromise. The right response begins by establishing what is configured and why, rather than assuming every forward is harmless or malicious.

For Microsoft 365 businesses, checking one Outlook screen is not a complete review. The forwarding setting, Inbox rules and the controls that allow or block external forwarding need to be examined together by an authorised administrator.

The image illustrates a mail-routing review; it is not a Microsoft administration screenshot or evidence from a customer tenant.

Distinguish the forwarding routes

Microsoft documents automatic forwarding through user-created Inbox rules and administrator-configured mailbox forwarding. These are different places to inspect. An internal destination and an address outside the organisation also have different implications for access and information handling.

The mailbox-forwarding guidance explains the administrator setting, including the option to retain a copy. A retained mailbox copy does not mean another copy stayed inside the business. Ask where the message goes, not only whether the original user can still see it.

Do not treat “Automatic” as proof of your intended policy

Microsoft's current external-forwarding guidance says the behaviour of Automatic – System-controlled can differ between organisations because of historical use. It recommends choosing an explicit On or Off setting instead of relying on that ambiguity. Establish the intended policy and confirm which policy actually applies to the mailbox.

The same guidance explains that outbound spam policies control automatic forwarding to external recipients, while internal automatic forwarding is not affected. Remote-domain settings and mail-flow rules can introduce additional restrictions; a blocking setting typically takes precedence over a setting that allows forwarding. A visible rule alone therefore does not establish whether messages are leaving.

Begin with an authorised, read-only inventory

Use your Microsoft 365 administration and support process to record the current arrangement before approving changes. Review the relevant mailboxes and their rules, then classify each destination as internal, approved external, unknown or obsolete.

  • Who owns the mailbox, and which department depends on it?
  • What destination is configured, and who controls that address?
  • Is there a written business reason and a person who approved it?
  • Is forwarding temporary, and when should it be reviewed or removed?
  • Which effective policies and additional routing controls affect it?
  • What evidence is available about recent activity and configuration changes?

Include authorised checks for relevant Inbox rules, not just the main mailbox setting. Record the configuration and timestamps needed for the review without copying complete customer messages into a general support spreadsheet.

Handle approved integrations as exceptions with an owner

A legitimate workflow may send messages to an external ticketing or processing service. That requirement needs a defined receiving organisation, authorised destination, operational owner and review date. “It was already there” is not a sufficient reason to keep it.

If an exception is necessary, have the administrator assess the narrowest appropriate scope and any other controls involved. Avoid enabling external forwarding broadly just to make one workflow function. If you are unsure how an arrangement fits the current configuration, request a Microsoft 365 Forwarding Review before changing the organisation-wide policy.

Investigate an unknown destination as a possible incident

An unexplained rule should prompt a security review, particularly when it coincides with unusual sign-ins, account changes or reported invoice fraud. Microsoft's compromised-account response guidance covers a wider response than removing a rule: account access and unauthorised changes also need attention.

Preserve relevant configuration and audit evidence as part of prompt containment; do not delay urgent containment merely to complete a document. Let the responsible administrator coordinate identity checks, session or access action and recovery. Removing forwarding does not undo messages already sent, and it does not prove that every other unauthorised access route has been closed.

Escalate any suspected disclosure through the business's incident process. Decide who can communicate with affected parties and what specialist advice is needed rather than asking individual users to investigate each other's mailboxes.

Test the intended outcome without exposing real information

After an approved change, use a benign test and a destination the business is authorised to test. Record the source, destination, time and expected result. Confirm the observed mail flow with the administrator instead of relying only on a screenshot of a setting.

If forwarding fails with an external-forwarding policy error, investigate the effective restriction. A delivery failure is not, by itself, a reason to relax security across the tenant. Conversely, a successful test to one destination does not prove all other routes are controlled.

Document what the test covered. Automatic-forwarding controls are not a complete data-loss-prevention system and do not establish that a user cannot manually send information elsewhere. Other sharing, application and access paths require their own review.

Close the loop when staff or suppliers change

Keep an exception register with the purpose, approver, destination owner and review date. Revisit it during supplier changes and employee offboarding. A replacement mailbox or new support platform should trigger a review of the old route, not simply another forwarding rule.

A useful completion record states which routes were found, which remain approved, what was removed, how the intended behaviour was checked and what still needs investigation. That gives the next administrator a workable starting point.

Request a Microsoft 365 Forwarding Review

ITZ can help review mailbox forwarding, relevant rules and administration responsibilities within an agreed Microsoft 365 support scope. Share the business issue, affected mailbox types and any known approved integration. Request a Microsoft 365 Forwarding Review; do not include passwords, recovery codes or customer email contents in the enquiry.