What automatic forwarding is — and is not
In Microsoft 365 two layers are often mixed up:
- Inbox rule (Outlook / Exchange Online): the user (or someone with mailbox access) creates a rule that Forwards or Redirects messages to an external address — often a personal Gmail. Redirect keeps the original sender; Forward sends on from the mailbox. Both can stay invisible for months if nobody reviews rules.
- Tenant / remote domain (AutoForwardEnabled): at organisation level you decide whether automatic forwards to external domains are allowed at all. If that is open, user rules to the outside work; if it is closed, external auto-forward fails unless you make an exception.
That is different from manually forwarding one message, or a delegated mailbox you set up on purpose. The topic is silent, ongoing copies leaving the organisation.
Why an SME should block it
Three practical reasons. Exfiltration after phishing: whoever takes over a mailbox often creates a forward rule to their own address within minutes — and hides or deletes the visible trail. Leavers: a colleague who still forwards to a private address keeps receiving mail after you think access is closed — see also the joiner and leaver checklist and inactive accounts. Silent copy: “I forward everything to my Gmail so I can read on the road” is understandable, but puts business mail outside your tenant, outside your retention and outside multifactor authentication (MFA) on your tenant — see turning on MFA in Microsoft 365.
Mail authentication (SPF, DKIM and DMARC) protects against spoofing of your domain; it does not stop outbound forward from a legitimate mailbox. Those two sit side by side, not instead of each other.
What you should decide in writing
Keep it short enough to decide this quarter:
- default: external auto-forward blocked (remote domain / outbound controls);
- exceptions: only by name (mailbox or domain), with owner, reason and end date;
- who may request an exception (director, HR, or a fixed contact) and who approves;
- try alternatives first: shared mailbox, guest access, or the app on the business account — not “everything to private”;
- review: walk the allow-list every quarter; on offboarding check every forward rule on that mailbox;
- Secure Score / hygiene: treat forward blocking as a fixed item next to MFA and account review.
Write those points on one page. That is your anti-forward policy; the tenant follows that text.
What Floor ICT configures — and what you decide
In the Microsoft 365 tenant we typically: set Remote domain / AutoForward so external auto-forward is off by default; apply Outbound spam and Transport-related controls that limit or signal suspicious forwards; alert or periodically report on existing inbox rules with external Forward/Redirect; and clean known rules after your approval. We tie this to joiner/leaver so leavers do not leave silent forwards behind.
You still decide: whether the default is truly “block everything”; which partners or scenarios deserve an exception; how long it lasts; and whether a shared mailbox or guest account is the better answer. Technical switches without ownership do not fix “someone has forwarded to private for a year”; policy without execution does not either.
More depth
Checklist for SME directors
1) Decide: external auto-forward off by default. 2) Inventory existing Forward/Redirect rules. 3) Clean unwanted rules after approval. 4) Put exceptions on name with an end date. 5) Tie offboarding to a rule check. 6) Review the allow-list every quarter.
Forward versus Redirect
Forward sends on from the mailbox (the recipient often sees a forward). Redirect keeps the original sender visible to the external recipient. Both can move data outside the tenant; both belong in the same block-and-review approach.
Exception — or better a shared mailbox?
A partner who “needs everything from invoices@” is often better served with Full Access on a shared mailbox or with a guest account — not a permanent forward to a personal address. Floor ICT helps pick the right pattern after you have written down the goal.