Microsoft 365 Email Forwarding Rules Audit: How to Find Hidden Auto-Forward Rules Set by Compromised Accounts or Insider Threats

Microsoft 365 stores email forwarding configurations in three distinct locations, each requiring different tools to enumerate:

1. Inbox Rules (Exchange Online): Stored per-mailbox, managed via Get-InboxRule. These are the rules a user creates in Outlook or OWA under Settings > Rules. They can forward, redirect, or delete messages matching specific criteria.

2. OWA / Outlook on the Web Rules: Also stored per-mailbox, but created specifically through the OWA interface. In older Exchange environments, these were stored separately from MAPI inbox rules and could not be seen via Get-InboxRule in certain configurations. In modern Exchange Online, they share the same store, but the forwarding address configuration differs.

3. Exchange Transport Rules (Mail Flow Rules): Tenant-wide or scoped rules configured by admins at the organization level. Attackers who compromise a Global Admin or Exchange Admin account may create transport rules to silently BCC or redirect matching emails. These are more dangerous because they survive mailbox-level remediation and apply to multiple recipients.

A complete audit must check all three. Start with the Exchange Online PowerShell module.

Connect to Exchange Online PowerShell:

Install-Module -Name ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

Get all inbox rules for all mailboxes and filter for forwarding actions:

$allMailboxes = Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq 'UserMailbox'}

$forwardingRules = foreach ($mailbox in $allMailboxes) {
    Get-InboxRule -Mailbox $mailbox.Identity | Where-Object {
        $_.ForwardTo -ne $null -or
        $_.ForwardAsAttachmentTo -ne $null -or
        $_.RedirectTo -ne $null
    } | Select-Object @{N='Mailbox';E={$mailbox.UserPrincipalName}},
        Name, ForwardTo, ForwardAsAttachmentTo, RedirectTo, Enabled
}

$forwardingRules | Export-Csv -Path "forwarding_rules_audit.csv" -NoTypeInformation

For large tenants (1000+ mailboxes), throttle the loop to avoid hitting Exchange Online rate limits:

$i = 0
foreach ($mailbox in $allMailboxes) {
    if ($i++ % 50 -eq 0) { Start-Sleep -Seconds 2 }
    Get-InboxRule -Mailbox $mailbox.Identity | Where-Object { $_.ForwardTo -or $_.RedirectTo } |
    Select-Object @{N='Mailbox';E={$mailbox.UserPrincipalName}}, Name, ForwardTo, RedirectTo
}

Review the output for addresses outside your organization's accepted domains. Any forwarding to a Gmail, Yahoo, or unknown domain is an immediate high-priority finding.

Inbox rules are not the only forwarding mechanism. Exchange Online also supports direct mailbox-level forwarding via the ForwardingSmtpAddress and ForwardingAddress properties on the mailbox object. These do not appear in Get-InboxRule output.

Enumerate all mailboxes with external forwarding enabled:

Get-Mailbox -ResultSize Unlimited | Where-Object {
    $_.ForwardingSmtpAddress -ne $null -or
    $_.ForwardingAddress -ne $null
} | Select-Object UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward |
Export-Csv -Path "mailbox_forwarding_audit.csv" -NoTypeInformation

The DeliverToMailboxAndForward property is important. If this is $true, the original mailbox receives the email AND a copy goes to the forwarding address. Attackers prefer this setting because the user continues to receive their email normally, reducing the chance of discovery. If it is $false, email is redirected entirely and the user will notice missing emails.

To block forwarding address configuration at the mailbox level as a policy control:

Get-Mailbox -ResultSize Unlimited | Set-Mailbox -ForwardingSmtpAddress $null -DeliverToMailboxAndForward $false

Run this with caution in environments that use legitimate forwarding for shared mailboxes or CRM integrations. Audit first, then remediate selectively.

Transport rules operate at the organization level and require Exchange Admin or Global Admin to create. They are more dangerous than inbox rules because they can apply across all mailboxes and survive individual mailbox remediation.

Enumerate all transport rules with copy or redirect actions:

Get-TransportRule | Where-Object {
    $_.BlindCopyTo -ne $null -or
    $_.CopyTo -ne $null -or
    $_.RedirectMessageTo -ne $null -or
    $_.AddToRecipients -ne $null
} | Select-Object Name, BlindCopyTo, CopyTo, RedirectMessageTo, Priority, State |
Format-List

Look for rules that were created recently by accounts other than known admins. Check the creation date against your change management records:

Get-TransportRule | Select-Object Name, WhenChanged, WhenChangedUTC, ModifiedBy |
Sort-Object WhenChangedUTC -Descending | Format-Table -AutoSize

The ModifiedBy field shows which account last modified the rule. If you see a non-admin UPN that recently modified a transport rule, investigate immediately. This is a strong indicator of admin-level account compromise.

To block all auto-forwarding to external recipients at the transport layer (the recommended baseline control):

1. In the Microsoft 365 Defender portal, go to Email and collaboration > Policies and rules > Threat policies > Anti-spam
2. Open the default outbound spam policy
3. Set Automatic forwarding to Off (Forwarding is disabled)

One-time audits are not sufficient. Forwarding rules are often set within minutes of account compromise, faster than any manual detection cadence.

Enable Unified Audit Logging and alert on rule creation events. The key operation names to monitor in the audit log:

• New-InboxRule (forwarding rule created)
• Set-InboxRule (existing rule modified to add forwarding)
• Set-Mailbox (ForwardingSmtpAddress or ForwardingAddress changed)
• New-TransportRule (transport rule created)

Query the audit log via PowerShell:

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) `
    -Operations "New-InboxRule","Set-InboxRule" `
    -ResultSize 5000 |
Select-Object UserIds, CreationDate, Operations,
    @{N='RuleDetails';E={$_.AuditData | ConvertFrom-Json | Select-Object -ExpandProperty Parameters}} |
Export-Csv -Path "inbox_rule_events_30days.csv" -NoTypeInformation

In Microsoft Sentinel, use the OfficeActivity table:

OfficeActivity
| where Operation in ("New-InboxRule", "Set-InboxRule")
| where UserId !in~ (known_admin_accounts)
| extend RuleName = tostring(parse_json(Parameters)[0].Value)
| extend ForwardTo = tostring(parse_json(Parameters)[?Name == "ForwardTo"].Value)
| where ForwardTo !endswith "@yourdomain.com"
| project TimeGenerated, UserId, RuleName, ForwardTo, ClientIPAddress
| order by TimeGenerated desc

Alert on any rule creation that forwards to an external domain and was created outside business hours or from an IP not in your corporate egress range.