Most business owners do not realise their emails are being copied to a third party until a client calls to ask why their bank details have changed. Automatic email forwarding is one of the first things a criminal sets up after gaining access to a staff member's mailbox. It allows them to sit silently in the background, reading every incoming message without ever having to log in again. By the time you notice, the data has been exfiltrated and the invoices have been intercepted.
Stopping email forwarding to external addresses is one of the most effective ways to break the chain of a Business Email Compromise (BEC) attack. It ensures that even if an account is breached, the attacker cannot easily set up a permanent, invisible 'tap' on your communications.
What external email forwarding actually means
External email forwarding is a setting or a rule that automatically sends a copy of any email arriving in a business mailbox to an address outside of your organisation. This is usually a personal Gmail, Outlook, or Yahoo account. There are two ways this happens: a user sets it up because they want to check their work mail from a personal phone (which is a bad idea for other reasons), or an attacker sets it up via a hidden rule.
Unlike a manual forward where you click a button, these rules are automated. They happen at the server level, often before the user even sees the email in their inbox. In a security context, we distinguish between internal forwarding (e.g., sending mail from 'info@' to 'sales@') and external forwarding. The latter is where the risk lives. If your data leaves your managed environment and lands in a personal inbox, you have lost control over who sees it, where it is stored, and whether it is ever deleted.
The commercial cost of a silent forwarder
When an attacker redirects your mail, they are not looking for your lunch orders. They are looking for patterns. They watch how you speak to your suppliers, they wait for a large invoice to be sent, and then they pounce. This is known as phishing and invoice fraud. They will send a follow-up email from a lookalike domain, referencing the real invoice the victim just received, and claim that your bank details have changed due to an audit. Because they have been reading the forwarder for weeks, they know exactly who to contact and what tone to use.
Beyond fraud, there is the regulatory impact. Under UK GDPR, your business is responsible for the personal data it holds. If an employee's mailbox is forwarding every client email to a personal account, and that personal account is later compromised, you have a data breach on your hands. The ICO takes a dim view of organisations that allow data to leak out of their controlled environment via simple, preventable settings like automatic forwarding.
For a typical UK firm with 25 staff, a single intercepted invoice of £15,000 can be enough to wipe out the month's profit. The time spent by management unpicking the fraud, notifying the bank, and trying to recover the funds often exceeds 40 hours of senior staff time. At an internal cost of £50 per hour, that is another £2,000 in lost productivity before you even consider the reputational damage.
How to block external forwarding in Microsoft 365
Microsoft has made this easier in recent years by introducing the outbound spam policy. This is the global 'off' switch. Previously, you had to mess around with complex transport rules, but now it is a standard security feature in the Microsoft 365 Defender portal.
- Log into the Microsoft Defender portal (security.microsoft.com).
- Navigate to Email & collaboration and then Policies & rules.
- Select Threat policies.
- Under the Policies section, click on Anti-spam.
- You will see a policy named Anti-spam outbound policy (Default). Click on this.
- In the flyout menu, click Edit protection settings at the bottom.
- Look for the section titled Forwarding rules. You will see a dropdown for Automatic forwarding rules.
- Change the setting from 'Automatic - System-controlled' to Off - Forwarding is disabled.
- Click Save.
A pattern we see on most tenants we take on is finding legacy forwarding rules hidden in the mailboxes of former employees, often set up years ago for a legitimate reason but now serving as a potential back door. Changing this setting to 'Off' globally will immediately break those links. Any email that tries to auto-forward externally will now be 'bounced', and the sender will receive a Non-Delivery Report (NDR) stating that the message could not be delivered because the organisation does not allow external forwarding.
Finding existing rules before they do damage
Turning off the global switch prevents future leaks, but it does not tell you who was already forwarding mail. You need to audit your environment to see if any rules are currently active. Attackers are clever; they often name their rules something boring like 'RSS' or 'Archive' to hide them from a casual glance at the user's Outlook settings.
We recommend running a report via the Exchange Admin Centre or using PowerShell to list all mailboxes with forwarding enabled. This allows you to see the destination addresses. If you see a staff member forwarding to an address you do not recognise, or a personal address you did not authorise, that account needs to be treated as potentially compromised. You should immediately reset the password, revoke all active sessions, and check for other signs of a breach, such as new MFA devices or unusual login locations.
If you are unsure where to start with this audit, we offer a Microsoft 365 security review that looks at these rules as part of a wider health check. It is often the quickest way to find out if your data is already being quietly copied elsewhere.
Managing legitimate exceptions
Sometimes, there is a genuine business reason to forward mail externally. Perhaps you use a third-party ticketing system that requires mail to be sent to a specific external address, or you have a dedicated service provider that needs copies of certain alerts.
Do not just turn the global policy back on to allow these. Instead, create a specific outbound spam policy for just those users or mailboxes.
- In the same Anti-spam section of the Defender portal, click Create policy and select Outbound.
- Name it something clear, like 'Legitimate External Forwarders'.
- In the Users section, add only the specific mailboxes that require the exception.
- In the Protection settings, set Automatic forwarding rules to On - Forwarding is enabled.
- Ensure this policy has a higher priority (a lower number) than your default 'Off' policy.
This approach follows the principle of least privilege. You are not opening the door for the whole company; you are just opening a small, monitored window for a specific purpose. We also handle hardware, broadband, mobile and networking, not just security, and we often find that these exceptions are better handled via professional integrations or shared mailboxes rather than simple forwarding rules.
Common mistakes we see in the field
- Relying on the 'System-controlled' default: Microsoft's default setting can change. At various times, it has allowed forwarding if it thinks the mail is not spam. Do not leave it to chance; explicitly set it to 'Off'.
- Ignoring the NDR alerts: When you turn off forwarding, legitimate users who were doing it will get error messages. If your helpdesk ignores these, they might be tempted to 'just turn it back on' to stop the tickets, without checking why the user was doing it in the first place.
- Forgetting about 'Inbox Rules': There are two ways to forward. One is a mailbox setting, the other is an 'Inbox Rule' created by the user in Outlook. The outbound spam policy catches both, but when auditing, make sure you are looking for both types of configuration.
- Not checking leavers: We frequently find that when people leave, their mailboxes are kept active for a few months. If that user had a forwarder to their personal account, your business data is still going to them long after they have left the building.
How Black Sheep Support helps
Securing a Microsoft 365 tenant is not a one-time job. Settings drift, new features are added, and attackers find new ways to bypass old defences. We manage this for our clients every day, ensuring that 'hidden' risks like external forwarding are identified and neutralised before they lead to a financial loss.
If you are worried that your email configuration might be leaking data
and we will help you understand how to lock down your environment without breaking your workflow.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture: 30 to 60 minutes with one of our engineers, or 15 to 20 minutes on your own, no commitment.
FAQ
Can I still forward emails manually if I disable automatic forwarding?
Yes. Disabling automatic forwarding only stops rules that happen without user intervention. You and your staff can still click 'Forward' on an individual email and send it to an external address as normal. This does not affect daily manual operations.
Will this stop my out-of-office replies from working?
No. Out-of-office (Automatic Replies) are handled differently by Microsoft 365. Disabling external forwarding will not prevent your staff from sending automated 'I am on holiday' messages to people outside the business.
How do I know if someone is already forwarding my mail?
You can run a 'Forwarding report' in the Exchange Admin Centre. This lists every mailbox that has an active forwarding address. If you see a Gmail or Outlook.com address you don't recognise, it is time to investigate that account for a breach.
Does this apply to Google Workspace too?
Yes, Google Workspace has a similar setting in the Admin Console under Gmail settings. It is just as important to disable it there. If you use Google, we can help with Google Workspace management to ensure these policies are enforced across your estate.
Want this handled for you? See Cyber security services.
Based in Brighton or Hove? We are too: see IT support in Brighton.
