The settingWhat we hold this to
CreativeTechs minimum
Outbound anti-spam policy AutoForwardingMode = Off for every policy including Default. A transport rule blocking external redirect. Zero mailboxes with ForwardingSmtpAddress set to an external domain, except those carrying a recorded exception.
Benchmark position
CISA MS.EXO.1.1 — automatic forwarding to external domains SHALL be disabled. Same target; no gap.
Where the switch is
Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam → Anti-spam outbound policy → Automatic forwarding rules = Off. Transport rule: Exchange admin centre → Mail flow → Rules.
How to verify
Get-HostedOutboundSpamFilterPolicy | fl Name,AutoForwardingMode # expect Off
Get-Mailbox -ResultSize Unlimited | ? {$_.ForwardingSmtpAddress} | fl Name,ForwardingSmtpAddress- Why it matters
- The standard business-email-compromise persistence move: set a forward, then keep reading mail long after the password reset.
- How we check
- Secure Score mdo_blockmailforward and mdo_autoforwardingmode. CISA.MS.EXO.1.1.
- Fix — M365
- Exchange → anti-spam outbound policy → automatic forwarding = Off. Add a transport rule to catch redirects.
- Fix — Google
- Admin → Gmail → Routing → disable automatic forwarding.
- User notices
- Breaks any legitimate forward to a personal address or an outside partner — and there is usually one.
- Expected pushback
- Occasionally real: someone forwards to a bookkeeper. Scoped exception, not a tenant-wide off. Audit existing forwards before flipping.