How to find hidden email forwarding rules in Microsoft 365

By Ed Dupuy, Sealbridge Security · Updated October 20, 2026

Why attackers use forwarding rules

Once a scammer has a password, they want to watch the closing without being noticed. A rule can forward every email that mentions "wire", "closing" or "payoff" to an outside address, or move replies from the real buyer into a folder nobody opens. The rule keeps working even after the password is changed, so removing it is part of every cleanup.

Rules like these often have short or meaningless names, such as a single period, so they're easy to overlook.

Step 1: Have each person check their own Outlook

This takes two minutes per person and needs no admin access.

1. Open Outlook on the web (outlook.office.com) and click the gear icon for Settings.
2. Go to Mail → Forwarding. Forwarding should be off unless you set it up on purpose.
3. Go to Mail → Rules. Look for any rule you didn't create, especially ones that forward, redirect, delete, or move messages to folders like Archive, RSS Feeds or Conversation History.

If anything looks unfamiliar, don't delete it yet. Take a screenshot and tell your administrator; see what to do if you find one.

Step 2: Check every mailbox's forwarding as an admin

In the Microsoft 365 admin center, go to Users → Active users, select a person, open the Mail tab and look at Email forwarding. Microsoft renames these menus from time to time, so the labels may differ slightly. (Microsoft: configure email forwarding)

For more than a few people, PowerShell is faster and also finds rules the admin center doesn't show. You'll need an Exchange admin account and the ExchangeOnlineManagement module.

Connect (run once per session)

Install-Module ExchangeOnlineManagement   # first time only
Connect-ExchangeOnline

Mailboxes with forwarding turned on

Get-EXOMailbox -ResultSize Unlimited -Properties ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward |
  Where-Object { $_.ForwardingAddress -or $_.ForwardingSmtpAddress } |
  Format-Table DisplayName,ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward

Step 3: List every inbox rule that forwards, deletes or moves mail

Get-EXOMailbox -ResultSize Unlimited | ForEach-Object {
  Get-InboxRule -Mailbox $_.UserPrincipalName -IncludeHidden |
    Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo -or $_.DeleteMessage -or $_.MoveToFolder } |
    Select-Object MailboxOwnerId,Name,Enabled,ForwardTo,ForwardAsAttachmentTo,RedirectTo,DeleteMessage,MoveToFolder
}

-IncludeHidden matters: it shows rules that don't appear in Outlook. Some hidden rules are normal system rules, so focus on any that send mail to an outside address or move mail somewhere unusual.

Also check organization-wide mail flow rules, which an attacker with admin access could add:

Get-TransportRule | Where-Object { $_.RedirectMessageTo -or $_.BlindCopyTo -or $_.CopyTo -or $_.AddToRecipients } |
  Format-Table Name,State,RedirectMessageTo,BlindCopyTo,CopyTo,AddToRecipients

Step 4: Turn off forwarding to outside addresses

Microsoft 365 can block automatic forwarding to external addresses for the whole organization. The default setting, "Automatic - System-controlled," behaves differently in different tenants, so Microsoft recommends choosing On or Off explicitly. (Microsoft: control automatic external email forwarding)

1. Open the Microsoft Defender portal (security.microsoft.com).
2. Go to Email & collaboration → Policies & rules → Threat policies → Anti-spam.
3. Open Anti-spam outbound policy (Default) and edit its protection settings.
4. Set Automatic forwarding rules to Off - Forwarding is disabled and save.

This stops both inbox-rule forwarding and mailbox forwarding to outside addresses. Forwarding between people inside your organization still works. If one person truly needs to forward outside, create a separate policy just for them rather than turning it back on for everyone.

Step 5: Make sure someone sees the alerts

Microsoft includes two default alert policies in many Microsoft 365 plans (Microsoft: alert policies):

• Creation of forwarding/redirect rule: someone created an inbox rule that forwards or redirects mail (informational).
• Suspicious email forwarding activity: a mailbox auto-forwarded email to a suspicious outside account (high).

In the Defender portal, under Policies & rules → Alert policy, check that these are on and that alert emails go to someone who reads them every business day.

If you find a rule you didn't create

1. Record it first. Screenshot or export the rule details. Your insurer and investigators will want them.
2. Lock the account. Reset the password, sign the user out of all sessions in the admin center, and remove any sign-in methods (phone numbers or authenticator apps) the user didn't add.
3. Remove the rule and any forwarding on the mailbox.
4. Look at what was exposed. Check sent items, deleted items and the sign-in log for the past few weeks.
5. Call everyone in open closings by phone to warn them that emails from that mailbox may have been fake, and re-verify any wiring instructions sent recently.

Using Google Workspace instead? Each person can check Gmail under Settings → See all settings → Forwarding and POP/IMAP and Filters and Blocked Addresses.

Sources

• Microsoft Learn, Control automatic external email forwarding in Microsoft 365
• Microsoft Learn, Alert policies in the Microsoft Defender portal
• Microsoft Learn, Configure email forwarding for a mailbox