# Automatic Forwarding - Block > This transport rule blocks automatic email forwarding to external recipients. This transport rule blocks automatic email forwarding to external recipients. Enabling this rule helps prevent data exfiltration and reduces the risk of sensitive information being sent outside the organization without authorization. ## Settings this baseline controls | Setting | What it does | | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Rule name | The name of the transport rule. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps) | | Rule enabled | Whether the rule is enabled or disabled. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps) | | Matched message type | The type of message to match (e.g., AutoForward). [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps) | | Sender location | The scope of the sender (e.g., InOrganization). [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps) | | Recipient location | The scope of the recipient (e.g., NotInOrganization). [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps) | | Rejection status code | The enhanced status code for rejected messages. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps) | | Rejection explanation text | The text displayed to users when the message is rejected. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps) | | Excluded recipients | Exceptions for specific recipients. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps) | **3 more settings** | Setting | What it does | | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | Excluded recipient domains | Exceptions for specific recipient domains. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps) | | Incident report recipient | Email address to send incident reports to. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps) | | Rule priority | The priority of the rule. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/new-transportrule?view=exchange-ps) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this baseline to the tenant to stop internal mailboxes automatically forwarding mail to an external address, or bundle it into a scheme you deploy to many tenants at once. 1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. **Turn the rule on.** Set **Rule enabled** to on. 3. **Leave the scope as sender inside, recipient outside.** Leave **Sender location** set to `InOrganization`, **Recipient location** set to `NotInOrganization`, and **Matched message type** set to `AutoForward`. This catches only automatic forwarding (a mailbox forwarding rule or an admin-set forwarding address), not someone forwarding or replying to a message by hand. 4. **Leave the rejection message as-is.** Leave **Rejection status code** at `5.7.1` and **Rejection explanation text** at `Delivery Not Authorized, Message Refused`, so a blocked sender gets a clear, standard bounce rather than a silent drop. 5. **Save.** Turn on **Auto-remediation** ([Remediation](https://docs.octiga.io/baselines/remediation/)) if you want Octiga to recreate the rule whenever it's disabled or removed. Existing automatic forwards to external addresses stop working as soon as the rule is enabled. > **Caution:** Before you enforce the rule, check the Auto forwarded messages report in the Exchange admin centre for anyone already forwarding externally. A legitimate vendor integration, or a user forwarding to a personal address, stops working as soon as the rule takes effect, and the sender gets a bounce rather than a silent failure. ## Check it worked Passing means a mail flow rule named **Automatic Forwarding - Block** exists and is enabled. You can confirm it in the Exchange admin centre under **Mail flow → Rules**. When a user has a forwarding rule to an external address, the forwarded messages bounce back to the original sender with a non-delivery report instead of reaching the external address. ## Standards this addresses ### CIS - **M365 6.2.1** — CIS M365 Foundations Benchmark 6.2.1 - **v8 3.3** — CIS Controls v8 Safeguard 3.3 ### NIST - **PR.DS-5** — NIST CSF 2.0 PR.DS-5 - **SC-7** — NIST SP 800-53 SC-7 - **AC-20** — NIST SP 800-53 AC-20 ### ISO 27001 - **A.8.23** — ISO/IEC 27001:2022 Annex A.8.23 - **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)