Automatic Forwarding - Block

This transport rule blocks automatic email forwarding to external recipients. Enabling this rule helps prevent data exfiltration and reduces the risk of sensitive information being sent outside the organization without authorization.

Settings this baseline controls

Setting	What it does
Rule name	The name of the transport rule. Learn more
Rule enabled	Whether the rule is enabled or disabled. Learn more
Matched message type	The type of message to match (e.g., AutoForward). Learn more
Sender location	The scope of the sender (e.g., InOrganization). Learn more
Recipient location	The scope of the recipient (e.g., NotInOrganization). Learn more
Rejection status code	The enhanced status code for rejected messages. Learn more
Rejection explanation text	The text displayed to users when the message is rejected. Learn more
Excluded recipients	Exceptions for specific recipients. Learn more

3 more settings

Setting	What it does
Excluded recipient domains	Exceptions for specific recipient domains. Learn more
Incident report recipient	Email address to send incident reports to. Learn more
Rule priority	The priority of the rule. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

Add this baseline to the tenant to stop internal mailboxes automatically forwarding mail to an external address, or bundle it into a scheme you deploy to many tenants at once.

1. Add the baseline.

   Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).

2. Turn the rule on.

   Set Rule enabled to on.

3. Leave the scope as sender inside, recipient outside.

   Leave Sender location set to InOrganization, Recipient location set to NotInOrganization, and Matched message type set to AutoForward. This catches only automatic forwarding (a mailbox forwarding rule or an admin-set forwarding address), not someone forwarding or replying to a message by hand.

4. Leave the rejection message as-is.

   Leave Rejection status code at 5.7.1 and Rejection explanation text at Delivery Not Authorized, Message Refused, so a blocked sender gets a clear, standard bounce rather than a silent drop.

5. Save.

   Turn on Auto-remediation (Remediation) if you want Octiga to recreate the rule whenever it’s disabled or removed. Existing automatic forwards to external addresses stop working as soon as the rule is enabled.

Caution

Before you enforce the rule, check the Auto forwarded messages report in the Exchange admin centre for anyone already forwarding externally. A legitimate vendor integration, or a user forwarding to a personal address, stops working as soon as the rule takes effect, and the sender gets a bounce rather than a silent failure.

Check it worked

Passing means a mail flow rule named Automatic Forwarding - Block exists and is enabled. You can confirm it in the Exchange admin centre under Mail flow → Rules. When a user has a forwarding rule to an external address, the forwarded messages bounce back to the original sender with a non-delivery report instead of reaching the external address.

Standards this addresses

CISM365 6.2.1v8 3.3

NISTPR.DS-5SC-7AC-20

ISO 27001A.8.23A.8.24

GDPRArticle 32

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→