# Mail Auto Forwarding

> This setting controls whether users can automatically forward email to external recipients.

This setting controls whether users can automatically forward email to external recipients. Disabling auto-forwarding helps prevent data leaks and reduces the risk of attackers exfiltrating sensitive information by forwarding mail outside the organization.

## Settings this baseline controls

| Setting                      | What it does                                                                                                                                                                          |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Automatic forwarding enabled | Controls whether automatic forwarding to external recipients is allowed. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-remotedomain?view=exchange-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline stops mail being forwarded automatically to external addresses across the whole organisation.

1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. **Turn off automatic forwarding.** Set **Automatic forwarding enabled** off for the tenant's default remote domain. This stops automatically forwarded mail reaching any external address, whether it's set up by an inbox rule, a mailbox-level forwarding address or an admin-set redirect.
3. **Save.** Turn on **Auto-remediation** if you want Octiga to turn this back off whenever it's changed (see [Remediation](https://docs.octiga.io/baselines/remediation/)). Existing external auto-forwards stop working as soon as this takes effect.

> **Caution:** This blocks every route to automatic external forwarding for the tenant's default remote domain, including legitimate ones such as a user forwarding to a personal address or a workflow that depends on it. Check the Auto forwarded messages report in the Exchange admin centre first to see who's forwarding externally. Octiga also offers [Automatic Forwarding - Block](https://docs.octiga.io/baselines/email-security/auto-forward-block-transport-rule/), a mail flow rule that blocks the same behaviour a different way. You can use both, and a block from either one is enough to stop it.

## Check it worked

Passing means the tenant's default remote domain has automatic forwarding disallowed. Check it in the Exchange admin centre, under **Mail flow → Remote domains → Default**, in the email reply types settings. Mail a user auto-forwards to an external address no longer arrives there; Exchange rejects the forward instead.

## Standards this addresses

### CIS

- **M365 6.2.1** — CIS M365 Foundations Benchmark 6.2.1
- **v8 3.3** — CIS Controls v8 Safeguard 3.3

### NIST

- **PR.DS-5** — NIST CSF 2.0 PR.DS-5
- **SC-7** — NIST SP 800-53 SC-7
- **AC-20** — NIST SP 800-53 AC-20

### ISO 27001

- **A.8.23** — ISO/IEC 27001:2022 Annex A.8.23
- **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)