Mail Auto Forwarding

This setting controls whether users can automatically forward email to external recipients. Disabling auto-forwarding helps prevent data leaks and reduces the risk of attackers exfiltrating sensitive information by forwarding mail outside the organization.

Settings this baseline controls

Setting	What it does
Automatic forwarding enabled	Controls whether automatic forwarding to external recipients is allowed. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

This baseline stops mail being forwarded automatically to external addresses across the whole organisation.

1. Add the baseline.

   Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).

2. Turn off automatic forwarding.

   Set Automatic forwarding enabled off for the tenant’s default remote domain. This stops automatically forwarded mail reaching any external address, whether it’s set up by an inbox rule, a mailbox-level forwarding address or an admin-set redirect.

3. Save.

   Turn on Auto-remediation if you want Octiga to turn this back off whenever it’s changed (see Remediation). Existing external auto-forwards stop working as soon as this takes effect.

Caution

This blocks every route to automatic external forwarding for the tenant’s default remote domain, including legitimate ones such as a user forwarding to a personal address or a workflow that depends on it. Check the Auto forwarded messages report in the Exchange admin centre first to see who’s forwarding externally. Octiga also offers Automatic Forwarding - Block, a mail flow rule that blocks the same behaviour a different way. You can use both, and a block from either one is enough to stop it.

Check it worked

Passing means the tenant’s default remote domain has automatic forwarding disallowed. Check it in the Exchange admin centre, under Mail flow → Remote domains → Default, in the email reply types settings. Mail a user auto-forwards to an external address no longer arrives there; Exchange rejects the forward instead.

Standards this addresses

CISM365 6.2.1v8 3.3

NISTPR.DS-5SC-7AC-20

ISO 27001A.8.23A.8.24

GDPRArticle 32

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→