My anti-spam policy to allow external email forwarding doesn't work

GraemeG-3877 60 Reputation points
2026-08-11T21:00:02.2+00:00

I've read all the documentation (Configure outbound spam policies for cloud mailboxes) and configured a policy in Defender to allow external forwarding. It is currently set for just a single user. I set that user email account to forward to its current email address, in Exchange.

Every time I test it I get an Undeliverable response that says "Policy violation or system error."

I want to get it working before adding more users so that they receive the "Get Started with Microsoft 365" emails at their current email addresses.

Here's how the policy looks (sorry about the font size -- it's a straight cut and paste):

Protection settings__

Restrict sending to external recipients (per hour)

1000

Restrict sending to internal recipients (per hour)

1000

Maximum recipient limit per day

10000

Over limit action

No action, alert only

Automatic forwarding

On - Forwarding is enabled

Send a copy of suspicious outbound messages or message that exceed these limits to these users and groups

Off

Notify these users and groups if a sender is blocked due to sending outbound spam

On

Microsoft Security | Microsoft Defender | Microsoft Defender for Office 365
Answer accepted by question author

AI answer

2026-08-11T21:00:29.3933333+00:00

For this scenario, the most likely issue is that the forwarding setting is allowed in the outbound spam policy, but another control is still blocking the message.

Use this validation path:

  1. Verify the mailbox forwarding itself in Exchange Online. In the Exchange admin center, go to Recipients > Mailboxes > select the mailbox > Mailbox > Email forwarding.
    • Turn on Forward all emails sent to this mailbox.
    • Confirm the external forwarding address is correct.
    • Optionally enable Deliver message to both forwarding address and mailbox if a local copy is needed.
  2. Confirm the outbound spam policy is actually applied to that mailbox. A custom outbound spam policy must target the specific sender on the Users, groups, and domains page. If the mailbox is not in scope, the default policy applies instead.
  3. Check whether a higher-priority anti-spam policy is overriding the custom policy. Anti-spam policies use first-match processing. If the mailbox is included in Strict preset security policy or Standard preset security policy, those settings take precedence and custom policy settings are ignored.
    • In the Microsoft Defender portal, check Preset security policies.
    • Compare the affected mailbox against the users, groups, or domains included there.
    • If needed, exclude that mailbox from the preset policy so the custom outbound spam policy can apply.
  4. If the message is being blocked as automatic forwarding, check the NDR text. When outbound spam filtering blocks automatic forwarding, the NDR contains: 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)
  5. If policy edits fail or do not seem to stick, check for RBAC issues. If policy changes fail with 403 or CmdletAccessDeniedException even after permissions are verified, the documented cause can be an Exchange Online RBAC configuration issue that requires a backend RBAC configuration refresh through Microsoft Support.

Important behavior to account for:

  • Automatic forwarding = On - Forwarding is enabled in the outbound spam policy allows forwarding at that layer.
  • That does not guarantee delivery if another policy still blocks it.
  • Microsoft recommends Off - Forwarding is disabled as the secure baseline, so forwarding must be explicitly allowed only where needed.

Also note:

  • For internal senders, an NDR is generated only when the forwarding method is mailbox forwarding.
  • If the forwarding method is an Inbox rule, an NDR is not generated for internal senders.

Given the symptoms, the highest-probability cause is policy precedence: the mailbox is still covered by a preset security policy or another first-match anti-spam policy, so the custom outbound policy that enables forwarding is not the one being enforced.

AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.