This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 81%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EK%3C/text%3E%3C/svg%3E)
When we receive "Creation of forwarding/redirect rule" alerts from the Microsoft 365 Security Center, there is a link in the message that takes us to a list of all similar events. The list is interactive, and additional details can be gleaned from each item. Historically, these details would include the mailbox where the messages are being forwarded, as well is any additional components of the rule, such as if the rule was conditional or was being applied to all messages. In recent weeks, the event details are more limited and does not contain the specific details that I previously mentioned. Is there some way to capture these details within M365's various admin centers?
Thanks,
JJ
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 98%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERM%3C/text%3E%3C/svg%3E)
I have spent a larger amount of tme than I want to chasing down forwarding email alerts that then dont show up in Defender, so if anyone knows I'd appreciate it.
You can view in the insights menu. Click on the entries to view more details.
https://admin.exchange.microsoft.com/#/reports/autoforwardedmessages
Thank you, Andy. That certainly does show individual messages that are being autoforwarded to addresses outside of our Microsoft tenant. What I would rather see are details on the forwarding rule itself. This would tell us preemptively where the rule would forward messages, whether inside or outside of our tenant. That way, we would not have to wait until messages actually start flowing.
For reference, the View Alerts page is found at https://security.microsoft.com/viewalertsv2. Clicking on one of the "Creation of forwarding/redirect rule" alerts brings up a pane where I can select "View activity list". From there, I can select the hyperlink of one of the individual events. This is where the details of the event have become less complete over the last few weeks.
Thanks again,
JJ
If you click on the forwarding mailbox name there is more detail such as the rule itself, number of times its forwarded, etc...
Andy, you are still referencing the "Auto forwarded messages" page (https://admin.exchange.microsoft.com/#/reports/autoforwardedmessages), correct? I am more interested in reviewing the forwarding rule immediately after it is created rather than reviewing the messages after they start getting forwarded.
Thanks,
JJ
Ok, understood. Question: Do you block autoforwarding to external domains?
Andy, our current approach is to monitor rather than block.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 87%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERB%3C/text%3E%3C/svg%3E)
I`m also experiencing the same behaviour. I click on the link provided and it tells me "Either what you are looking for doesn't exist or you need to use a different search string."
Ok, gotcha, I dont think there are any other 365 portal menus that can help you here but consider looking at these options as well if you arent getting the info you need: (If you havent already)