How to block external email forwarding in entire organization by allowing few exceptions

Question

How to block external email forwarding in entire organization by allowing few exceptions

Mani 476

Hello All,

I need some suggestion to get it fix, we want to block external email forwarding(Auto Forwarding to external senders) in entire organization level by allowing few exceptions.

Please suggest the best way for this

As per my research we can create new Anti Spam policy but it's not suggestable for my org.

0 comments

Answer accepted by question author

Andy David - MVP 160.3K MVP Volunteer Moderator

Yea you actually do not want to block auto forwarding in the outbound spam policy in your scenario.

Use the mail flow rule instead to block autoforwarding except for the allowed senders.

So in this example, you would block with the following sample rule

and add an exception for the senders ( or recipients). Hope that makes sense!

User's image

Mani 476 Reputation points

2025-07-29T18:37:56.62+00:00

Hello @Andy David - MVP ,

Need One more suggestion

Can we proceed with

Turn off the Auto forwarding in Anti-spam outbound policy (It is set to yes for us) and create a transport rule to allow few users/groups to enable email forwarding.
Andy David - MVP 160.3K Reputation points MVP Volunteer Moderator

2025-07-29T18:58:36.17+00:00

You want to leave that set to "On" and let the mail flow rules handle it
Mani 476 Reputation points

2025-08-08T17:01:08.4433333+00:00

@Andy David - MVP

Are there any additional properties need to be added to block email forwarding enabled by admin from Exchange/M365 admin center

As of now this rule is blocking emails with auto forward set by mailbox rules by users.
Andy David - MVP 160.3K Reputation points MVP Volunteer Moderator

2025-08-08T17:10:45.8433333+00:00

You cant block any set by an Admin. The assumption is that you meant to allow those
Mani 476 Reputation points

2025-08-14T20:40:00.3133333+00:00
Hello @Andy David - MVP

One last question,

I created rule and it's working as expected by blocking all rules set by users and allowing email forwarding enabled by admins and i have one more requirement as below,

Please check once and suggest if it is possible by transport rules or we need to create new anti-spam policy only

Block auto-forwarding to external recipients by default.

Allow forwarding only for users in the ******@domain.com group.

And only allow those in the group to auto forward to Permitted exceptions:

Specific external domains (e.g., partnerdomain.com)

Specific external addresses (e.g., ******@externalvendor.net)

1 additional answer

Your answer

Mani 476 Reputation points

2025-07-29T18:37:56.62+00:00

Hello @Andy David - MVP ,

Need One more suggestion

Can we proceed with

Turn off the Auto forwarding in Anti-spam outbound policy (It is set to yes for us) and create a transport rule to allow few users/groups to enable email forwarding.
Andy David - MVP 160.3K Reputation points MVP Volunteer Moderator

2025-07-29T18:58:36.17+00:00

You want to leave that set to "On" and let the mail flow rules handle it
Mani 476 Reputation points

2025-08-08T17:01:08.4433333+00:00

@Andy David - MVP

Are there any additional properties need to be added to block email forwarding enabled by admin from Exchange/M365 admin center

As of now this rule is blocking emails with auto forward set by mailbox rules by users.
Andy David - MVP 160.3K Reputation points MVP Volunteer Moderator

2025-08-08T17:10:45.8433333+00:00

You cant block any set by an Admin. The assumption is that you meant to allow those
Mani 476 Reputation points

2025-08-14T20:40:00.3133333+00:00

Hello @Andy David - MVP

One last question,

I created rule and it's working as expected by blocking all rules set by users and allowing email forwarding enabled by admins and i have one more requirement as below,

Please check once and suggest if it is possible by transport rules or we need to create new anti-spam policy only

Block auto-forwarding to external recipients by default.

Allow forwarding only for users in the ******@domain.com group.

And only allow those in the group to auto forward to Permitted exceptions:

Specific external domains (e.g., partnerdomain.com)

Specific external addresses (e.g., ******@externalvendor.net)

Answer 1

Andy David - MVP 160.3K MVP Volunteer Moderator

Use a transport rule and set an exception for those that are allowed.

https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding#how-to-find-users-that-are-automatically-forwarding

Mani 476

Hello @Andy David

Can I follow the below steps- Not sure if this rule setup will work

Step 1: Block External Forwarding Globally

Access Microsoft 365 Defender Portal:

Go to the Microsoft 365 Defender portal: https://security.microsoft.com.

Navigate to Policies & Rules > Threat Policies > Anti-spam policies.

Modify Outbound Spam Filter Policy:

- Under **Outbound spam filter policy**, edit the default policy or create a new one.

   - Set the option **Outbound spam filter policy > Automatic forwarding** to **On - Forwarding is disabled**. This blocks automatic external forwarding for all users in your organization.

   **Save the Policy**:

      - Save the changes to enforce the policy across your organization.

Step 2: Allow Exceptions for Specific Users or Groups

To allow specific users or groups to forward emails externally, you can create a Mail Flow Rule in the Exchange Admin Center (EAC).

Access Exchange Admin Center:

Go to the Exchange Admin Center: https://admin.exchange.microsoft.com.

Create a New Mail Flow Rule:

  - Navigate to **Mail flow** > **Rules**.
  
     - Click on **+ Add a rule** and select **Create a new rule**.
     
     **Configure the Rule**:
     
        - **Name**: Provide a meaningful name like "Allow External Forwarding for Specific Users".
        
           - **Apply this rule if**: Select **The sender is** and specify the users or groups you want to allow external forwarding for.
           
              - **Do the following**: Select **Set the spam confidence level (SCL)** and set it to **Bypass spam filtering**.
              
                 - **Stop processing more rules**: Enable this option to ensure the rule applies only to the specified users/groups.

Save the Rule:
- Save the rule and ensure it is enabled.