How to allow external email forwarding in entire organization with conditions

Question

Hello All,

We are checking to block email forwarding to all with the below exemptions

1. User-Based Exceptions

Allow specific users to forward externally to any destination.

• Executives or Assistants: May need to forward to personal accounts or external consultants.
• Contractors or Vendors: Temporary access with forwarding needs.
• Support Teams: Forwarding to ticketing systems or external partners.

---

2. Destination-Based Exceptions

Allow forwarding to specific external domains or recipients.

• Trusted Partners: e.g., @partnercompany.com
• External Ticketing Systems: @ticketing.com

---

3. Combination of User + Destination

Allow forwarding only when both the user and the destination are approved.

• Example: Only ******@company.com can forward to ******@trustedpartner.com.

Please suggest the possible ways to get this done.

Answer 1

Hi @Mani

Thank you for reaching out via the Microsoft Q&A forum regarding this issue.

Based on your goal to block external email forwarding across the organization but still allow some specific exceptions, here’s a setup you might want to try: 

1. Disable External Forwarding 

To begin, you can turn off automatic external forwarding in your anti-spam policy: 

• In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-spam. 
• Click on the Anti-spam outbound policy. 
• Go to Outbound forwarding rules. 
• Under Automatic forwarding, set it to “Off” – this blocks all external forwarding. To allow exceptions, you must create a separate outbound spam policy where automatic forwarding is enabled for specific users. Mail flow rules do not override this setting. 

More details can be found here: Configuring and controlling external email forwarding in Microsoft 365 

2. Create Security Groups for Approved Users 

• Create a security group with users allowed to forward externally. 
• Maintain a list of trusted external domains. 

3. Configure Mail Flow Rules 

In Exchange Admin Center > Mail flow > Rules, create the following rules in this order: 

• Rule 1: Allow specific users to forward to specific external recipients 
• Rule 2: Allow members of the “ApprovedForwarders” group to forward to trusted domains 
• Rule 3: Block all other external auto-forwarding 

Make sure the rules are ordered in that sequence, so exceptions are processed before the default block applies. 

Important note: This approach should give you the flexibility you need to manage forwarding safely. However, if you've configured everything correctly and forwarding still doesn’t work as expected, it may be due to current platform limitations in Exchange Online. In that case, this would be the closest solution available at the moment. 

Feel free to test it out and let us know how it goes, we’re happy to help further if needed! 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

1.Use mail flow rules to restrict external forwarding.

1. Create a transport rule in the Exchange admin center (EAC) to block external forwarding by default.
2. Use conditions to identify when a message is auto-forwarded externally.
3. Add exceptions based on your requirement.

2.Monitor & Remove

Alternatively, you can monitor users’ email forwarding configurations regularly. If you identify any unexpected forwarding rules, you can review and remove them as needed.