AutoForwardingMode locked as "Automatic" on CSP-managed tenant – Set-HostedOutboundSpamFilterPolicy blocked despite Enable-OrganizationCustomization

Question

I manage a Microsoft 365 tenant licensed through a CSP reseller (IONOS). I need to enable external email forwarding via a transport rule, but external recipients are receiving NDR 550 5.7.520 ("Your organization does not allow external forwarding").

I have full Global Admin rights and am confirmed as a member of the Organization Management role group. I have tried the following:

1. Microsoft 365 Defender portal (security.microsoft.com) → Anti-spam outbound policy → setting Automatic forwarding rules to "On" reverts to "System Controlled" every time, triggered by a "Complete organizational setup" prompt that loops back without saving.
2. PowerShell: Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode On Returns: "The command you tried to run isn't currently allowed in your organization. To run this command, you first need to run the command: Enable-OrganizationCustomization."
3. Running Enable-OrganizationCustomization returns: "This operation is not required. Organization is already enabled for customization."
4. Confirmed via Get-HostedOutboundSpamFilterPolicy -Identity Default | Select AutoForwardingMode that the value remains "Automatic" regardless of attempts to change it.

I contacted my CSP reseller (IONOS), who confirmed this falls outside their support scope and directed me to Microsoft directly.

Is this policy locked at the CSP/partner level, requiring partner delegated admin access to change? If so, what is the correct path to get this unlocked, given my reseller has declined to action it? Is there a way for me as the tenant Global Admin to override this myself, or does this require a Microsoft support ticket specifically flagged as a CSP tenant policy lock?

Answer 1

Please note that we're not Microsoft support, this is a user-to-user support forum. Moderators have no backend access and cannot directly intervene in Microsoft products. We provide only technical guidance and best-practice recommendations based on reported issues.

Hi @Rohit Gorasia

Based on what you’ve described, this behavior is unexpected and strange. I have tested the same PowerShell commands as a Global Administrator with the appropriate roles, and I can normally modify the outbound anti-spam policy, including the AutoForwardingMode setting.

Before try contacting Microsoft support, I recommend creating a custom outbound spam policy and explicitly scoping it to some test users first. Custom policies take precedence over the default policy and can be used to enable automatic external forwarding without modifying the default configuration.

Use this article to know how to create an outbound policy.

If the custom policy also fails to apply or produces the same behavior, this would indicate a potential backend or policy enforcement issue, and it would be best to proceed with a Microsoft support request for further investigation.

Please try first and let me know how it goes.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.