Auto forwarded messages report in the new EAC in Exchange Online
Article
The Auto-forwarded messages report in the new Exchange admin center (new EAC) displays information on messages that are automatically forwarded from your organization to recipients in external domains. You can use this report to look for potential data leaks.
Note
By default, the report shows data for the last 7 days. If the report is empty, try changing the date range.
The summary page allows you to query up to the last 90 days of data. The new activity page shows the activity of the last 7 days. The request report feature has a limit of the last 30 days.
If you hover over a specific color in the chart, you'll see the associated numbers for that specific forwarding type, recipient domain, or forwarding user.
The Auto forwarded message details section shows the following information about each-specific forwarder (the user account that's doing the forwarding):
Forwarders
Forwarding type
Recipient name
Recipient domain
Details: If the message was auto-forwarded by a Transport rule, the ID of the rule is shown. Otherwise, this value is blank. In Exchange Online PowerShell, you can use the Get-TransportRule cmdlet to identify the rule by running the following command: Get-TransportRule -Identity <RuleIDParameter>. For example, Get-TransportRule -Identity 8754395095991580000.
Forward count
First forward date
Click Export to export the displayed results to a .csv file.
This module examines how Exchange Online Protection (EOP) protects organizations from phishing and spoofing. It also explores how EOP blocks spam, bulk email, and malware before they arrive in users’ mailboxes.