Auto forwarded messages report in the new EAC in Exchange Online
The Auto-forwarded messages report in the new Exchange admin center (new EAC) displays information on messages that are automatically forwarded from your organization to recipients in external domains. You can use this report to look for potential data leaks.
By default, the report shows data for the last 7 days. If the report is empty, try changing the date range.
For permissions that are required to use this report, see Permissions required to view mail flow reports.
The overview section contains the following charts:
- Forwarding type: Typical values are:
- Mail flow rules
- Inbox rules
- SMTP forwarding: This is automatic forwarding that admins can configure on a mailbox as described in Configure email forwarding for a mailbox.
- Recipient domain
- Forwarding users
If you hover over a specific color in the chart, you'll see the associated numbers for that specific forwarding type, recipient domain, or forwarding user.
The Auto forwarded message details section shows the following information about each-specific forwarder (the user account that's doing the forwarding):
- Forwarding type
- Recipient name
- Recipient domain
- Details: If the message was auto-forwarded by a Transport rule, the ID of the rule is shown. Otherwise, this value is blank. In Exchange Online PowerShell, you can use the Get-TransportRule cmdlet to identify the rule by running the following command:
Get-TransportRule -Identity <RuleIDParameter>. For example,
Get-TransportRule -Identity 8754395095991580000.
- Forward count
- First forward date
Click Export to export the displayed results to a .csv file.
Two insights are generated based on the report data: New domains being forwarded email and New users forwarding email. Each insight provides a summary of the number of new forwarders or domains with a link back to this report.
For more information about other mail flow reports, see Mail flow reports in the modern EAC.