Your tenant never turned off auto-forwarding, so mail can quietly leave

An account in your organisation gets compromised — a reused password, a convincing phishing page, nothing exotic. The attacker doesn’t announce themselves or lock anyone out, because they don’t need to. They set one quiet rule: forward a copy of every incoming email to an address outside the company. Then they leave. From that moment, everything that lands in that mailbox — invoices, contracts, password resets, the private thread about the acquisition — is delivered to a stranger, in real time, and the person whose account it is has no idea.

The reason this works so well is that it produces no symptoms. The victim still receives their mail. Nothing appears in their Sent folder, because an auto-forward isn’t a message they sent — it’s a rule the server applies silently. There’s no bounce, no warning, no sign anything changed. The mailbox behaves exactly as it always has, while quietly copying itself out of the building.

Why it stays invisible

Microsoft 365 has a control that governs whether accounts are allowed to automatically forward mail to external addresses. The catch is the default. It ships in a state Microsoft describes as “automatic” or system-controlled — which in practice means nobody has actually decided. Unless an administrator went in and explicitly turned external forwarding off, it may well be permitted, and most organisations never touched the setting because they never knew it was there.

So the door is ajar not through anyone’s mistake but through inaction, and inaction leaves no trace to notice. Forwarding is also a genuinely useful, legitimate feature — people forward their mail to a colleague while on leave, or to another system — which is precisely why it isn’t blocked by default and why a malicious forward hides comfortably among the honest ones.

The mechanism the attacker uses barely matters: it might be an inbox rule, a mailbox forwarding setting, or a sneakier variant that forwards and then deletes so even the incoming copy vanishes. What they share is silence. This is the same family of problem as a malicious inbox rule — a small, quiet piece of automation that turns a mailbox against its owner — and it’s found the same way: by going and looking, because nothing will come and tell you.

Find it yourself

Two checks, about ten minutes: one an administrator runs across the whole tenant, one any individual can run on their own mailbox.

If you administer Microsoft 365:

1. Open the Microsoft Defender portal (defender.microsoft.com) and go to Email & collaboration → Policies & rules → Threat policies → Anti-spam.
2. Open the outbound policy. In the Anti-spam outbound policy (default), find the Automatic forwarding rules setting.
3. Read what it’s set to. The three options are Automatic – System-controlled (the default), On and Off. If it’s on the default or On, external forwarding is effectively permitted. Set it to Off to disable all automatic external forwarding — which, per Microsoft’s own documentation, also disables any inbox rule or mailbox (SMTP) forwarding that redirects to an external address. Internal forwarding between your own users is unaffected, and people can still forward individual messages by hand.
4. Hunt for forwards already in place. In the Exchange admin centre, review mailboxes for Mail flow → forwarding settings, and run a search for inbox rules that forward externally. Anything forwarding to an outside address you don’t recognise is the thing you’re looking for.

If you just want to check your own mailbox (no admin rights needed):

1. In Outlook on the web, open Settings → Mail → Forwarding, and confirm nothing is quietly forwarding your mail elsewhere.
2. Then open Settings → Mail → Rules and read every rule. Delete any that forward or redirect to an address you don’t recognise — especially ones that also move the message to another folder or mark it read, which is how they stay hidden.

The unsettling find is usually a rule nobody remembers creating, pointing at an address nobody recognises.

The fix

The durable fix is to decide the default deliberately instead of leaving it to chance.

Turn external auto-forwarding off at the tenant level, and make exceptions consciously — a specific mailbox that genuinely needs to forward, allowed on purpose, rather than the whole organisation left open by omission. This single change closes the most common quiet-exfiltration route in one move.

Clean up what’s already there. Remove any forwarding rules and settings you couldn’t account for during the check, and — because a forwarding rule usually means the account was compromised to create it — reset the password and sign out all sessions for any mailbox where you find one.

Make it visible going forward. Set an alert for when a new external-forwarding rule is created, so the next attempt surfaces the day it happens rather than months later when a leaked thread turns up somewhere it shouldn’t. Microsoft 365 can raise this alert; turning it on is a two-minute job that pays for itself the first time it fires.

Re-check after every departure or incident. A leaver’s mailbox, or one caught up in a phishing scare, is exactly where a forgotten forward hides. Fold this check into offboarding and incident cleanup, alongside the account itself.

It’s a small setting with an outsized reach: flip external forwarding to a deliberate off, clear out what shouldn’t be there, and the quietest way for your mail to walk out of the building is closed.