Best way to find and remove mail forwarding rules in Exchange Online

Part of the Microsoft 365 offboarding process involves securing your work environment from data leaks. One such component involves eliminating forwarding messages to external addresses to remove the risk of sharing confidential information. These mail forwarding rules in Exchange Online may have been set by the user or by the previous administration team for legitimate reasons at the time. And it’s important to be aware of all of these as sources of breaches especially when the source can be one or several employees who have left the company.

Often, managing multiple users is problematic because the O365 admin portal is limited by its UI. Admins resort to PowerShell to get it done but don’t always have the skills for elaborate scripting. I’m not a PowerShell power user myself so I usually resort to internet searches to find ready-to-use scripts that can help.

In this article, I’ll describe how to find email forwarding settings in order to turn them off or simply remove them. I’ll demonstrate how to manage them for a single user in the Microsoft 365 portal and some of them can simply be accessed with our third-party tool, sapio365.

Topics:

• • User-defined SMTP email forwarding & mail flow settings
  • Transport Rules
  • Users’ inbox rules

Transport Rules

It’s worth mentioning that there may also be forwarding rules in place in the form of Office 365 Transport Rules created by previous administrators. You can find and change these in the Exchange Online Admin center (see image 5).

Users’ inbox rules

Lastly, let’s look at the most common way users set up mail forwarding rules by navigating to the Rules section of their Outlook settings. Here you can see that Grady has set up two rules, including the “Send me a copy” rule which forwards messages to an external email address (see image 6).

Unfortunately, short of logging in as that user to access his mail rules, I’m not able to see these user-set rules in any of the available admin centers.

The only native solution I found to access them is through PowerShell scripting which becomes a complex task since you’ll need to use a script to get the information to identify forwarding mail rules and another script to remove them. Of course, identifying and removing forwarding inbox rules becomes tedious to do when you’re dealing with several mailboxes, each with its own rules. It even becomes impossible for mailboxes volumes in the thousands because PowerShell requires re-authentication after a certain time.

sapio365 – simpler than PowerShell

sapio365 is an easy and the ONLY alternative to scripting your way to your users’ mail rules.
And what’s more, we’ve automated various common admin tasks including an actionable report on externally forwarding inbox rules. It’s as easy as 1,2,3 (see image 7).

1. Run the automated job
2. Select options
3. Delete straight from the report!

In this case, this automatic report used filters to only retain rules that forward emails to external addresses. Each rule is broken down to its components – conditions, actions, exceptions – so that you know exactly what that rule does and if you want to remove it.

The beauty of sapio365 is that it doesn’t require any PowerShell scripting to handle multiple queries and it takes care of the information layout for you. Also, sapio365 may complete high volume tasks in as much time or less than the fanciest PowerShell script but is far more reliable in that it does not time out.

In fact, I can schedule a weekly job in the off-hours. This is to be able to sweep through all the mailboxes looking for rules that forward to external email addresses. When it’s done, I’ll get emailed a report outlining who’s got these inbox forwarding rules set up. Of course like all automated jobs in sapio365, it can be tweaked to actually remove the culprits as it finds them!