Email forwarding/external rules

[Renfield-64]

The heads of our trust have asked us to make a report of any email rules staff may have setup for Outlook 365 at one of my schools and the same for Gmail at my other school:

· External Rules : Accounts with a mail rule set up.

· Mailbox with Forward : Accounts from 365 admin panel with a forward set.

 

Does anyone know how I am supposed to see if any users have any of these rules set up as I can't see anything obvious in the admin screens?

 

Thanks

[Chaniel]

Can't really help with gmail but for MS365

 

Firstly, make a transport rule to disable forwarding rules. You don't want people (or malicious actors) to be able to set forwarding rules to send to external addresses.

 

MS 365 Admin > Exchange Admin Centre > Mail Flow > Rules > New Rule

 

Apply if: Sender is located inside the organisation

And the recipient is located Outside the organisation

and The message type is Auto-forward

 

Reject the message with the explanation 'Client forwarding rules to external domains are not permitted'

 

Save that.

 

To get a report of any auto-forward rules, you'll want to use Powershell. This was part of the "Secure Score" section of the admin centre but I can't seem to find that anymore...

 

https://gcits.com/knowledge-base/find-inbox-rules-forward-mail-externally-office-365-powershell/

[Renfield-64]

That's great, I'll give that a try then.

 

Thanks.

[Chaniel]

I lied, I can help with Google.

 

Disabling forwarding: https://support.google.com/a/answer/2491924?hl=en

 

To find all users with forwarding rules, pretty sure you have to use GAM (https://github.com/jay0lee/GAM)

 

gam all users print forwardingaddresses todrive

 

 

Hope that helps!

[Danp]

I lied, I can help with Google.

 

Disabling forwarding: https://support.google.com/a/answer/2491924?hl=en

 

To find all users with forwarding rules, pretty sure you have to use GAM (https://github.com/jay0lee/GAM)

 

gam all users print forwardingaddresses todrive

 

 

Hope that helps!

 

I just tried this on my setup as I'm new to using GAM, gave me some interesting results, thank you.

[Renfield-64]

Now that I have set this up for 365 it seems to stop us sending any emails to external sources when I only wanted to stop forwarding to external

[LeMarchand]

Now that I have set this up for 365 it seems to stop us sending any emails to external sources when I only wanted to stop forwarding to external

 

Might have the wrong end of the stick, but I thought this was set to default towards the end of last year (caught out some governors who weren't using their school emails properly).

 

You should be able to disable automatic forwarding in anti-spam settings.

 

 

P.S. Checking my email Exchange with one of the govs, if they have rules in place emails sent get bounced back.

Edited January 28, 2021 by LeMarchand

[Michael]

That's correct, Microsoft disabled automatic forwarding (even if a user specifies a forwarder) late last year.

 

To create a new Outbound Rule, navigate to: https://protection.office.com/antispam and under 'Automatic Forwarding' set it to 'On'. Below this add the users or groups you want this to apply to.

[Roberto]

Report in O365? Try the powershell snippets below or something similar. Keep in mind you can only manage server-side rules.

 

get-mailbox -ResultSize Unlimited -Filter "ForwardingSmtpAddress -like '*'" |

select name, alias, ForwardingSMTPAddress

 

get-mailbox -ResultSize Unlimited -Filter "ForwardingAddress -like '*'" |

select name, alias, ForwardingAddress

[Renfield-64]

Thanks, will look into that as well.

[Danp]

Yesterday, I disabled forwarding within Google Admin, just ran the script again to export from GAM and it's still showing the same ones with a forwarder setup as before I made the change. How do I turn the rules off without going into their accounts?

[Danp]

Yesterday, I disabled forwarding within Google Admin, just ran the script again to export from GAM and it's still showing the same ones with a forwarder setup as before I made the change. How do I turn the rules off without going into their accounts?

 

Found how to do it with GAM

 

gam user [email protected] delete forwardingaddress [email protected]