Back to Checks
m365

Transport rule does not allow forwarding mail to external domains

exchange_transport_rules_mail_forwarding_disabled
Service: exchangeSeverity: high
OfficialBuilt-inVerified
Categories:email-securitye3
Resource Type:NotDefined

Microsoft 365 Exchange Online mail flow rules are assessed for actions that forward or redirect messages to external domains. The finding highlights rules that add external recipients during transport.

Prowler logoProwlerprowler-provider-m365

Risk

External auto-forwarding enables silent data exfiltration, bypassing DLP and retention, reducing confidentiality.

A compromised mailbox can use forwarding for persistence and lateral movement, leaking sensitive content to untrusted domains and undermining communication integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks exchange_transport_rules_mail_forwarding_disabled

Recommendation

Block external auto-forwarding at the organization level and prefer internal controls for sharing. Apply least privilege with narrowly scoped, time-bound exceptions only when justified.

Adopt defense in depth: pair with DLP, outbound filtering, and alerts on new forwarding rules. Review and attest rules regularly.

Remediation

CLI

Remove-TransportRule -Identity <example_rule_name>

Other

1In the Microsoft 365 admin center, go to Admin centers > Exchange
2Navigate to Mail flow > Rules
3For each rule that has the action "Redirect the message to", select the rule, click Edit
4Under "Do the following", remove the action "Redirect the message to"
5Click Save
6Repeat for any other rules with this action

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.exchange.exchange_client import exchange_client


class exchange_transport_rules_mail_forwarding_disabled(Check):
    """
    Check to ensure that no mail transport rules allow forwarding mail to external domains.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the check to validate that no transport rules allow forwarding mail to external domains.

        This method retrieves all transport rules from the Exchange service and evaluates
        whether any of them allow forwarding mail to external domains. A report is generated for each
        transport rule.

        Returns:
            List[CheckReportM365]: A list of findings with the status of each transport rule.
        """
        findings = []
        for rule in exchange_client.transport_rules:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=rule,
                resource_name=rule.name,
                resource_id="ExchangeTransportRule",
            )
            report.status = "PASS"
            report.status_extended = f"Transport rule {rule.name} does not allow forwarding mail to external domains."

            if rule.redirect_message_to:
                report.status = "FAIL"
                report.status_extended = f"Transport rule {rule.name} allows forwarding mail to external domains: {', '.join(rule.redirect_message_to)}."

            findings.append(report)

        return findings

References