[Important] Prohibition of Automatic Forwarding per User in Microsoft 365 and Recommendations for Reviewing Forwarding Settings in Email DLP

Target

• Customers using Email DLP
• Customers who allow users to operate automatic forwarding individually in Outlook / Outlook on the web
• Customers who want to check our recommended settings for Email DLP transport rules in Exchange Online

* If any of the following settings are already configured in the Email DLP transport rules for Exchange Online, no further action is required regarding this matter.
* If the following settings are not configured, please update to the latest recommended settings below to ensure proper email delivery to Email DLP. For detailed configuration steps, please refer to the Help Center article [Email DLP] Connection Procedure (Microsoft 365).

• In [Rule description] – [Apply this rule if], both [The sender is located 'InOrganization'] and [The recipient is located 'NotInOrganization'] (English: [Is sent to 'Outside the organization' and Is received from 'Inside the organization']) are set as AND conditions.
• In [Rule description] – [Except if], [The sender's domain is 'onmicrosoft.com'] (English: [sender's address domain portion belongs to any of these domains: 'onmicrosoft.com']) is set as an OR condition.
  

Overview

To strengthen security governance and ensure stable email delivery, we recommend disabling the individual automatic forwarding feature for users in Microsoft 365 (Exchange Online).

Please disable any user-specific automatic forwarding settings configured in Microsoft 365 (Exchange Online) and review the forwarding settings to Email DLP (transport rules in Exchange Online).

Background of Recommendation

Email DLP is designed to properly process and protect emails sent directly by users from Outlook / Outlook on the web, as well as emails authenticated via SMTP-AUTH and similar methods.

• Information leakage risk: Security risks due to forwarding routes not managed or recognized by administrators
• Send limit pressure: Exceeding Exchange Online send limits due to mass forwarding (delays or errors in normal business email delivery)
• Disruption of stable operation: Delivery delays between Exchange Online and HENNGE Email DLP due to unexpected email inflow

If you are delivering automatically forwarded emails via Email DLP, please refer to the following procedures and consider taking action.

• For customers who do not require automatic forwarding in Outlook (including the web version)
• For customers who wish to continue using automatic forwarding in Outlook (including the web version)

Procedure

Disabling Automatic Forwarding

Procedure for administrators to disable external email forwarding

1. Access Microsoft 365 Defender.
2. Click [Email & collaboration] – [Policies & rules] – [Threat policies].
   
3. Click [Anti-spam] – [Outbound spam filter policy (Default)].
   
4. At the bottom of the settings, click [Edit protection settings].
   

5. In [Forwarding rules] – [Automatic forwarding rules], turn the setting off and save.
   

   * Even if forwarding is disabled, users can still configure automatic forwarding in Outlook. However, while users can register forwarding rules in Outlook, actual external email forwarding will be blocked by the aforementioned Exchange Online external forwarding restriction policy. 

Recommended Settings for Customers Who Wish to Continue Email Forwarding

Procedure for administrators to configure external email forwarding

1. Access the Exchange admin center.
2. Go to [Mail flow] – [Rules], then click [Add a rule] – [Create a new rule].
   

3. Configure the following values:

   • [Name]: Any name (e.g., Forwarding Rule)
   • In [Apply this rule if], specify the conditions for the emails you want to forward, then click [Save].
     Example: To forward emails sent by a specific user:
     [Sender] – [is this person] – [Specify the sender's email address]

   • In [Do the following], specify the forwarding action, then click [Save].
     Example: To forward to a specific email address in addition to the recipient:
     [Add recipient] – [To the Cc box] – [Specify the forwarding email address]

     

    

4. After configuring the above rule, click [Next].

5. Select the following items and click [Next].

   • [Rule mode]: "Apply"
   • [Priority]: "Not specified"
   • [Match sender address in message]: "Header or envelope"

   

6. Review the settings and click [Next].

7. After confirming the message "The transport rule was created successfully," click [Done].

   

8. Select the rule you created, then click [Enable or disable rule] – [Enable].

   

9. Confirm that the connection is completed successfully.