CIS.M365.6.2.1 - (L1) Ensure all forms of mail forwarding are blocked and/or disabled
Overview
Mail flow rules and outbound spam policies do not forward mail to recipients outside the organisation.
Auto-forwarding is a favourite way to take mail from a compromised mailbox: the attacker adds a rule that copies every message to an outside address and then keeps receiving mail after the password is reset. It is also an easy way for a user to move company data to a personal account.
The test lists enabled transport rules outside audit mode that redirect mail to an address outside the accepted domains. It resolves a recipient stored by alias or name before checking its address. Domain matching is exact: a subdomain is external unless it is itself an accepted domain. The test also checks the default outbound spam policy and custom policies that an enabled rule applies to; unused custom policies are not evaluated. Automatic forwarding must be Off. The default Automatic - System-controlled does not pass, because its effect depends on the organisation.
Remediation action
- Sign in to the Microsoft Defender portal.
- Go to Email & collaboration > Policies & rules > Threat policies > Anti-spam and open each outbound policy.
- Set Automatic forwarding rules to Off - Forwarding is disabled. Do not use Automatic - System-controlled, because its effect depends on how Microsoft applies it in your organisation.
- Sign in to the Exchange admin center.
- Go to Mail flow > Rules and delete or change each rule that redirects mail to an external address.
Related links
- Microsoft Defender portal - Anti-spam policies
- Exchange admin center - Mail flow rules
- Control automatic external email forwarding in Microsoft 365
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.2.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.2.1 |
| Severity | High |
| Suite | CIS |
| Product | Exchange Online |
| Related products | Defender |
| Feature | Mail flow |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1114.003 Email Forwarding Rule |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.2.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.2.1, nist-800-53-r5:AC-4 |
| PowerShell test | Test-MtCisMailForwardingBlocked |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.6.2.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.2.1.md