(L1) Ensure all forms of mail forwarding are blocked and/or disabled

Contributed by jeremy finneyAll contributors →

Part of CIS · Exchange Online · Mail flow · All checks

Run this check

Invoke-Maester -TestId CIS.M365.6.2.1

Overview

Mail flow rules and outbound spam policies do not forward mail to recipients outside the organisation.

Auto-forwarding is a favourite way to take mail from a compromised mailbox: the attacker adds a rule that copies every message to an outside address and then keeps receiving mail after the password is reset. It is also an easy way for a user to move company data to a personal account.

The test checks the RedirectMessageTo property used by the CIS PowerShell audit procedure, and lists enabled transport rules outside audit mode that redirect mail to an address outside the accepted domains. It resolves a recipient stored by alias or name before checking its address. Domain matching is exact: a subdomain is external unless it is itself an accepted domain. It also checks every outbound spam policy returned by Exchange, including custom policies without an enabled rule, and fails if the default policy is missing. Automatic forwarding must be Off. The default Automatic - System-controlled does not pass, because its effect depends on the organisation.

Remediation action

1. Sign in to the Microsoft Defender portal.
2. Go to Email & collaboration > Policies & rules > Threat policies > Anti-spam and open each outbound policy.
3. Set Automatic forwarding rules to Off - Forwarding is disabled. Do not use Automatic - System-controlled, because its effect depends on how Microsoft applies it in your organisation.
4. Sign in to the Exchange admin center.
5. Go to Mail flow > Rules and delete or change each rule that redirects mail to an external address.

To turn off automatic forwarding with PowerShell instead of steps 1 to 3, connect with Connect-ExchangeOnline and set it on each outbound spam policy, including custom policies without an enabled rule:

Set-HostedOutboundSpamFilterPolicy -Identity '<policy name>' -AutoForwardingMode Off

# Or set it on every outbound spam policy at once
Get-HostedOutboundSpamFilterPolicy | Set-HostedOutboundSpamFilterPolicy -AutoForwardingMode Off

Related links

• Microsoft Defender portal - Anti-spam policies
• Exchange admin center - Mail flow rules
• Control automatic external email forwarding in Microsoft 365
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.2.1

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.6.2.1
Severity	High
Suite	CIS
Product	Exchange Online
Related products	Defender
Feature	Mail flow
Area	External access and sharing
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1114.003 Email Forwarding Rule
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.2.1
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:6.2.1, nist-800-53-r5:AC-4
PowerShell test	Test-MtCisMailForwardingBlocked
Services	ExchangeOnline

Source

• Test: tests/cis/Test.CIS.M365.6.2.1.ps1
• Documentation: tests/cis/Test.CIS.M365.6.2.1.md