1

In an incident concerning a user's mailbox - will any rule that forwards emails to a potential attack be visible in the office365/exchange admin interface, or is it possible to set an outlook client-only rules that will forward these emails and will not show unless inspecting the user's outlook client?

Thanks!

1 Answer 1

1

Generally there are multiple Ways to forward E-Mails:

  • Users can create a forwarding rule within Outlook or Outlook Web App
  • An administrator can create a client rule for forwarding
  • An administrator can set the ForwardingSMTPAddress parameter on a mailbox
  • Users can set the ForwardingSMTPAddress parameter on a mailbox
  • An administrator can set the ForwardingAddress parameter on a mailbox

You can check which Mailboxes have external forwarding enabled via Powershell, as this Post suggests.

Get-Mailbox -ResultSize Unlimited -Filter {(RecipientTypeDetails -ne "DiscoveryMailbox") -and ((ForwardingSmtpAddress -ne $null) -or (ForwardingAddress -ne $null))}

If you want to disable external forwarding of Mails in General, this Microsoft Guide will help you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .