How to find M365 external forwarding rules

Cover

Photo: StockSnap (CC0)

What you are probably seeing

You notice unexplained delivery failures or customer complaints about missing emails that actually went to a third-party address.

You see a spike in sign-in events from unfamiliar locations or devices in your audit logs without corresponding user notifications.

Why it happens

Attackers exploit hijacked credentials to create silent forwarding rules that bypass internal detection systems and divert mail externally.

The breach chain often starts with a compromised identity elsewhere that allows threat actors to maintain persistent access to your tenant.

What changed recently

2026-10-07 · Update on Nikkei: the phishing sent from its hijacked Microsoft 365 account on Sep 30 claimed at least one victim. Group publisher Nikkei BP says an employee gave away their login via a phishing emai
Nikkei exposed the gap where:
• Approximately 9,000 phishing emails originated from a hijacked Microsoft 365 mailbox.
• The breach chain began with a Google Workspace account hack in late July 2026.
Source: bluesky

Step by step

1. Navigate to the Microsoft Defender Portal and filter for audit events tagged as AddMailboxPermission or UpdateMailbox with external recipient changes.

2. Review the sign-in logs for the last 30 days and flag any activity originating from high-risk locations or unknown device fingerprints.

3. Cross-reference new mailbox permissions against your employee directory to identify recently added rules that lack valid business justification.

4. Isolate and disable any suspicious forwarding rules immediately and rotate credentials for the affected user accounts.

5. Document the findings and update your internal access control policies to require multi-factor authentication for all administrative mailbox changes.

Ways to go further

Affiliate links: CHEAPUNO may earn a commission if you buy through them, at no extra cost to you.

Other problems readers raise

How to stop copy-pasting between Claude and Google Sheets

How do I stop vague blockers from delaying launch?

Does Claude’s Google sidebar beat built-in Gemini?

Is a 42% off HP laptop with Office 365 a good deal?

How to tell if basic IT tasks consume over 10 hours weekly