Forwarding your email sounds like a useful shortcut—until it turns into a major security problem. In Microsoft 365, users can set up rules that automatically send copies of emails to other addresses, even outside your company.
And here’s the catch: this can happen in the background, without anyone knowing. Whether it’s done by an employee or a hacker, it could lead to sensitive information being forwarded to personal email accounts, or worse—straight to cybercriminals.
Let’s break down how this works, why it’s risky, and what your business can do to stop it.
What Is Email Auto-Forwarding?
Auto-forwarding is when a user creates a rule that sends some—or all—of their incoming emails to a different email address. This could be another work account, a personal Gmail, or worse—an address controlled by a cybercriminal.
While it has legitimate use cases, it can easily be misused without anyone noticing. That makes it a perfect tool for data theft, wire fraud, and internal leaks.
Why It’s a Big Risk
Here are some real-world examples of how auto-forwarding can go wrong:
1. An Employee Forwards Emails to Their Gmail
Let’s say an employee wants to check work email from their phone and sets up a rule to forward all their messages to their personal Gmail account. It seems harmless—until they leave the company. Now, even after they’re gone, their personal email may keep getting forwarded messages that include internal notes, client data, or financial info.
2. A Hacker Sets Up a Stealth Rule
If a hacker gains access to a company email account, one of the first things they might do is set up a rule to forward every incoming message to their own account. This lets them quietly monitor your business emails without needing to stay logged in. It’s a slow, quiet form of data theft—and it often goes unnoticed for weeks or months.
3. Unapproved Rules Between Teams or Contractors
Sometimes, forwarding rules are set up just to “keep things organized” between departments or contractors. But if these rules aren’t approved or managed, your company may accidentally send confidential messages to people who shouldn’t see them.
What You Can Do About It
The good news is that Microsoft 365 has built-in tools to help stop these risks—but they need to be set up correctly. Here’s what we recommend:
1. Block External Forwarding by Default
You can configure your Microsoft 365 settings to prevent anyone from forwarding email to external addresses (like Gmail, Yahoo, or other outside domains). This stops most unauthorized data sharing before it starts.
How to do it:
Your IT provider or administrator can disable external forwarding using Microsoft’s built-in mail flow settings. This is a standard security best practice for businesses.
2. Regularly Check for Suspicious Rules
Your IT team should routinely check for inbox rules that:
-
Automatically forward messages
-
Delete or hide messages after forwarding
-
Were recently added or changed
This helps spot problems early—whether they’re accidental or malicious.
3. Turn On Alerts for New Forwarding Rules
Microsoft 365 allows you to set up alerts when someone creates a forwarding rule. That means if an employee or attacker tries to set one up, you’ll know about it right away.
Your IT provider can create a simple alert policy inside Microsoft Purview (the Microsoft 365 compliance center).
4. Educate Your Team
A lot of the time, employees set up auto-forwarding without realizing the risk. It’s important to explain:
-
Why forwarding to personal email accounts is not allowed
-
What the company’s policy is
-
How to request secure access if they need to work offsite
Even basic cybersecurity training goes a long way in protecting your company.
5. Use Microsoft Defender for Extra Protection
If your company uses Microsoft 365 Business Premium or Microsoft 365 E5, you already have access to Microsoft Defender for Office 365. This gives you stronger protection tools like:
-
Safe Links to block phishing websites
-
Safe Attachments to scan for malware
-
Real-time attack monitoring
If you’re not using these tools yet, Sirius can help you set them up and make sure everything’s running securely.
Final Thoughts
It’s easy to forget how powerful a simple inbox rule can be. But auto-forwarding—especially to outside email addresses—can open the door to lost data, legal risks, and even full-blown cyberattacks.
At Sirius Office Solutions, we help small and mid-sized businesses in Phoenix and Fort Collins keep their Microsoft 365 systems secure, properly configured, and backed by real support. Whether you need a one-time checkup or full IT management, we’ve got you covered.
Worried about what’s going on behind the scenes in your inboxes?
Let’s talk and make sure your Microsoft 365 is safe, smart, and set up right.
