How to Fix Email Forwarding Failures Due to Outbound Spam Policy in Exchange Online
This is commonly caused by Outbound Anti-Spam Policies, where automatic forwarding is disabled by default to prevent data exfiltration and misuse.
🔍 The Symptoms / Error Message
⚠️ What You May Experience
- Emails configured for forwarding are not delivered to external recipients
- No visible errors in mailbox forwarding settings
- Message trace shows forwarded emails blocked or failed
- Forwarding rules appear enabled but do not function
🧠 Root Cause
💡 Why This Happens
The issue occurs because automatic email forwarding is restricted or disabled in the Outbound Spam Filter Policy within Microsoft 365 Defender.
By default, external forwarding is set to “Automatic – System-controlled” or “Off”. Microsoft enforces this to mitigate:
- Data leakage risks
- Compromised account abuse
- Unauthorised email exfiltration
⚠️ Result
Forwarding rules configured at the mailbox level will not work unless explicitly allowed in the outbound policy.
🛠️ Step-by-Step Resolution
Method 1 — Enable Forwarding via Microsoft 365 Defender Portal (GUI)
The quickest fix for restoring forwarding across the board, by modifying the existing outbound spam filter policy.
✅ GUI Method
- Go to Microsoft 365 Defender Portal at security.microsoft.com
- Navigate to: Email & Collaboration → Policies & Rules → Threat Policies
- Select Anti-spam policies
- Open the Outbound spam filter policy (Default or Custom)
- Locate Automatic forwarding rules
- Set the value to On – Forwarding is enabled
- Click Save
Method 2 — Create a Dedicated Outbound Policy (Recommended)
Instead of modifying the default policy for all users, scope forwarding access to only the mailboxes that need it.
✅ GUI Method
- Go to Anti-spam policies
- Click Create policy → Outbound
- Configure: Users/Groups → add only the required mailboxes
- Configure: Automatic forwarding rules → set to On
- Save and apply the policy
✅ This ensures controlled and secure usage of forwarding.
Method 3 — Verify Mailbox Forwarding Settings
Confirm the mailbox-level forwarding configuration and inbox rules via PowerShell.
Connect-ExchangeOnline Get-Mailbox -Identity "user@yourdomain.com" | Select DisplayName, ForwardingSMTPAddress, DeliverToMailboxAndForward # Check inbox rules Get-InboxRule -Mailbox "user@yourdomain.com" | Select Name, Enabled, ForwardTo, RedirectTo
Method 4 — Validate / Update Outbound Policy via PowerShell
Check and update the AutoForwardingMode setting directly through Exchange Online PowerShell.
Connect-ExchangeOnline Get-HostedOutboundSpamFilterPolicy | Select Name, AutoForwardingMode # To enable forwarding Set-HostedOutboundSpamFilterPolicy -Identity "YourPolicyName" -AutoForwardingMode On
💡 Best Practices & Recommendations
- Do NOT enable email forwarding globally for all users — enabling forwarding tenant-wide increases the risk of data exfiltration and account compromise abuse
- Always create a scoped outbound spam policy for only the required users or departments
- Regularly monitor forwarding activity using Message Trace and audit logs
- Combine with Conditional Access and MFA enforcement for additional protection
✅ Key Takeaway
Email forwarding failures in Exchange Online are typically due to security restrictions in outbound spam policies, not mailbox misconfiguration.
By enabling forwarding through a dedicated outbound policy, organisations can restore functionality while maintaining strong security controls. However, forwarding should never be enabled for all users, as it introduces significant security risks — making scoped and controlled configuration the recommended Microsoft best practice.
📚 References & Further Reading
- 🔗 Configure outbound spam filtering — Microsoft Learn
- 🔗 External email forwarding in Microsoft 365 — Microsoft Learn
- 🔗 Get-HostedOutboundSpamFilterPolicy — Microsoft Learn