Security Policy Errors

How to Enable External Automatic Email Forwarding in Microsoft 365

John Wilson Oct 23, 2026 869 views

Question details

Users need to allow emails to be automatically forwarded to external email addresses outside of their Microsoft 365 organization.

How to Enable External Automatic Email Forwarding in Microsoft 365

Product: Microsoft 365
Device & OS: not provided
Scenario: Attempting to configure automatic email forwarding to an external domain for a user mailbox.
Observed behavior: Microsoft 365 blocks the automatic forwarding, often resulting in bounce messages, because the default Exchange outbound anti-spam policy restricts external forwarding.

Before you start

Ensure you have Global Administrator or Security Administrator privileges in your Microsoft 365 tenant, as standard end-users do not have the permissions required to modify outbound anti-spam policies.

Solution 1Recommended

Enable Automatic Forwarding via Microsoft 365 Defender

Configure the outbound anti-spam policy in the Microsoft 365 Defender portal to permit automatic external forwarding.

By default, Microsoft 365 enforces a strict anti-spam policy to prevent data exfiltration and spam generation. You must explicitly allow automatic forwarding in the threat protection settings to lift this restriction.

Access the Defender Portal

Navigate to Threat Policies

In the left-hand navigation pane, go to 'Email & collaboration', click on 'Policies & rules', then select 'Threat policies', and finally click on 'Anti-spam'.

Edit Outbound Anti-Spam Policy

Click on 'Anti-spam outbound policy (Default)' from the list of policies, and then click the 'Edit protection settings' link at the bottom of the flyout pane.

Enable Forwarding

Scroll down to the 'Forwarding rules' section, click the 'Automatic forwarding rules' dropdown menu, and select 'On - Forwarding is enabled'.

Save the Changes

Click 'Save' to apply the new policy settings. Allow up to one hour for the changes to fully propagate across the Exchange servers.

Enable Automatic Forwarding via Microsoft 365 Defender

Custom Policies: Instead of modifying the default policy, you can create a custom outbound anti-spam policy and assign it to specific users or groups to restrict external forwarding only to those who strictly need it.

Solution 2

Contact Your IT Administrator

If you are an end-user experiencing blocked forwards, you must request your organization's IT department to make this change.

Free Microsoft Office alternative

Enhance Your Productivity with WPS Office

While resolving email forwarding policies in Microsoft 365, consider WPS Office as a lightweight, free, and highly capable alternative to traditional Microsoft Office desktop applications. It offers a seamless experience for managing all your essential document workflows.

1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
2. Install the Software: Run the setup file and follow the quick on-screen instructions to complete the installation.
3. Open Your Documents: Launch WPS Office and instantly open, edit, and save your existing Word, Excel, and PowerPoint files without formatting loss.

Fully compatible with Microsoft Office formats like .docx, .xlsx, and .pptx.Free, fast, and lightweight alternative to heavy desktop office suites.Familiar user interface ensuring a zero learning curve for Microsoft 365 users.Built-in PDF editing, document conversion, and secure local file management.

microsoft office alternative - wps office

Frequently Asked Questions

Why does Microsoft 365 block external automatic forwarding by default?

Microsoft disables external automatic forwarding by default as a security measure. This prevents compromised accounts from secretly forwarding sensitive organizational data and emails to external malicious addresses.

How long does it take for the anti-spam policy changes to take effect?

After an administrator updates the outbound anti-spam policy in the Microsoft 365 Defender or Exchange admin center, it can take up to 60 minutes for the new routing rules to propagate and take effect across the tenant.

How do I know if my automatic forwarding was blocked by an outbound spam policy?

If a policy blocks the forward, the original sender or the mailbox owner will typically receive a Non-Delivery Report (NDR) bounce message containing the status code '5.7.520 Access denied, Your organization does not allow external forwarding'.

Can I enable automatic forwarding for just one specific user?

Yes. Instead of editing the default outbound anti-spam policy which applies to everyone, administrators can create a new custom outbound anti-spam policy, set forwarding to 'On', and assign it exclusively to specific users or groups.

Microsoft Office Security Issues