How to Enable External Email Forwarding for Selected Microsoft 365 Users
Question details
The administrator needs to allow specific users within the organization to automatically forward emails to external addresses without enabling this feature globally for all users.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Configuring selective external email forwarding permissions for a distinct group of users while maintaining the default block on automatic external forwarding across the rest of the tenant.
- Observed behavior
- External automatic forwarding is disabled by default organization-wide, preventing users from creating their own rules to forward emails outside the company.
Ensure you have Exchange Online Administrator or Global Administrator privileges in Microsoft 365, as modifying outbound anti-spam policies or transport rules requires elevated administrative permissions.
Create a Custom Outbound Anti-Spam Policy (Recommended)
This is the most secure and standard method to allow specific users or groups to forward emails externally without altering the organization's default security posture.
By default, Microsoft 365 blocks automatic forwarding to external domains to prevent data exfiltration. Instead of changing the default policy, administrators should create a new, targeted outbound spam filter policy.
This method does not require PowerShell; it can be entirely configured through the Microsoft 365 Defender portal.
Log in to the Microsoft 365 Defender portal at security.microsoft.com using your admin credentials.
Go to 'Email & collaboration' > 'Policies & rules' > 'Threat policies' > 'Anti-spam' in the left-hand navigation pane.
Click on 'Create policy' and select 'Outbound'. Give the policy a descriptive name, such as 'Allow External Forwarding for Selected Users', and click Next.
In the 'Users, groups, and domains' section, add the specific users or Microsoft 365 groups that require external forwarding permissions.
Proceed to the 'Protection settings' section. Under 'Forwarding rules', select 'On - Forwarding is enabled' from the dropdown menu, then save and activate the policy.
Use Exchange Mail Flow (Transport) Rules
An alternative method that utilizes Exchange transport rules to automatically BCC or forward emails to external contacts, keeping user-level forwarding disabled.
Need a powerful and lightweight alternative for document editing?
While Microsoft 365 administrators handle complex enterprise email routing and security policies, users often just need a fast, reliable, and cost-effective solution for daily document tasks. WPS Office provides a fully featured suite that supports all major document formats without the heavy overhead.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the downloaded installer and follow the simple on-screen prompts to complete the setup.
- 3. Open and Edit Your Files: Launch WPS Office and immediately start creating or editing your existing Microsoft Word, Excel, or PowerPoint documents.
Frequently Asked Questions
Is PowerShell required to enable external email forwarding in Microsoft 365?
No, PowerShell is not strictly required. While you can use PowerShell to configure these settings, administrators can easily create custom outbound anti-spam policies directly through the graphical interface of the Microsoft 365 Defender portal.
Why do my users receive bounce-back messages when setting up Inbox rules to forward emails?
This occurs because Microsoft 365's default outbound anti-spam policy blocks automatic external forwarding to protect against data leaks. Unless an exception is created for those specific users, the server will reject the forwarding attempt and send a non-delivery report (NDR).
Can I allow external forwarding for my entire organization instead of selected users?
Yes, but it is highly discouraged for security reasons. If absolutely necessary, you can modify the default outbound anti-spam policy in the Microsoft 365 Defender portal and set 'Automatic forwarding rules' to 'On - Forwarding is enabled', which will apply to the entire tenant.
What is the difference between an anti-spam policy forwarding exception and a mail flow rule?
An anti-spam policy exception allows users to safely set up their own forwarding rules (like Outlook Inbox rules) without being blocked. A mail flow (transport) rule is an admin-enforced server-side rule that automatically routes or copies messages behind the scenes, overriding user settings.
