How to Verify Outlook Alerts for a Forwarding or Redirecting Rule
Question details
The user needs to investigate a Microsoft 365 alert triggered by the creation of an inbox rule that forwards or redirects emails to another account.
- Product
- Microsoft 365 / Outlook
- Device & OS
- not provided
- Scenario
- An administrator receives an automated security alert indicating that an email forwarding or redirecting rule has been set up in an organization's mailbox.
- Observed behavior
- The default alert policy tracks and notifies admins when rules are created through Outlook on the web or Exchange Online PowerShell to forward emails.
Ensure you have Microsoft 365 administrator privileges, as accessing the Microsoft 365 Defender portal and alert policies requires the appropriate admin credentials.
Verify the Alert in the Microsoft 365 Admin Center
Use the Microsoft 365 Defender portal to review and validate the 'Creation of a forwarding/redirecting rule' alert to ensure the inbox rule is authorized.
This alert is automatically generated by Microsoft 365 default security policies when someone in your organization creates a rule to forward or redirect email to an external account. Investigating these alerts is a critical step in preventing unauthorized data exfiltration.
Open your web browser, navigate to the Microsoft 365 admin center (admin.microsoft.com), and log in with your administrator account credentials.
From the left-hand navigation menu of the admin dashboard, click on 'Security' to open the Microsoft 365 Defender portal.
In the Microsoft 365 Defender menu, expand 'Email and collaboration', click on 'Policies and rules', and then select 'Alert policies'.
Scroll through the list of policies to find 'Creation of a forwarding/redirecting rule'. Click on it to view the generated alerts, which will identify the mailbox involved and the rule created via Outlook on the web or Exchange Online PowerShell.
Looking for a Lightweight Office Suite? Try WPS Office
If you are exploring alternatives to Microsoft Office for your daily document processing, WPS Office offers a free, highly compatible, and lightweight suite. It provides a familiar user interface that makes migrating away from costly subscriptions completely seamless.
- 1. Download WPS Office: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the Software: Run the downloaded installer and follow the simple on-screen instructions to complete the setup.
- 3. Open Your Office Files: Launch WPS Office and directly open your existing Microsoft Office files to start editing immediately.
Frequently Asked Questions
Why did I receive a forwarding or redirecting rule alert in Microsoft 365?
This alert is triggered automatically by default Microsoft 365 security policies when a user in your organization sets up an inbox rule via Outlook on the web or Exchange Online PowerShell to forward or redirect their emails to another address. It acts as an early warning for potential data leaks.
Can standard Microsoft 365 users view these alert policies?
No. Viewing and managing alert policies within the Microsoft 365 Defender portal requires elevated permissions, such as the Global Administrator or Security Administrator role.
How do I remove an unauthorized forwarding rule from a user's mailbox?
You can remove the rule by navigating to the Exchange admin center, locating the specific user's mailbox under 'Recipients', opening the 'Mailbox features' or 'Mailflow settings', and deleting the unauthorized forwarding address or inbox rule.
Does this alert policy track forwarding rules made in the Outlook desktop application?
The default alert policy specifically focuses on tracking forwarding and redirecting rules created through Outlook on the web (OWA) and Exchange Online PowerShell, though client-side rules synced to the Exchange server may trigger related auditing events.
