Why Exchange Online Forwards Quarantined Phishing Emails
Question details
Users want to know why a shared mailbox continues to forward messages to an external address even when the messages are quarantined as high-confidence phishing.
- Product
- Microsoft Exchange Online
- Device & OS
- not provided
- Scenario
- Managing shared mailbox forwarding rules alongside Exchange Online Protection (EOP) security policies.
- Observed behavior
- A message quarantined as a high-confidence phish does not appear in the local Outlook inbox but is unexpectedly forwarded to an external address by the shared mailbox's forwarding rule.
Check your Exchange Admin Center to verify which shared mailboxes currently have automatic external forwarding enabled, as this configuration directly impacts how quarantined messages are processed.
Acknowledge Expected EOP Behavior and Submit Feedback
Understand how the mail flow rule processes forwarding before quarantine enforcement and learn how to report this protection gap to Microsoft.
Microsoft Support has confirmed that this behavior is expected within Exchange Online Protection (EOP). The automatic forwarding rule processes and forwards the message before the quarantine enforcement drops it from normal mailbox delivery.
Currently, there is no available Exchange Online setting that reliably blocks this specific forwarded behavior for quarantined messages.
Log in to the Microsoft 365 Exchange Admin Center, navigate to Mailboxes, and check the external forwarding configurations on your shared mailboxes.
Navigate to the official Microsoft Feedback portal or use the feedback channel within Exchange Online to report this protection gap. Requesting a fix can help prioritize a future update to prevent quarantined messages from being automatically forwarded.
Boost Your Productivity with WPS Office
While managing your Microsoft Exchange and Outlook security settings, consider enhancing your local workflow. WPS Office provides a lightweight, fully compatible, and free alternative to Microsoft Office, making it easy to create and edit documents, spreadsheets, and presentations.
- 1. Visit the official website: Go to the official WPS Office website to access the free download page.
- 2. Download the installer: Click the "Download WPS Office Free" button and save the setup file to your computer.
- 3. Install and launch: Run the installer file, follow the simple on-screen instructions, and launch the application to start working on your documents.
Frequently Asked Questions
Can I stop Exchange Online from forwarding quarantined emails?
Currently, Microsoft Exchange Online Protection does not offer a confirmed, built-in setting to stop a mailbox from forwarding emails that are quarantined as high-confidence phishing. The forwarding action triggers before the quarantine hides it from the inbox.
Why don't these forwarded emails appear in the local Outlook inbox?
The EOP quarantine enforcement successfully prevents the phishing email from being delivered to the local Outlook inbox. However, because the external forwarding rule is processed earlier in the mail flow sequence, the message still gets sent to the external address.
How can I protect external addresses receiving these forwarded phishing emails?
Ensure that the destination email servers have their own robust anti-phishing and spam filters enabled. If the security risk is too high, consider temporarily disabling automatic external forwarding on your shared mailboxes.
