Email forwarding set up for a holiday can remain active after the person returns to work. Here is how to check Microsoft 365 forwarding and inbox rules, establish what they are for and remove arrangements that are no longer needed.
Email carries quotes, contracts and customer information. Forwarding messages to a colleague or an agreed service can be a necessary part of the job. Problems arise when it is unclear who receives the messages, which messages are forwarded or how long the arrangement should last.
IT can check what the settings do. The mailbox user and the person responsible for the work know why the arrangement was set up. Review it together. The aim is to distinguish rules that are still needed from those that are not.
Imagine a company where the finance manager has arranged for an external contractor to cover invoicing during their holiday. A rule forwards messages containing a particular word in the subject line to the contractor. The holiday has ended, but the rule is still active.
Finding the rule does not, by itself, mean there has been a security breach. The finance manager recognises the arrangement and confirms that the contractor no longer needs new messages. IT checks the recipient, the rule's conditions and its actions. IT then disables the unnecessary rule and checks that invoicing emails still reach the right people.
A useful review answers three questions: which messages does the rule process, where are they sent and is the arrangement still needed? A rule name such as “invoices” or “holiday” does not answer any of these on its own.
In Microsoft 365, messages can be forwarded automatically through mailbox forwarding settings or inbox rules. An administrator can configure mailbox forwarding in the Microsoft 365 admin centre. Detailed steps are available in Microsoft's guide to configuring email forwarding.
A rule may apply only to messages from a particular sender or messages containing a specific word in the subject line. It can also move messages to a folder. Check both the conditions and the actions: looking at the forwarding address alone does not tell you how incoming messages are handled. Microsoft's guide to inbox rules also explains how rule order and stopping the processing of further rules affect the outcome.
Having forwarding configured does not prove that messages have been delivered to the recipient. Your organisation's policies may block automatic external forwarding. Check the relevant forwarding controls when investigating where messages go. Microsoft explains how the different settings work together in its guide to external email forwarding.
Start with a temporary cover arrangement that has ended, for example, or a finding reported by a tool. Ask the user which automatic arrangements they use. Limit the review to the settings and information needed to investigate the issue. There is no need to read message content just in case.
In Outlook on the web or new Outlook, open Settings → Mail → Forwarding. Check whether forwarding is enabled, which address is configured and whether a copy of the messages is kept in the original mailbox. Menu names may vary. Follow the Microsoft Outlook instructions for your version. Where necessary, IT should also check the forwarding configured in the admin centre.
Open Settings → Mail → Rules. Check which rules are enabled, which messages they apply to and what they do. Record forwarding and redirection addresses, along with any other actions included in the same rule. If you cannot inspect a rule in your version of Outlook, ask IT to check it with a suitable administration tool.
Do not identify the recipient from the display name alone. Check the full address and establish who owns it. Go through these questions with the user and, where needed, their manager:
An external address does not, on its own, make the arrangement inappropriate. Equally, a familiar recipient may no longer need the messages.
Disable forwarding or a rule that is no longer needed. If the need continues, agree on the appropriate scope with the user. After the change, check that messages reach the right people, for example by sending a test message created for that purpose. Do not include customer or employee information in the test. Record what changed and who will be responsible for the arrangement from now on.
An unknown recipient or a rule the user does not recognise needs investigation. Look into events surrounding the rule's creation, any unusual sign-ins and other alerts. Microsoft's investigation guide for suspicious forwarding rules bases the assessment on several pieces of information: the recipient, the rule's conditions and the user's other activity.
If you suspect inappropriate forwarding, follow your company's security incident process and involve your IT partner if needed. Preserve the information required for the investigation and stop harmful activity without delay. Removing the rule alone does not resolve a possible account compromise. You must separately establish whether messages were actually sent and what further action is needed.
Vahti brings together risk findings from your Microsoft 365 environment and helps you understand what they mean. You can also explore inbox rules in the public demo. A finding provides a starting point for a review: IT investigates the setting, the user confirms the business need and the agreed fix is made in Microsoft 365.
Marking a finding as accepted in Vahti does not delete the email rule or change how it works in Microsoft 365.
Management should agree on when emails may be forwarded outside the company and who approves the arrangement. IT manages the technical settings. The user reports when temporary cover, a partnership or a work task changes. Add a forwarding review to the checklist for these changes.
Start with one mailbox that you know had a temporary arrangement. Check that its forwarding settings and rules match the current business need.
Explore Vahti's interactive demo to see inbox rules alongside risks affecting users, file sharing and app permissions.
Want to see how Vahti can help your business day to day? Explore Vahti.