CIS.M365.6.2.1 - (L1) Ensure all forms of mail forwarding are blocked and/or disabled
Overview
Mail flow rules and outbound spam policies do not forward mail to recipients outside the organisation.
Auto-forwarding is a favourite way to take mail from a compromised mailbox: the attacker adds a rule that copies every message to an outside address and then keeps receiving mail after the password is reset. It is also an easy way for a user to move company data to a personal account.
The test checks the RedirectMessageTo property used by the CIS PowerShell audit procedure, and lists enabled transport rules outside audit mode that redirect mail to an address outside the accepted domains. It resolves a recipient stored by alias or name before checking its address. Domain matching is exact: a subdomain is external unless it is itself an accepted domain. It also checks every outbound spam policy returned by Exchange, including custom policies without an enabled rule, and fails if the default policy is missing. Automatic forwarding must be Off. The default Automatic - System-controlled does not pass, because its effect depends on the organisation.
Remediation action
- Sign in to the Microsoft Defender portal.
- Go to Email & collaboration > Policies & rules > Threat policies > Anti-spam and open each outbound policy.
- Set Automatic forwarding rules to Off - Forwarding is disabled. Do not use Automatic - System-controlled, because its effect depends on how Microsoft applies it in your organisation.
- Sign in to the Exchange admin center.
- Go to Mail flow > Rules and delete or change each rule that redirects mail to an external address.
To turn off automatic forwarding with PowerShell instead of steps 1 to 3, connect with Connect-ExchangeOnline and set it on each outbound spam policy, including custom policies without an enabled rule:
Set-HostedOutboundSpamFilterPolicy -Identity '<policy name>' -AutoForwardingMode Off
# Or set it on every outbound spam policy at once
Get-HostedOutboundSpamFilterPolicy | Set-HostedOutboundSpamFilterPolicy -AutoForwardingMode Off
Related links
- Microsoft Defender portal - Anti-spam policies
- Exchange admin center - Mail flow rules
- Control automatic external email forwarding in Microsoft 365
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.2.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.2.1 |
| Severity | High |
| Suite | CIS |
| Product | Exchange Online |
| Related products | Defender |
| Feature | Mail flow |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1114.003 Email Forwarding Rule |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.2.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.2.1, nist-800-53-r5:AC-4 |
| PowerShell test | Test-MtCisMailForwardingBlocked |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.6.2.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.2.1.md