forwarding

What it observes

Whether mail can leave this organisation automatically, and which of the three controls that govern it are in which position.

Three gates, and no screen shows them together

Microsoft documents that these interact rather than override: "When one setting allows external forwarding, but another setting blocks external forwarding, the block typically wins."

A reader who has checked one has checked a third of the question.

One value does not carry its own meaning

AutoForwardingMode: Automatic was equivalent to On when it was introduced. In 2021 it became Off for new organisations and for existing organisations that were not actively using it, and stayed On for those that were.

Two tenants showing the same word have opposite behaviour, decided by the organisation's history rather than by anything readable today. Microsoft does not ask anybody to reason about it -- it says to stop using it: *"Because the behavior can differ by organization, configure On - Forwarding is enabled or Off

• Forwarding is disabled instead of Automatic - System-controlled."*

That is read by EXO-FORWARD-001.

A block on a remote domain reaches half of it

AutoForwardEnabled: false overrides forwarding a user configured, through an Inbox rule or Outlook on the web. Microsoft states what it does not reach: "When admins use other methods to configure automatic forwarding for users, the forwarded messages aren't affected by the remote domain settings."

Mailbox forwarding an administrator configured, and mail flow rules, go anyway. So a tenant that blocked every remote domain and reported automatic forwarding is disabled described one of the two ways mail leaves. That is read by EXO-FORWARD-002.

What it does not read

• Mail flow rules. Whether any of them forwards externally is a question about rule actions rather than about a forwarding setting, and it is a separate reading. Their absence is recorded as not-supported, not as none.
• Per-mailbox forwarding. ForwardingSmtpAddress on a mailbox is what an administrator set, and enumerating it is a per-recipient reading.
• Whether forwarding should be permitted. Many organisations forward deliberately, and Microsoft publishes no rule that it must be off.

A second surface exists and has not been compared

Microsoft Graph exposes hostedOutboundSpamFilterPolicy through Tenant Configuration Management, carrying the same AutoForwardingMode. The same setting is readable two ways, under different permissions, through a different endpoint. Whether they agree is a measurement nobody has made, and it is recorded as named rather than left unstated.

Sources

• Control automatic external email forwarding from cloud mailboxes (Microsoft Learn)
• Remote domains in Exchange Online (Microsoft Learn)
• Recommended email and collaboration threat policy settings (Microsoft Learn)