What it decides

Rule
EXO-FORWARD-001
Applies to
exchange · tenant
Default severity
medium
Basis
documented-guidance

On what authority

Microsoft describes the value and then tells you not to use it: "When this value was introduced, it was equivalent to On - Forwarding is enabled. In 2021, the value changed to Off - Forwarding is disabled for new organizations and for existing organizations that weren't actively using the Automatic - System-controlled value. For existing organizations that were already using the value, it can remain equivalent to On - Forwarding is enabled. Because the behavior can differ by organization, configure On - Forwarding is enabled or Off - Forwarding is disabled instead." Their recommended-settings table says the same in one line: the default is Automatic and both the Standard and Strict recommendations are Off, with the comment that the behaviour of Automatic can differ by organization. This rule does not say forwarding should be off. It says that while this value is in place, nobody can read the setting and know which it is -- including the administrator, the auditor, and this engine.

What it needs to decide

  • forwarding.outbound_policies_ambiguous

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • forwarding: whether mail can leave this organisation automatically, and which of the three controls that govern it are in which position · not live-validated

What a pass does not establish

A PASS SAYS THE VALUE IS READABLE AND NOT THAT MAIL CANNOT LEAVE. A policy explicitly set to Off does not stop a mail flow rule from forwarding, and a policy set to On is still subject to whatever the remote domains permit. Microsoft states that where one control allows and another blocks, the block typically wins, so no single setting answers whether mail leaves.

  • This reads the policies and not who they apply to. A custom policy scoped to a few recipients decides for those recipients only, and a tenant may be explicit for most people and ambiguous for some.
  • Automatic forwarding between internal users is not affected by these settings at all, so a fail here says nothing about mail that never leaves the organisation.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b8@c2aecc628b21.

Generated from capability-manifest/1.0.0 at 1.0.0b8@c2aecc628b21, contract 1.0.0b8. Every fact on this page is the Engine's; this site publishes it and does not maintain it.