What it decides

Rule
EXO-FORWARD-002
Applies to
exchange · tenant
Default severity
low
Basis
documented-guidance

On what authority

Microsoft documents the default and the limit together. "Allow or prevent automatically forwarded messages to be sent to people on the remote domain. The default is to allow automatic forwarding." And, for what the setting reaches: it overrides forwarding a user configured through an Inbox rule or Outlook on the web, while "when admins use other methods to configure automatic forwarding for users, the forwarded messages aren't affected by the remote domain settings". An organisation may permit forwarding deliberately, and many do. What this rule refuses is the reading in the other direction: a remote domain that permits forwarding is not the only gate, and a remote domain that blocks it is not the whole answer either. Both halves of that belong on the same finding, which is why they are on this one.

What it needs to decide

  • forwarding.remote_domains_allowing_forwarding

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • forwarding: whether mail can leave this organisation automatically, and which of the three controls that govern it are in which position · not live-validated

What a pass does not establish

A PASS DOES NOT MEAN MAIL CANNOT LEAVE AUTOMATICALLY. Remote domain settings do not affect mailbox forwarding configured by an administrator, and they do not affect mail flow rules. A tenant blocking every remote domain still forwards by both of those routes, and this rule reads neither.

  • Mail flow rules are the third control and are not read by this collector. Whether any of them forwards externally is a question about rule actions rather than about a forwarding setting.
  • The outbound spam filter policy is the other gate, and Microsoft states that where one control allows and another blocks, the block typically wins. A remote domain permitting forwarding while the policy is set to Off produces no forwarding at all.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b8@c2aecc628b21.

Generated from capability-manifest/1.0.0 at 1.0.0b8@c2aecc628b21, contract 1.0.0b8. Every fact on this page is the Engine's; this site publishes it and does not maintain it.