Allow or block external auto-forwarding in Exchange Online and fix 5.7.520

Originally published on EpiFive, where it is kept up to date.

When a user's mail is forwarded to an external address and the sender gets 5.7.520 Access denied, Your organization does not allow external forwarding, an outbound spam filter policy is blocking it. Set the policy's automatic forwarding option to On for the people who legitimately need forwarding, keep it Off for everyone else, and the bounce stops for the approved users only.

This article walks through how Microsoft 365 decides whether to allow automatic external forwarding, how to read the setting in the Microsoft Defender portal and Exchange Online PowerShell, how to allow forwarding for a named group of users, and how to find out who is forwarding mail today.

Who this is for and what you will have

This is for Microsoft 365 administrators who have received a ticket about a forwarding bounce, or who want to make forwarding behaviour predictable before an audit. It assumes you can open the Microsoft Defender portal and Exchange Online PowerShell.

At the end you will have:

• A clear picture of the three forwarding methods and which one is blocked.
• The default outbound spam policy set explicitly to block external forwarding.
• A custom policy that allows forwarding for an approved list of users.
• A report of current forwarders and a way to confirm the result with a test message.

If you suspect a compromised account rather than a business need, start with Find and remove malicious inbox and forwarding rules after a BEC and come back here to tighten the policy.

How external forwarding works in Microsoft 365

Microsoft documents two kinds of automatic forwarding to external recipients:

Method	Who configures it	Where it lives
Inbox rule	The user (or an attacker using the account)	Outlook rules for the mailbox
Mailbox forwarding (SMTP forwarding)	An admin	Mailbox forwarding settings in the Exchange admin center or Set-Mailbox

A third control, mail flow rules, can also redirect or copy mail, and the Auto forwarded messages report lists Mail flow rules as a forwarding type alongside the other two.

The outbound spam filter policy has one setting that governs all of this for cloud mailboxes, shown in the portal as Automatic forwarding rules and in PowerShell as AutoForwardingMode:

Portal value	PowerShell value	Behaviour
Automatic - System-controlled	Automatic	The default. Equivalent to On or Off depending on the organization
On - Forwarding is enabled	On	Automatic external forwarding is not disabled by the policy
Off - Forwarding is disabled	Off	Automatic external forwarding is blocked and the sender gets an NDR

Two details matter in practice:

• Setting Off disables any inbox rules and mailbox forwarding that redirect messages to external addresses. The rules still exist, but the forwarded copies are not delivered externally.
• The setting does not affect forwarding between internal users. It applies to cloud-based mailboxes; users forwarding from an on-premises system through Microsoft 365 are subject to the same policy controls.

Why Automatic is unreliable

When the Automatic value was introduced it behaved like On. In 2021 it changed to Off for new organizations and for existing organizations that were not actively using the value. Organizations that already used it can remain equivalent to On. Two tenants showing the same value in the portal can therefore behave differently, and Microsoft recommends choosing On or Off explicitly.

The NDR the sender receives

When the policy blocks a forwarded message, the sender gets this non-delivery report:

5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)

Per Microsoft's documentation, NDRs are generated in these cases when forwarding is disabled:

• Messages from external senders, for all forwarding methods.
• Messages from internal senders if the forwarding method is mailbox forwarding. If the method is an inbox rule, no NDR is generated for internal senders.

That second point explains a common confusion: an internal colleague's message to a user with an inbox rule may silently not arrive at the external address, with no bounce.

Prerequisites

• A Microsoft 365 organization with Exchange Online mailboxes. Outbound spam policies apply to all organizations with cloud mailboxes.
• Permissions: membership of the Organization Management or Security Administrator role groups in Exchange Online, or the Microsoft Entra Security Administrator role (Global Administrator also works, but Microsoft recommends least privilege). Read-only roles such as Security Reader or Global Reader can view the policies.
• Exchange Online PowerShell, connected as described in Connect to Exchange Online PowerShell:

Connect-ExchangeOnline -UserPrincipalName [e-mail]

If a policy change fails to save with a 403 or CmdletAccessDeniedException even though your permissions are right, Microsoft notes some organizations need a backend RBAC configuration refresh and says to contact Microsoft Support and reference "RBAC configuration refresh".

Step 1: Check what your tenant does today

List the outbound spam filter policies and their forwarding mode:

Get-HostedOutboundSpamFilterPolicy | Format-Table Name, AutoForwardingMode

Then list the rules, which hold the scope and priority of custom policies:

Get-HostedOutboundSpamFilterRule | Format-Table Name, Priority, State

In the Defender portal, open Email & collaboration > Policies & rules > Threat policies > Anti-spam (or go to https://security.microsoft.com/antispam). The default outbound policy is named Anti-spam outbound policy (Default). Select it and look at the Forwarding rules section of the flyout.

If the value is Automatic - System-controlled, you do not yet know whether your tenant forwards externally. Test it in Step 5, then set an explicit value.

Step 2: Set the default policy explicitly to Off

A safe baseline is to block external forwarding for everyone and add exceptions. In the portal:

1. Open Anti-spam and select Anti-spam outbound policy (Default).
2. In the Forwarding rules section of the flyout, select Edit.
3. In the Automatic forwarding rules dropdown, choose Off - Forwarding is disabled.
4. Select Save.

The same change in PowerShell:

Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off

The default policy applies to all senders and always has the lowest priority. You cannot scope it, rename it, disable it or delete it, which is why exceptions go in a custom policy.

Step 3: Allow forwarding for approved users

Create a custom outbound spam policy that allows forwarding and applies only to the people who need it. Because custom policies are processed before the default, the approved users get On while everyone else falls through to Off.

Option A: Defender portal

1. On the Anti-spam policies page, select Create policy > Outbound.
2. On Name your policy, enter a name such as Allow external forwarding and an optional description.
3. On Users, groups, and domains, add the approved Users or Groups, or a Domains value. You can use each condition once, but it can hold many values.
4. On Protection settings, set Automatic forwarding rules to On - Forwarding is enabled.
5. Select Next, review, and select Create.

Scope behaviour to know before you pick users or groups:

• Different condition types use AND logic. If you add a user and a group, the policy applies to that user only if they are also in the group.
• Identifying a Microsoft 365 Group under Groups applies the policy to messages sent by its members. Automatic forwarding by inbox rules inside the group uses the group's own address as sender, so to cover that case identify the group under Users.
• Dynamic distribution groups and Microsoft Entra dynamic membership groups are not supported in the scope.
• A domain condition also covers subdomains unless you exclude them.

Option B: Exchange Online PowerShell

In PowerShell a policy is two objects: the policy (settings) and the rule (scope and priority). Create the policy first, then the rule that points to it:

New-HostedOutboundSpamFilterPolicy -Name "Allow external forwarding" -AutoForwardingMode On

New-HostedOutboundSpamFilterRule -Name "Allow external forwarding" `
  -HostedOutboundSpamFilterPolicy "Allow external forwarding" `
  -From "[e-mail]","[e-mail]" `
  -Priority 0

To scope by group instead, replace -From with -FromMemberOf "External Forwarding Approved". The policy is not visible in the Defender portal until a rule is attached to it. A rule can be linked to only one policy, and it cannot point at the default policy.

Understand priority

Outbound spam protection stops for a sender after the first policy applies, so only the highest-priority policy for that sender counts. A lower priority number means higher priority and 0 is the highest. A new policy created in the portal is placed below the lowest existing custom policy, so if you have several custom policies, check the order and adjust it:

Set-HostedOutboundSpamFilterRule -Identity "Allow external forwarding" -Priority 0

Changing one rule's priority shifts the others, so list the rules again afterwards.

Step 4: Check the other controls that can still block

Setting On in the outbound spam policy only means this one control does not block. Microsoft states that when one setting allows forwarding and another blocks it, the block typically wins:

Outbound spam policy	Other control	Result
Off	Remote domain allows automatic forwarding	Blocked
On	Mail flow rule or remote domain blocks automatic forwarding	Blocked
Automatic	Remote domain allows forwarding	Depends on the tenant, so set On or Off

You can use this on purpose: allow forwarding in the outbound spam policy, then use remote domains to restrict which external domains users may forward to. If an approved user still sees 5.7.520 or a similar bounce after Step 3, check your remote domains and mail flow rules in the Exchange admin center.

Step 5: Find out who is forwarding

Before and after changing the policy, review the Auto forwarded messages report in the Exchange admin center (under mail flow reports). It shows messages automatically forwarded from your organization to recipients in external domains, split by:

• Forwarding type: mail flow rules, inbox rules or SMTP forwarding.
• Recipient domain.
• Forwarding users.

The detail table lists the forwarder, recipient, recipient domain, forward count and first forward date, and you can export it to CSV. For mail flow rules, the Details column holds the rule ID, which you can resolve with Get-TransportRule -Identity <RuleID>.

Practical limits from the documentation: the report shows 7 days by default, the summary page can query up to 90 days, and the request report feature is limited to the last 30 days. If the report looks empty, widen the date range.

For on-premises users forwarding through Microsoft 365, Microsoft's documented workaround is a mail flow rule that matches the header X-MS-Exchange-Inbox-Rules-Loop with value . and sets a header such as X-Forwarded: True with severity Low, Medium or High, so the Exchange transport rule report shows who forwards.

To review admin-configured mailbox forwarding directly, read the properties on the mailbox:

Get-Mailbox -Identity [e-mail] |
  Format-List ForwardingAddress, ForwardingSmtpAddress, DeliverToMailboxAndForward

If you need to set forwarding for an approved user, the Exchange admin center path is Recipients > Mailboxes, select the mailbox, then under Mailbox > Email forwarding choose Manage email forwarding, turn on Forward all emails sent to this mailbox, and select Forward to an external email address. The Deliver message to both forwarding address and mailbox option keeps a copy. Or use PowerShell:

Set-Mailbox -Identity "Jason Smith" -DeliverToMailboxAndForward $true -ForwardingSmtpAddress [e-mail]

Microsoft warns that automatic forwarding to external recipients makes an organization vulnerable to takeover attacks, and recommends an outbound policy that allows it only for users who need it.

Step 6: Verify

1. Confirm the settings:

Get-HostedOutboundSpamFilterPolicy | Format-Table Name, AutoForwardingMode
Get-HostedOutboundSpamFilterRule | Format-Table Name, Priority, State

1. Expect Default to show Off and your custom policy to show On with the rule State as Enabled.
2. Send a test message from outside the organization to an approved user who has an external forwarding rule. It should reach the external mailbox.
3. Send the same test to a user who is not in the approved scope and has a forwarding rule. The sender should receive the 5.7.520 NDR.

Troubleshooting

Approved user still gets 5.7.520. Check scope and priority. A higher-priority custom policy with Off may apply to the user first, and AND logic across condition types may exclude them. Also check remote domains and mail flow rules (Step 4).

Forwarding stopped for everyone after the policy change. That is expected for Off: existing inbox rules and mailbox forwarding to external addresses stop delivering externally. Use the Auto forwarded messages report to list affected users, then decide who gets an exception.

No NDR, but mail is not arriving. For internal senders and inbox-rule forwarding, no NDR is generated when forwarding is disabled. Check the forwarding configuration and the policy instead of waiting for a bounce.

The new PowerShell policy is not in the portal. It appears only after a rule is attached. Create the matching New-HostedOutboundSpamFilterRule.

A policy was deleted but the rule remains (or the reverse). In PowerShell, removing a policy does not remove its rule and removing a rule does not remove its policy. Remove both with Remove-HostedOutboundSpamFilterRule and Remove-HostedOutboundSpamFilterPolicy.

Tenant-wide behaviour differs from a colleague's tenant. That is the Automatic value; set On or Off.

Checklist

• Default outbound policy set to Off explicitly.
• Custom policy with On scoped to approved users or a group, at the right priority.
• Remote domains and mail flow rules reviewed for conflicting blocks.
• Auto forwarded messages report reviewed before and after the change.
• Test messages sent to an approved and a non-approved user.
• Approved list reviewed on a regular schedule, since each exception is a data-exfiltration path.

For wider hardening, see Microsoft 365 tenant security baseline.

References

• Control external email forwarding and fix 5.7.520 errors
• Configure outbound spam policies
• Set-HostedOutboundSpamFilterPolicy
• New-HostedOutboundSpamFilterRule
• Configure email forwarding for a mailbox in Exchange Online
• Set-Mailbox
• Auto forwarded messages report
• Connect to Exchange Online PowerShell

---

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.