How To Stop Email Forwarding Rules Stealing Microsoft 365 Credentials

Summary

This guide helps you troubleshoot and resolve: How To Stop Email Forwarding Rules Stealing Microsoft 365 Credentials. Follow the steps below to fix the issue.

Common Causes

Email forwarding rules are a common method used by attackers to exfiltrate sensitive data from Microsoft 365 accounts. Once credentials are compromised, an attacker can create an inbox rule to silently forward emails containing donor details, volunteer information, or financial records to an external address without the user's knowledge. For not-for-profit and community organisations, this poses a significant risk to privacy and stakeholder trust. This guide explains how to audit and disable unauthorised forwarding rules to protect your organisation's communications.

Auditing Forwarding Rules in Outlook on the Web

1. Open your browser and sign in to Outlook on the web at outlook.office.com using the affected user account.
2. Click the Settings (gear) icon in the top right corner.
3. Select Mail from the settings menu.
4. In the left-hand panel, click Rules.
5. Review the list of rules for any action that says Forward to or Redirect to.
6. Select any suspicious rule and click the Delete (trash bin) icon.
7. Click Save to apply your changes.

Remember to check rules for all shared mailboxes used by volunteers or staff, not just individual user accounts.

Checking Organisation-Wide Forwarding in the Microsoft 365 Admin Center

1. Sign in to the Microsoft 365 Admin Center at admin.microsoft.com.
2. Navigate to Users > Active users.
3. Select a user account to open their properties pane.
4. Click the Mail tab.
5. Under Email forwarding, check if forwarding is enabled.
6. If forwarding is active and unauthorised, toggle the setting to Off and click Save changes.

Reviewing Exchange Transport Rules

1. In the Microsoft 365 Admin Center, open the Admin centers menu and select Exchange.
2. Go to Mail flow > Rules.
3. Look for any rules that redirect messages to external domains.
4. Select the rule and click the Delete icon to remove it.

Warning: Disabling a forwarding rule stops the redirection, but it does not secure the account. If you suspect a credential breach, force a password reset and enable multi-factor authentication (MFA) immediately.

Protective Measures

• Enable multi-factor authentication (MFA) for all user accounts, especially those with administrative privileges.
• Restrict email forwarding to external domains via organisation-wide settings in the Exchange admin center.
• Regularly audit inbox rules and transport rules as part of your security maintenance schedule.
• Educate staff and volunteers about phishing emails that attempt to steal Microsoft 365 credentials.
• Monitor sign-in logs for unusual login locations or times.

Still Having Issues?