locked
Exchange and Office 365: Mail Forwarding to an external SMTP RRS feed

  • Question

  • Hi There

    We are currently using Office 365 and we have concern over the function Exchange (OWA) 365: Mail Forwarding to external SMTP. We have noticed some of our users are forwarding to their personal email address and we would like to monitor i.e. when the forwarding is being turned on etc.

    Is there is any function available to use?

    Thank you

    Monday, January 30, 2017 12:33 PM

All replies

  • Hello Bobby,

    Get-mailbox -Resultsize unlimited | Select DeliverToMailboxAndForward,ForwardingAddress,ForwardingSmtpAddress, primarysmtpaddress

    This command will hep you to extract the information on which mailboxes forwarding is set up 

    Similarly, you can disable the forwarding functionality by following below article:-

    - https://blogs.technet.microsoft.com/educloud/2012/07/05/turning-off-forwarding-in-exchange-online/

    Hope this helps


    • Edited by Akabe Monday, January 30, 2017 12:41 PM
    Monday, January 30, 2017 12:41 PM
  • thanks, is there is anyway we check when the forward is been setup?

    Thank you.

    Monday, January 30, 2017 1:06 PM
  • we have identifed the users, however we need to know how long this is being going on. Therefore we need to optain a audit log, when its been truned on and by which IP etc.

    Thanks

    Monday, January 30, 2017 1:11 PM
  • If the admin has enabled forwarding then it is traceable via Audit logs 

    However when ever the user sets it up it would be based on the inbox rules. 

    Monday, January 30, 2017 1:23 PM
  • If the admin has enabled forwarding then it is traceable via Audit logs 

    However when ever the user sets it up it would be based on the inbox rules. 

    Not if they set it in OWA, that's not a inbox rule.

    I would also recommend disabling auto forwarding in the remote domain in Office 365 if its allowed.


    Blog:    Twitter:   


    Monday, January 30, 2017 1:34 PM
  • thanks both,

    we have disable the function now, however we still dont when users enabled this via OWA:(.  we need to the logs for our investigation purpose.

    Monday, January 30, 2017 1:43 PM
  • thanks both,

    we have disable the function now, however we still dont when users enabled this via OWA:(.  we need to the logs for our investigation purpose.

    You can check the Office 365 logs for those users and see if anything shows up.

    I don't think setting the forwarding would be capture with the mailbox audit logs however - assuming they are enabled.


    Blog:    Twitter:   


    Monday, January 30, 2017 1:50 PM
  • Hi

    Following are the steps to monitor all user who are enabling forwarder on mailbox in 0365.

    1: First need to connect office 365  using windows powershell.(you can easily prerequisite on web)
    2:After connecting execute beneath  command for finding all user who were forwarder enabled

    Get-Mailbox | select UserPrincipalName,ForwardingSmtpAddress,DeliverToMailboxAndForward

    Hope this will help you.


    Kindly click "Mark as Answer" on the post that helps you, this can be beneficial to other community members reading this thread.

    Regards.

    H.shakir

    Monday, January 30, 2017 2:18 PM
  • Hi

    Following are the steps to monitor all user who are enabling forwarder on mailbox in 0365.

    1: First need to connect office 365  using windows powershell.(you can easily prerequisite on web)
    2:After connecting execute beneath  command for finding all user who were forwarder enabled

    Get-Mailbox | select UserPrincipalName,ForwardingSmtpAddress,DeliverToMailboxAndForward

    Hope this will help you.


    Kindly click "Mark as Answer" on the post that helps you, this can be beneficial to other community members reading this thread.

    Regards.

    H.shakir


    Akabe has already answered that. No need to repeat it.

    Blog:    Twitter:   

    Monday, January 30, 2017 2:34 PM
  • thanks, however we are trying to identify when the forward is been turned on.

    Thanks

    Monday, January 30, 2017 3:06 PM
  • Bobby,

    I dont think there is a way to accomplish this.

    As i said earlier, if an Admin has set the forwarding on a mailbox by running the command set-mailbox it will be traced in the admin audit logs (only applicable for last 90 days). Other than that setting forwarding does not leave a trail behind with a time stamp 


    • Edited by Akabe Monday, January 30, 2017 3:16 PM
    • Proposed as answer by David Wang_ Tuesday, January 31, 2017 6:42 AM
    Monday, January 30, 2017 3:13 PM
  • Note that Office 365 has user auditing logs in place that you should enable.

    https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c


    Blog:    Twitter:   


    Monday, January 30, 2017 5:41 PM
  • Have you considered searching each user's Sent Items folder?

    If they have setup a mailbox rule, you could see the items there?  Unless the user is sneaky and deleted them all, but then you could probably search the deleted-retention items.  Look at search-Mailbox.

    If the auto-forward was set on the user account (not a rule), then there would not be any data in the sent items as it would have been forwarded by the transport.  However, depending on how recent this may have occurred, you might also be able to search the transport logs to find messages that were sent TO the forwarding address(es).  If you have enough history, you may be able to find the first message that was sent.


    -Eriq VanBibber, CTO, Priasoft Inc.

    Tuesday, January 31, 2017 3:20 AM
  • Hi,

    According to your description, I understand you have identified the users, and want to know how long this forward is being going on.

    Please refer to suggestions above and review the mailbox audit logs.

    Here is the detailed infos about audit logs:

    https://technet.microsoft.com/en-us/library/jj150497%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396


    Best Regards,
    David Wang
    TechNet Community Support


    Please remember to mark the replies as answers if they helped.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, January 31, 2017 6:57 AM