How to Setup email forwarding to external addresses on Microsoft 365

Last updated: February 19, 2026

Key Takeaways

• Microsoft 365 blocks external email forwarding by default to protect against data leaks and phishing attacks
• You must enable external forwarding at the admin level before individual mailboxes can forward to outside addresses
• Three methods exist for configuring forwarding: Admin Center, Outlook Web, and PowerShell
• Internal forwarding between Microsoft 365 users works without any special configuration
• Custom policies let you enable forwarding for specific users instead of your entire organisation

Quick Answer

To setup email forwarding to external addresses on Microsoft 365, you’ll first need a Global or Security Administrator to enable external forwarding in the Microsoft Defender portal’s outbound spam policy. Once that’s done, you can configure individual mailbox forwarding through the Microsoft 365 Admin Center, Outlook Web, or PowerShell. By default, Microsoft blocks all external forwarding to prevent security risks, so both steps are essential.

Why Microsoft 365 Blocks External Forwarding by Default

Microsoft 365 takes security seriously, and that’s why external email forwarding is disabled right out of the box.

This isn’t Microsoft being difficult. It’s actually protecting you from some very real threats. When employees set up automatic forwarding to personal Gmail or Yahoo accounts, they might accidentally expose sensitive business data. Compromised accounts can also be exploited to forward confidential emails to attackers without anyone noticing[3].

The default blocking happens through outbound spam filter policies. These policies control what happens when someone tries to automatically forward messages outside your organisation. Internal forwarding between Microsoft 365 users in your company works fine—it’s only external addresses that get blocked[3].

Common scenarios that trigger the block:

• Employee forwarding work email to their personal account
• Shared mailbox configured to forward to an external ticketing system
• Inbox rules that redirect messages to outside addresses
• SMTP forwarding set up at the mailbox level

Don’t worry, this is a common issue. We see this all the time when businesses first migrate to Microsoft 365 or when new employees try to set up their preferred email workflow.

Understanding the Three Forwarding Control Settings

Microsoft gives you three options for controlling automatic forwarding in your outbound spam policies[3].

“Automatic – System-controlled” is the default setting. In practice, this blocks external forwarding just like the “Off” setting. Microsoft manages this automatically, and it’s designed to keep you safe without you having to think about it.

“On – Forwarding is enabled” does exactly what it says. When you select this, users can forward emails to external addresses using either mailbox forwarding or Inbox rules. This is what you’ll need to enable if you want to setup email forwarding to external addresses on Microsoft 365.

“Off – Forwarding is disabled” explicitly blocks all external forwarding. Any attempt to forward results externally in a non-delivery report (NDR) will bounce back to the sender. This is the most secure option if you never want external forwarding under any circumstances.

The most restrictive setting always wins. If you have one policy saying “yes” and another saying “no,” forwarding gets blocked. This layered approach means you can’t accidentally create a security hole[3].

How to Enable External Forwarding at the Admin Level

Before anyone can forward emails externally, a Global or Security Administrator must authorise it in the Microsoft Defender portal[4].

Here’s the step-by-step process:

1. Sign in to the Microsoft 365 Defender portal at security.microsoft.com
2. Navigate to Email & collaboration in the left sidebar
3. Select Policies & rules, then Threat policies
4. Click Anti-spam from the policy list
5. Choose the Anti-spam outbound policy (Default)
6. Click Edit protection settings (you’ll find this at the bottom of the sidebar)
7. Scroll to the Forwarding rules section
8. Change the Automatic forwarding rules dropdown from “Automatic – System-controlled” to “On – Forwarding is enabled”
9. Click Save to apply the changes[4]

Better security practice: Instead of enabling forwarding for everyone, create a custom outbound policy that only applies to specific users or groups who genuinely need it. This limits your exposure while still allowing legitimate use cases[6].

For example, you might create a policy just for your customer service team who need to forward tickets to an external helpdesk system. Everyone else remains protected by the default blocking policy.

If you’re not comfortable making these changes yourself, our Microsoft 365 setup service can handle the entire configuration for you. We come to you, and most problems can be fixed within an hour.

Setting Up Individual Mailbox Forwarding (Three Methods)

Once external forwarding is enabled at the policy level, you can configure the actual forwarding for individual mailboxes.

Method A: Microsoft 365 Admin Center (Recommended for Admins)

This is the easiest method if you’re managing forwarding for other users[8].

1. Go to admin.microsoft.com and sign in
2. Navigate to Users > Active users
3. Select the user whose email you want to forward
4. Click the Mail tab in the user details panel
5. Click Manage email forwarding
6. Toggle Forward all emails sent to this mailbox to On
7. Enter the external email address in the field provided
8. Optionally, check Keep a copy of forwarded emails in this mailbox if you want to retain messages
9. Click Save changes

The forwarding takes effect immediately. No waiting, no delays.

Method B: Outlook Web (For End Users)

Users can set up their own forwarding if they have the right permissions[7][9].

1. Sign in to Outlook on the web (outlook.office.com)
2. Click the Settings gear icon in the top right
3. Select Mail from the settings panel
4. Click Forwarding in the left menu
5. Select Enable forwarding
6. Enter the external email address
7. Choose whether to keep a copy of forwarded messages
8. Click Save

Common mistake: Users sometimes set up Inbox rules instead of proper forwarding. Inbox rules are less reliable and can be accidentally disabled. Mailbox forwarding is more robust and survives mailbox migrations.

Method C: PowerShell (For Bulk Updates)

If you need to configure forwarding for multiple mailboxes, PowerShell is your friend[8].

First, connect to Exchange Online PowerShell:

<code class="language-powershell">Connect-ExchangeOnline
</code>

Then set up forwarding for a single mailbox:

<code class="language-powershell">Set-Mailbox -Identity "[email protected]" -ForwardingSmtpAddress "[email protected]" -DeliverToMailboxAndForward $true
</code>

The -DeliverToMailboxAndForward $true parameter keeps a copy in the original mailbox. Set it to $false if you want all mail forwarded without keeping copies.

For bulk operations, you can pipe multiple users:

<code class="language-powershell">Get-Mailbox -Filter {Department -eq "Sales"} | Set-Mailbox -ForwardingSmtpAddress "[email protected]" -DeliverToMailboxAndForward $true
</code>

Need help with email setup support? We’ve got 17+ years experience with Microsoft 365 configurations. Same-day service available across London, Berkshire, and Surrey.

Creating Targeted Forwarding Policies for Specific Users

You don’t have to enable external forwarding for your entire organisation. Custom policies give you granular control[6].

When to use targeted policies:

• Only certain departments need external forwarding (like customer service)
• You want to allow forwarding to trusted partner domains only
• Compliance requirements restrict forwarding for most users
• You’re testing external forwarding before rolling it out widely

How to create a custom outbound spam policy:

1. In the Microsoft 365 Defender portal, go to Anti-spam policies
2. Click Create policy and select Outbound
3. Name your policy something descriptive like “Customer Service External Forwarding”
4. Under Applied to, specify the users, groups, or domains this policy covers
5. In the Forwarding rules section, select “On – Forwarding is enabled”
6. Set the priority higher than the default policy (lower number = higher priority)
7. Save the policy

The key is in the priority order. Policies are evaluated from highest to lowest priority. If a user matches multiple policies, the first matching policy applies.

Choose targeted policies if: You have specific business units that need external forwarding, you want tighter security for most users, or you’re in a regulated industry.

Choose organisation-wide enabling if: Everyone legitimately needs external forwarding, you’re a small team with simple requirements, or you have other security controls in place.

Using Transport Rules to Control Forwarding

Transport rules (also called mail flow rules) give you even more precise control over external forwarding[5].

These rules can override default restrictions or add additional filtering based on specific criteria. For example, you might allow forwarding from a shared mailbox only when the subject line contains “[TICKET]”.

Example scenario: Your support team uses a shared mailbox ([email protected]) that needs to forward certain messages to an external ticketing system, but you want to keep external forwarding blocked for everyone else.

Transport rule configuration:

1. Go to Exchange admin center (admin.exchange.microsoft.com)
2. Navigate to Mail flow > Rules
3. Click Add a rule > Create a new rule
4. Name it “Allow External Forwarding for Support Tickets”
5. Set condition: The sender > is > [email protected]
6. Add condition: The subject includes > [TICKET]
7. Set action: Modify the message properties > Set a message header
8. Save the rule

Transport rules are evaluated before outbound spam policies, so they can effectively create exceptions to your broader forwarding restrictions.

Edge case to watch: If you disable external forwarding in the outbound spam policy but create a transport rule to allow it, the spam policy still blocks it. Transport rules can’t override the fundamental spam filter block—you still need the outbound policy set to “On” for the specific users or organisation-wide[5].

For complex mail flow configurations, our business email support team can design and implement the right solution for your needs.

Troubleshooting Common External Forwarding Issues

Even after enabling external forwarding, you might run into problems. Here’s how to fix the most common issues.

Forwarding Still Blocked After Enabling Policy

Symptom: You’ve enabled external forwarding in the outbound spam policy, but messages still aren’t forwarding.

Solution: Check if you have conflicting settings in Remote Domains. Go to Exchange admin center > Mail flow > Remote domains > Default. Make sure “Allow automatic forwarding” is checked. If it’s unchecked, it overrides your outbound spam policy[1].

Also verify that you’ve waited 30-60 minutes after changing the policy. Policy changes aren’t always instant.

Non-Delivery Reports (NDRs) for Forwarded Messages

Symptom: Users receive bounce messages saying forwarding failed.

Solution: The NDR usually contains a specific error code. Common ones include:

• 5.7.520: External forwarding is disabled by policy
• 5.7.1: You don’t have permission to forward to external addresses
• 5.7.136: The recipient domain is blocked

Check your outbound spam policy settings and make sure the user is covered by a policy that allows external forwarding[3].

Forwarding Works for Some Users But Not Others

Symptom: Inconsistent forwarding behaviour across your organisation.

Solution: You likely have multiple outbound spam policies with different settings. Check policy priority and scope. Remember, the most restrictive policy wins if there’s any conflict.

Run this PowerShell command to see all policies and their settings:

<code class="language-powershell">Get-HostedOutboundSpamFilterPolicy | Select Name, AutoForwardingMode
</code>

Look for policies where AutoForwardingMode is set to “Off” or “Automatic” (which blocks forwarding).

Forwarding Stops Working After Mailbox Migration

Symptom: Forwarding was working fine, then stopped after moving mailboxes.

Solution: Mailbox migrations sometimes reset forwarding settings. Re-apply the forwarding configuration using the Admin Center or PowerShell methods described earlier.

Also check if the migration moved users into a different policy scope. They might now be covered by a restrictive policy that blocks external forwarding.

If you’re struggling with Microsoft Outlook sync issues or other email problems, we can diagnose and fix them remotely or on-site. You only pay if we fix it.

Security Best Practices for External Email Forwarding

Enabling external forwarding creates potential security risks. Here’s how to minimise them while maintaining functionality.

Audit forwarding rules regularly. Set up a monthly review process to check who has external forwarding enabled. You’d be surprised how many orphaned forwards exist for employees who left months ago.

Use this PowerShell command to generate a report:

<code class="language-powershell">Get-Mailbox -ResultSize Unlimited | Where {$_.ForwardingSmtpAddress -ne $null} | Select Name, ForwardingSmtpAddress, DeliverToMailboxAndForward | Export-CSV C:ForwardingReport.csv
</code>

Enable audit logging. Microsoft 365 audit logs track when forwarding rules are created or modified. This helps you detect unauthorised changes quickly.

Educate users about phishing risks. Attackers who compromise an account often set up forwarding rules to steal data. Train your team to recognise phishing attempts and use strong passwords.

Implement multi-factor authentication (MFA). Even if a password is compromised, MFA prevents attackers from accessing the account to set up malicious forwarding rules.

Consider Data Loss Prevention (DLP) policies. DLP can block forwarding of messages containing sensitive information like credit card numbers or confidential project data, even when general external forwarding is enabled.

Use conditional access policies. Restrict who can modify forwarding settings based on location, device compliance, or risk level.

Monitor for unusual activity. Set up alerts for sudden spikes in external forwarding or forwarding to suspicious domains.

For comprehensive cybersecurity solutions and ongoing monitoring, our managed IT services provide 24/7 protection for small businesses across London and the surrounding areas.

When to Allow External Forwarding vs. Alternative Solutions

External forwarding isn’t always the best solution. Sometimes there are better alternatives that maintain security while achieving the same goal.

Allow external forwarding when:

• Employees legitimately need to monitor work email from a personal account during transitions
• You’re integrating with external ticketing or CRM systems that require email forwarding
• Temporary contractors need access without creating full Microsoft 365 licenses
• You have strong DLP and security monitoring in place

Consider alternatives when:

• Users just want to check email on mobile devices (use the Outlook mobile app instead)
• You need to share emails with external partners (use shared mailboxes or distribution lists)
• Employees are retiring or leaving (configure delegate access for handover instead)
• You’re concerned about data leakage (implement stricter access controls and monitoring)

Better alternatives to external forwarding:

Shared mailboxes: Instead of forwarding a departmental mailbox externally, give external partners access to a shared mailbox within your Microsoft 365 environment. This keeps data under your control.

Microsoft 365 guest accounts: Add external users as guests with limited permissions. They can access specific resources without you losing visibility or control.

Email delegation: Grant delegate access so another internal user can manage the mailbox. This works well for executive assistants or team coverage.

Microsoft Teams integration: For external collaboration, Teams provides secure channels for communication without exposing email forwarding.

Third-party integration tools: Services like Power Automate can route messages to external systems with more granular control than simple forwarding.

Our Office 365 support team can help you evaluate which approach makes the most sense for your specific situation. We’ll explain the pros and cons in plain English, no jargon.

FAQ

Does enabling external forwarding affect all users in my organisation?

Not necessarily. If you enable it in the default outbound spam policy, yes, all users can then forward externally. But you can create custom policies that only apply to specific users, groups, or departments. This lets you enable forwarding for your customer service team while keeping it blocked for everyone else.

Can I forward to multiple external addresses from one mailbox?

Not directly through the built-in forwarding settings. You can only specify one external forwarding address per mailbox. However, you can create Inbox rules that forward to multiple addresses, or set up a distribution list at the external destination that then redistributes to multiple recipients.

Will forwarded emails show my original email address or the forwarding address?

Forwarded emails retain the original sender’s address in the “From” field. The recipient sees who originally sent the message, not your forwarding mailbox address. However, the email headers will show it was forwarded through your Microsoft 365 tenant.

What happens to emails when I disable external forwarding?

If you disable external forwarding while it’s actively configured, new incoming emails will bounce back to the sender with a non-delivery report (NDR). Emails already in the mailbox aren’t affected. The forwarding configuration remains in place but becomes inactive—if you re-enable external forwarding later, it will resume automatically.

Does external forwarding work with shared mailboxes?

Yes, but with some caveats. Shared mailboxes can forward to external addresses using the same methods as regular mailboxes. However, you need to ensure the outbound spam policy covers shared mailboxes specifically, as some organisations exclude them from certain policies for security reasons[1].

Can I forward only specific emails based on subject or sender?

Yes, but not through the basic mailbox forwarding feature. You’ll need to use Inbox rules or transport rules (mail flow rules) to create conditional forwarding. For example, you can forward only emails from a specific client or with “URGENT” in the subject line. This requires the external forwarding policy to be enabled first.

How long does it take for forwarding changes to take effect?

Mailbox forwarding changes typically take effect within 5-10 minutes. Outbound spam policy changes can take 30-60 minutes to propagate across all Microsoft servers. If forwarding isn’t working immediately after configuration, wait an hour before troubleshooting.

Will I still receive emails in my original mailbox if forwarding is enabled?

That depends on your configuration. When setting up forwarding, you’ll see an option to “deliver to mailbox and forward” or just forward. If you enable “deliver to mailbox and forward,” you’ll keep copies in both places. If you disable it, emails only go to the forwarding address.

Can external recipients reply to forwarded emails?

Yes, but the reply goes to the original sender, not to your forwarding mailbox. This can create confusion if you’re monitoring emails through a forwarded address. For two-way communication, consider using delegation or shared mailbox access instead.

Is there a limit to how many emails can be forwarded?

Microsoft 365 has sending limits that apply to forwarded messages. The default limit is 10,000 recipients per day for regular mailboxes. If you exceed this, forwarding will temporarily stop. For high-volume forwarding scenarios, you may need to request limit increases or use alternative solutions.

Does forwarding work with encrypted emails?

Encrypted emails (using Microsoft 365 Message Encryption or S/MIME) can be forwarded, but the recipient must have the appropriate decryption keys or credentials to read them. In many cases, external recipients won’t be able to decrypt forwarded encrypted messages, which defeats the purpose of forwarding.

Can I set up automatic forwarding for emails received in the past?

No, mailbox forwarding only applies to new incoming emails. It doesn’t retroactively forward messages already in your mailbox. If you need to move existing emails to an external address, you’ll need to manually forward them or use an email migration tool.

Key Takeaways

• Microsoft 365 blocks external email forwarding by default as a security measure to prevent data leaks and phishing attacks
• To setup email forwarding to external addresses on Microsoft 365, administrators must first enable it in the outbound spam policy through the Microsoft Defender portal
• Three configuration methods are available: Microsoft 365 Admin Center (easiest for admins), Outlook Web (for end users), and PowerShell (for bulk operations)
• Custom outbound spam policies let you enable forwarding for specific users or departments while keeping it blocked for everyone else
• Transport rules provide additional control for conditional forwarding based on sender, subject, or other criteria
• Internal forwarding between Microsoft 365 users always works without any special configuration
• The most restrictive policy always wins when multiple policies conflict, ensuring security isn’t accidentally compromised
• Regular auditing of forwarding rules helps identify orphaned configurations and potential security risks
• Alternative solutions like shared mailboxes, guest accounts, and delegation often provide better security than external forwarding
• Policy changes can take 30-60 minutes to propagate, so don’t panic if forwarding doesn’t work immediately

Conclusion

Setting up email forwarding to external addresses on Microsoft 365 requires two essential steps: enabling external forwarding at the admin policy level, then configuring individual mailbox forwarding.

The process isn’t complicated, but it’s deliberately designed with security in mind. Microsoft blocks external forwarding by default because it’s a common vector for data leaks and phishing attacks. By requiring explicit administrator approval, Microsoft 365 ensures you’re making an informed decision about the security trade-offs.

Start by evaluating whether you genuinely need external forwarding or if alternatives like shared mailboxes or delegation would work better. If external forwarding is the right choice, create targeted policies that only enable it for users who need it. This limits your exposure while maintaining functionality.

Remember to audit your forwarding configurations regularly. Set a calendar reminder to review who has external forwarding enabled every month. Remove outdated forwards for employees who’ve left or changed roles.

If you’re feeling overwhelmed or unsure about the right approach for your business, that’s completely normal. Email security can be complex, and you don’t need to be technical—that’s our job.

At Verge Tech Solutions, we’ve been helping businesses across London, Berkshire, and Surrey with Microsoft 365 setup and email configuration for over 17 years. We come to you, explain everything in plain English, and most problems can be fixed within an hour.

Whether you need help with the initial setup, troubleshooting forwarding issues, or implementing comprehensive security policies, we’re here to help. Same-day service is available, and you only pay if we fix it. No call-out fees, just straightforward IT support from people who actually pick up the phone.

Don’t let email forwarding headaches slow down your business. Get in touch with our team today for expert help you can trust.

References

[1] Allow External Outside Email To Automatically Be F – https://learn.microsoft.com/en-us/answers/questions/5454488/allow-external-outside-email-to-automatically-be-f

[2] 217597207 Set Up Microsoft 365 Email Forwarding – https://support.atera.com/hc/en-us/articles/217597207-Set-up-Microsoft-365-email-forwarding

[3] Outbound Spam Policies External Email Forwarding – https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding

[4] 1424 Enable External Forwarding In Microsoft 365 – https://docs.helpscout.com/article/1424-enable-external-forwarding-in-microsoft-365

[5] Exchange Online Forwarding Email External – https://learn.microsoft.com/en-us/answers/questions/5754812/exchange-online-forwarding-email-external

[6] How To Allow External Email Forwarding In Entire O – https://learn.microsoft.com/en-us/answers/questions/5551286/how-to-allow-external-email-forwarding-in-entire-o

[7] Forward My Microsoft 365 Email To A Different Email Account 20078 – https://www.godaddy.com/help/forward-my-microsoft-365-email-to-a-different-email-account-20078

[8] Configure Email Forwarding – https://learn.microsoft.com/en-us/microsoft-365/admin/email/configure-email-forwarding?view=o365-worldwide

[9] Forwarding Your Microsoft 365 Email – https://its.uiowa.edu/services/microsoft-365-email-calendaring/forwarding-your-microsoft-365-email