The four paths
| Path | Set by | Visibility |
|---|---|---|
| Mailbox ForwardingSmtpAddress | User (OWA settings) | The BEC classic — silent, external-capable |
| Mailbox ForwardingAddress | Admin (to a recipient object) | The sanctioned internal pattern |
| Inbox rules (forward/redirect actions) | User or compromise | The OTHER BEC classic — granular, hideable |
| Transport rules | Admin | Org-level, auditable, the compliance-grade path |
The attacker preference (paths 1 and 3) is structural: user-settable, quiet, and they exfiltrate FUTURE mail continuously — which is why post-compromise checklists (BEC concept) start with these two.
The gate: outbound spam policy's forwarding control
Get-HostedOutboundSpamFilterPolicy's AutoForwardingMode is the org-level switch: Automatic (system-controlled — effectively blocking auto-forward externally for most tenants), On, or Off — applied per policy scope. Modern default posture: external auto-forward BLOCKED, with a scoped exception policy for the documented business cases (the ticketing mailbox that must forward to a vendor). The gate turns paths 1 and 3's external halves into NDRs — attackers' silent exfil becomes a bounced, logged event.
Note the gate's precision: it kills AUTO-forwarding (rules, mailbox settings); transport-rule redirects and genuine manual forwards live outside it — sanctioned paths stay sanctioned.
The audit loop (because the gate isn't everything)
Internal forwarding still exfiltrates across trust boundaries (contractor mailboxes, acquired-entity domains), rules can forward to internal drop-mailboxes, and exceptions age. So: enumerate mailbox forwarding (both properties) fleet-wide, enumerate inbox rules with forward/redirect actions (the heavier query — worth scheduling), diff week over week — NEW forwarding is the alert condition; the standing set is the reviewed allow-list.
What to watch (proofs)
- The gate's state: AutoForwardingMode per outbound-spam policy (nightly scan — drift on this switch is a top-tier security alert; it's the setting attackers flip when they get admin).
- The standing census: forwarding properties + forwarding rules fleet-wide, diffed on schedule — serv365's drift discipline applied to the highest-value mailbox property there is.
- Blocked-forward events: the NDRs/alerts when the gate refuses — each one is either a user to educate or an incident to open.
- Exception hygiene: the scoped allow policy's membership vs documented business cases — reviewed like TABL permanent allows (small, justified, owned).