How to Set Up Email Forwarding in Microsoft 365

Email forwarding in Microsoft 365 is one of those tasks that’s simple until it isn’t. Forwarding to a colleague down the hall works on the first try. Forwarding to a personal Gmail address silently fails, and you spend twenty minutes convinced you set it up wrong — when actually Microsoft is blocking it on purpose. The trick is knowing which forwarding method to use and understanding why external forwarding behaves differently from internal.

This guide covers the two ways to forward (admin-set mailbox forwarding and user inbox rules), how to keep a copy in the original mailbox, the difference between internal and external destinations, and the security setting that blocks external forwarding by default.

Two ways to forward, and when to use each#

There are two distinct places forwarding can be configured, and they behave differently.

Mailbox forwarding is set on the mailbox object by an admin and applies to every message that arrives, no matter what. It’s the right choice for a departed employee whose mail should go to their manager, or a role address that should land with a specific person.

Inbox rules are created by the user in Outlook or OWA and can forward conditionally — only mail from a certain sender, or containing a keyword. They give the user control but depend on rule processing and can be changed or deleted by the user at any time.

Setting mailbox forwarding in the admin center#

This is the most common admin task. To forward all of a user’s incoming mail:

1. Go to the Microsoft 365 admin center → Users → Active users.
2. Select the user, open the Mail tab.
3. Under Email forwarding, choose Manage email forwarding.
4. Turn on Forward all emails sent to this mailbox and enter the forwarding address.
5. Decide whether to tick Keep a copy of forwarded messages (this is deliver-and-forward).
6. Save.

You can do the same in the Exchange admin center under the mailbox’s Mailbox delegation / Others settings, which exposes the same forwarding address and deliver-and-forward options.

Deliver and forward: keep a local copy#

By default, forwarding moves the message on without keeping it. If you want the original mailbox to retain a copy and forward — useful when someone is covering for a colleague but the original mailbox still needs the record — enable deliver and forward.

Doing it in PowerShell#

For scripting or bulk changes, Exchange Online PowerShell is faster than clicking through each mailbox.

Connect-ExchangeOnline

# Forward to an internal recipient and keep a copy in the original mailbox
Set-Mailbox -Identity "[email protected]" `
  -ForwardingAddress "[email protected]" `
  -DeliverToMailboxAndForward $true

# Forward to an EXTERNAL address (uses ForwardingSmtpAddress)
Set-Mailbox -Identity "[email protected]" `
  -ForwardingSmtpAddress "[email protected]" `
  -DeliverToMailboxAndForward $false

Note the two different parameters: ForwardingAddress takes an internal recipient object, while ForwardingSmtpAddress takes a raw SMTP address and is what you use for external destinations. To check what’s already set across your tenant:

# Find every mailbox with forwarding configured
Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.ForwardingAddress -or $_.ForwardingSmtpAddress } |
  Select-Object DisplayName, ForwardingAddress, ForwardingSmtpAddress, DeliverToMailboxAndForward

That audit query is worth running periodically on its own — unexpected ForwardingSmtpAddress values pointing to outside addresses are a classic sign of a compromised account quietly exfiltrating mail.

User-side: forwarding with an inbox rule#

When the user wants to control forwarding themselves, an inbox rule is the way. In Outlook on the web:

1. Settings → Mail → Rules → Add new rule.
2. Name it, set a condition (or “Apply to all messages”).
3. Add the action Forward to (or Redirect to) and enter the address.
4. Save.

There’s a meaningful difference between Forward and Redirect: forwarding sends a new message from the user with the original attached/inlined, while redirect passes the message along keeping the original sender, so replies go back to the original sender rather than the forwarding user. Choose redirect when you want the recipient to reply to whoever sent it originally.

Internal vs external: the part that catches everyone#

Forwarding to another mailbox inside your tenant is straightforward and works immediately. Forwarding to an address outside your organization — a personal account, a partner, a different company — is where things stop “just working.”

Microsoft 365 blocks automatic external forwarding by default. This isn’t a bug. Attackers who compromise an account frequently set up silent external forwarding to siphon off a copy of everything the victim receives. To shut that down, the default outbound anti-spam policy stops automatic external forwarding for everyone unless an admin explicitly allows it.

To permit external forwarding when it’s genuinely needed, adjust the outbound spam filter policy in the Defender portal (Email & collaboration → Policies & rules → Threat policies → Anti-spam → Outbound), where the Automatic forwarding setting controls whether forwards are blocked (default/automatic) or allowed. You can scope a separate outbound policy to only the users who should be allowed to forward externally.

A note on forwarding and security#

Because external forwarding is such a reliable exfiltration trick, the safe default is to leave it blocked and only open it where there’s a real business need. If you’re tightening this up after finding rogue forwards — or just hardening a tenant — our guide on stopping auto-forwarding of emails in Microsoft 365 walks through locking it down and catching the inbox rules attackers hide.

When a forward involves SPF, DKIM, or DMARC on the receiving end, the destination domain may reject mail that appears to come from your domain via the forward. That’s a deliverability issue on the other side, separate from whether Microsoft 365 lets the forward out.

Wrapping up#

Pick mailbox forwarding for permanent, admin-controlled routing and inbox rules for flexible, user-driven forwarding. Turn on deliver-and-forward when the original mailbox still needs the message. Internal forwarding works out of the box; external forwarding is blocked by default as an anti-exfiltration measure, so expect to allow it deliberately through the outbound spam policy when there’s a real need. And audit your tenant’s forwarding settings now and then — unexpected external forwards are often the first sign of a compromised account.

If forwarding is part of routing mail for a shared role or a departed user, you may also want to look at tracing a message in Exchange Online to confirm where forwarded mail actually ends up.