How to View Users' Inbox Rules in Exchange Online

Monitoring mailboxes with forwarding rules is crucial for admins to prevent data leaks and unauthorized access. For example, an employee might set up a rule to forward emails containing sensitive data to an external personal account, which poses a significant security risk. Once a mailbox with suspicious forwarding rules is identified, admins can review and remove these rules or prevent the user from setting such rules.

To view all the mailboxes having forwarding rules in your Microsoft 365, use the following PowerShell script.

$mailboxes = Get-Mailbox -ResultSize Unlimited
$forwardingMailboxes = @()
foreach ($mailbox in $mailboxes) { 
  $rules = Get-InboxRule -Mailbox $mailbox.Alias
  foreach ($rule in $rules) { 
    if ($rule.ForwardTo -or $rule.ForwardAsAttachmentTo) { 
       $forwardingMailboxes += [PSCustomObject]@{ 
          Mailbox       = $mailbox.Alias
          RuleName      = $rule.Name
          ForwardTo     = $rule.ForwardTo -join ", "
          ForwardAsAttachmentTo = $rule.ForwardAsAttachmentTo -join ", "
            }
         }
     }
}
$forwardingMailboxes | Format-Table -AutoSize

While using PowerShell scripts to monitor forwarding rules is effective, it can be time-consuming. This method also needs to be run periodically, making it tedious.

• The Mailbox with Forwarding Inbox Rules report provided by AdminDroid makes it easy to identify email forwarding rules in user mailboxes.
• This in-depth report provides valuable insights into which mailboxes have forwarding enabled with other key details, aiding in tracking misconfigured rules.

Suspicious inbox forwarding rules pose significant security risks, as attackers often use them in Business Email Compromise (BEC) attacks. By setting up forwarding rules, attackers can automatically send copies of incoming emails to external addresses, allowing them to intercept sensitive information without detection. This makes it crucial to create alerts for the creation of forwarding rules in Microsoft 365 to promptly identify and mitigate these threats.

Here are the steps to create an alert for forwarding rules in Microsoft 365 Defender:

By following these steps, you can effectively create alerts for forwarding rules in Microsoft 365, enhancing your organization's ability to detect and respond to potential security threats promptly. However, these alerts are general and do not specify whether the forwarding rules are set to external or internal addresses. Determining this requires a thorough investigation of each rule, which can be tedious.

To effectively keep track of external forwarding rules, AdminDroid provides a report on Inbox Rule Configuration Changes with External Forwarding under Exchange Analytics. These reports offer detailed insights like event time, user who created, rule name, forwarding addresses, etc.

You can set up alert polices to notify you when an external forwarding inbox rule is created, in just a few clicks.

Tracking inbox rules removed by users in Microsoft 365 is crucial for various reasons:

In Microsoft 365, traditional methods for monitoring user-removed inbox rules have been deprecated. This has made it cumbersome for admins to track these changes, as there is currently no convenient built-in way to generate reports on removed inbox rules by users. The lack of straightforward tracking increases the risk of missing critical security and compliance issues.

• AdminDroid's audit reports not only showcase the rules removed by users but also include all rule operations performed by users, such as enabling and disabling rules.
• Navigate to Analytics»Exchange Analytics»Inbox Rule Audit in AdminDroid.
• Go to the Other Operations to access the Enabled/Disabled/Removed Inbox Rule Changes report.

In addition, AdminDroid provides granular details of every inbox rule and configuration in easily digestible charts and graphs. This comprehensive approach ensures admins have full visibility into inbox rule changes, enhancing security, compliance, and user accountability.

Have you heard of Outlook rules attacks? These attacks involve cybercriminals exploiting the rules feature to automate malicious actions such as deleting or exfiltrating sensitive emails. This can happen without the user's knowledge, making the attack hard to detect and allowing continued unauthorized access.

Given these risks, it's crucial to prevent compromised or suspicious users from creating harmful rules. While inbox rule creations can be disabled for all Outlook Web App users via the global setting OWAMailboxPolicy-Default, this might not be a viable option. So, let's walk through how to disable inbox rule options for a particular user in Microsoft 365:

Now apply this policy to the suspicious user using PowerShell:

Set-CASMailbox -Identity "<UPN>" -OWAMailboxPolicy "<PolicyName>" 

Once inbox rules are disabled for a user, they will no longer be able to create, manage, or access any rules. Additionally, any rules that were already created will also be inaccessible and cannot be modified by the user.