Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / Azure and Microsoft 365 / Forwarding Emails to an External Address in Microsoft 365 (Exchange Online)

March 17, 2024

Forwarding Emails to an External Address in Microsoft 365 (Exchange Online)

By default, cloud-based Exchange Online (Microsoft 365) prevents automatic external email forwarding using Outlook rules or enabled mailbox forwarding.

If you create an inbox rule in an Exchange Online mailbox (using Outlook or PowerShell) to automatically forward incoming emails from your mailbox to an external email address, you will see the NDR message when trying to forward an email using the rule:

Your message wasn't delivered because the recipient's email provider rejected it.
Remote Server returned '550 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)'

Access denied error message when setting up email forwarding in exchnage online ('550 5.7.520 Access denied, Your organization does not allow external forwarding)

You may see the same message when you check the message trace in Microsoft 365.

Office 365 received the message that you specified, but couldn't deliver it to the recipient ([email protected]‎) due to the following error:
Error: ‎550 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)‎

Office 365 received the message that you specified, but couldn't deliver it to the recipient (external_adress@gmail.com‎) due to the following error Error: ‎550 5.7.520 Access denied, Your organization does not allow external forwarding.

You can allow automatic email forwarding for the whole organization or specific mailboxes in the Security and Compliance settings of your Microsoft 365 tenant. Go to https://protection.office.com -> Threat Management -> Policy -> Anti-Spam Policy.

If you want to allow external forwarding for all Microsoft 365 mailboxes, edit the Anti-spam outbound policy (Default). In our example, we’ll only allow external email forwarding for specific tenant users or groups. This option is preferable from the security point of view.

  1. Create a new anti-spam outbound policy;
  2. Set the policy name;
  3. Then select the users and/or groups that you want to allow external forwarding;
    enable automatic external forwarding for individual mailboxes in exchange online
  4. In the Forwarding rules section, select Automatic forwarding rules -> On Forwarding is enabled;Enable External Forwarding in Microsoft 365
  5. Save your anti-spam policy.

Then all users you have specified will be able to enable automatic external forwarding rules in their Microsoft 365 mailboxes.

There is another policy in Exchange Online that allows you to configure trusted domains to send OutOfOffice auto-replies and enable automatic email forwarding. It is the Remote Domain. However, anti-spam policy settings take precedence, you can use the Remote Domain option to create a list of trusted and untrusted external domains.

The Default policy in the Remote domain denies nothing. But you can change its settings or add your own rules for the specific domains:

  1. Open Mail flow -> Remote domains -> Add a remote domain in the Exchange Admin Center;
  2. Enter the domain name;
  3. Select what types of automatic replies you want to allow for this domain. Check Allow automatic forwarding;

MIcrosft 365: Allow automatically forwarded messages to be sent to recepients in the remote domain

You can also add trusted domains and configure remote domain allowed rules using PowerShell.

Connect to your Microsoft 365 tenant using the Exchange Online PowerShell module v3 (EXO V3). The following commands allow all types of automatic replies and forwarding for the woshub.com domain and all its subdomains:

New-RemoteDomain -Name "WOSHub and subdomains" -DomainName *.woshub.com
Set-RemoteDomain -Identity "WOSHub and subdomains" -AutoReplyEnabled $true -AutoForwardEnabled $true -AllowedOOFType InternalLegacy

You can display the full list of configured Remote Domain rules as follows:

Get-RemoteDomain Default | fl AllowedOOFType, AutoReplyEnabled, AutoForwardEnabled

You can use remote domains along with Microsoft 365 anti-spam filters for granular control over allowed domains to automatically forward messages from your tenant. For example, you can allow forwarding for the specific mailboxes in your anti-spam filter and deny automatic forwarding to free email services (gmail.com, outlook.com, etc.) using Remote Domains.

To audit enabled automatic forwarding rules in Office 365, you may use the PowerShell script below that will find and display all Outlook forwarding rules in all tenant mailboxes:

$mailboxes=get-mailbox –resultSize unlimited
$rules = $mailboxes | foreach { get-inboxRule –mailbox $_.alias }
$rules | where { ( $_.forwardAsAttachmentTo –ne $NULL ) –or ( $_.forwardTo –ne $NULL ) –or ( $_.redirectTo –ne $NULL ) }  | ft name, MailboxOwnerId, ForwardTo, Description

Remember that an administrator can also enable external forwarding rules on the entire mailbox level:

Set-Mailbox maxbak -ForwardingsmtpAddress [email protected] -DeliverToMailboxAndForward $true

You can find users with the enabled mail forwarding as shown below:

Get-Mailbox -ResultSize Unlimited -Filter "ForwardingAddress -like '*' -or ForwardingSmtpAddress -like '*'" | Select-Object Name,ForwardingAddress,ForwardingSmtpAddress

In on-premises Exchange Servers, you could create an AD contact or a mail-enabled user with an external email address and configure external forwarding for it. Such a contact will be trusted for the entire Exchange organization.

This method doesn’t work in Exchange Online. However, you will be able to create a contact using the EAC (https://admin.exchange.microsoft.com/ -> Recipients -> Contacts -> Add a contact) or PowerShell (New-MailContact -Name "ext-Andy.Thompson" -ExternalEmailAddress [email protected]). When you send an email to it, the NDR “’550 5.7.520” will still appear.

0 comment
2
Facebook Twitter Google + Pinterest
Azure and Microsoft 365ExchangePowerShell
previous post
Updating List of Trusted Root Certificates in Windows
next post
Fix: Microsoft Outlook Search Not Working on Windows 10/11

Related Reading

Outlook Keeps Asking for Password on Windows

March 17, 2024

How to Increase Attachment Size Limit in Outlook

March 15, 2024

Get a List of Mailboxes a User Has...

March 15, 2024

How to Manually Configure Exchange or Microsoft 365...

March 17, 2024

Checking User Sign-in Logs in Entra ID (Microsoft...

March 15, 2024

Configuring UserPrincipalName and UPN Suffixes in Active Directory

March 11, 2024

Fix: Microsoft Outlook Search Not Working on Windows...

March 17, 2024

How to Send a Message to Teams Channel...

March 13, 2024

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Recent Posts

  • Configuring Windows Protected Print Mode (WPP)

    May 19, 2025
  • Map a Network Drive over SSH (SSHFS) in Windows

    May 13, 2025
  • Configure NTP Time Source for Active Directory Domain

    May 6, 2025
  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • Outlook Keeps Asking for Password on Windows
  • Checking User Sign-in Logs in Entra ID (Microsoft 365)
  • How to Manually Configure Exchange or Microsoft 365 Account in Outlook 365/2019/2016
  • Search and Delete Emails from User Mailboxes on Exchange Server (Microsoft 365) with PowerShell
  • Configuring Password Policy in Microsoft Entra ID
  • Fix: Microsoft Outlook Search Not Working on Windows 10/11
  • Blank Sign-in Screen in Office 365 Apps (Outlook, Teams, etc.)
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top