Replace ambiguous automatic-forwarding settings with an explicit decision

Source facts

For Exchange Online outbound spam policies, Automatic – System-controlled is not a uniform assurance that external forwarding is blocked. Microsoft documents that its historical behavior can remain enabled in some existing organizations and recommends choosing an explicit On or Off value. Off disables external redirection through both Inbox rules and mailbox forwarding; internal forwarding is outside this control. Microsoft Learn.

Failure notifications also differ: external senders receive non-delivery reports for either method, but an internal sender does not receive one when an Inbox rule performs the blocked forwarding. Internal senders receive a report for blocked mailbox forwarding. Microsoft Learn.

Applicability

Review Exchange Online outbound spam policies controlling automatic forwarding to external recipients. This decision concerns automatic redirection, not an assumption that every kind of message forwarding shares the same control.

DSE recommendation

DSE recommends replacing an ambiguous inherited value with the explicitly approved behavior after identifying legitimate external forwarding requirements. Record the effective policy and the affected mailboxes before changing it. If forwarding is intentionally permitted, state that decision directly instead of relying on the interpretation of Automatic. Keep the approval separate from evidence that a particular delivery succeeded.

Verification

Use approved test recipients to exercise Inbox-rule and mailbox forwarding with both internal and external senders. Compare the actual destination result with the expected notification for each combination. Do not interpret the absence of a non-delivery report as proof of successful forwarding. Retain the four-case result with the selected policy value.

Official references

Microsoft Learn: Configure outbound spam policies.