Applies to: Microsoft 365 / Outlook work mailboxes
Summary
Automatic forwarding of work email to outside addresses (such as Gmail, Yahoo, Outlook.com, iCloud, or other personal accounts) is blocked. This is a default security measure in Microsoft 365, and it is kept in place to protect company and client information. Your work mailbox itself is not affected, and email continues to arrive there normally.
What you might notice
- Work email that used to show up in your personal inbox has stopped arriving there.
- You set up a forwarding rule in Outlook, but messages never reach the outside address.
- People who email you receive a bounce message that includes:
550 5.7.520 Access denied, Your organization does not allow external forwarding
Why this change was made
1. Microsoft blocks it by default
Microsoft 365 includes an outbound security policy that controls automatic forwarding to outside addresses. Its default setting blocks that forwarding. Turning it on means deliberately switching off a protection Microsoft built in.
2. Forwarding rules are a favourite tool of attackers
After stealing someone's password, an attacker often adds a hidden rule that forwards all incoming mail to an account they control. That rule keeps working even after the password is changed, so the attacker can keep reading invoices, payment requests, and password-reset emails without being noticed. Blocking outside forwarding for everyone closes off this whole category of attack.
3. Company data leaves company control
Forwarded email ends up in an account the organization can't secure, back up, search, or remove access to. Client details, contracts, financial records, and personal information would sit outside our protections, which can create privacy and compliance obligations. When an employee leaves, copies would also remain in their personal account indefinitely.
4. Forwarded email often isn't delivered reliably
Gmail and other providers check that incoming messages come from the server they claim to come from. Forwarded messages often fail these checks (known as SPF, DKIM, and DMARC). As a result, they may be delayed, sent to spam, or rejected without warning. Large volumes of forwarded mail can also make the organization look like a spam source, which can hurt email delivery for everyone.
Recommended alternatives
You can still get your work email anywhere, securely:
- On your phone: Install the Microsoft Outlook app (iOS or Android) and sign in with your work email address. You'll get email, calendar, contacts, and notifications.
- On any computer: Go to outlook.office.com and sign in with your work account.
- On your work computer: Use the Outlook desktop app.
These options keep your email protected by the organization's security, including multi-factor authentication, and work on any device.
Need an exception?
If there is a specific business reason for one mailbox to forward to one particular outside address, submit a request to the support team with:
- The mailbox that needs to forward
- The outside address it should forward to
- The business reason and how long the exception is needed
Each request is reviewed on its own merits. Approved exceptions are limited to the specific mailbox and destination and may be reviewed periodically.
Frequently asked questions
Is my work email broken?
No. Your work mailbox is receiving email normally. Only the copy to your outside account has stopped.
Can I forward individual emails by hand?
Yes. Manually forwarding a specific message is still possible. Please be careful with anything containing client, financial, or personal information, and follow your organization's data-handling policies.
Can I forward to a colleague's work address instead?
Yes. Forwarding within the organization is not affected by this block.
Will this setting change back?
Not by default. It is a deliberate security control, and exceptions are handled one at a time through support.
Comments
Article is closed for comments.