How to export inbox rules in Exchange Online

Before you start

Use an account in the Organization Management role group in Exchange Online, which the Exchange Administrator role in Microsoft Entra ID gives. The audit search in Option 2 needs the Audit Logs or View-Only Audit Logs role in Microsoft Purview.

The script reads 1 mailbox at a time, so a large tenant takes a while. The audit log keeps records for 180 days, or 1 year for users with an E5 licence. The examples read and export rules; they change nothing.

Option 1

Export inbox rules with PowerShell

Install the module once, then export every rule in every user and shared mailbox. Each mailbox is read with and without hidden rules, so the hidden ones can be marked.

# Install once, if the module is not already installed.
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline -ShowBanner:$false
try {
    $types = 'UserMailbox', 'SharedMailbox'
    $mailboxes = Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails $types
    $report = @(foreach ($mailbox in $mailboxes) {
        $address = $mailbox.PrimarySmtpAddress
        try {
            $visible = @(Get-InboxRule -Mailbox $address | ForEach-Object { $_.RuleIdentity })
            $rules = @(Get-InboxRule -Mailbox $address -IncludeHidden)
        } catch {
            Write-Warning "Skipped ${address}: $($_.Exception.Message)"
            continue
        }
        foreach ($rule in $rules) {
            $sends = @($rule.ForwardTo) + @($rule.ForwardAsAttachmentTo) + @($rule.RedirectTo)
            $sendsTo = @($sends | Where-Object { $_ })
            [pscustomobject]@{
                Mailbox      = $address
                Rule         = $rule.Name
                Enabled      = $rule.Enabled
                Hidden       = $rule.RuleIdentity -notin $visible
                Forwards     = $sendsTo.Count -gt 0
                SendsTo      = $sendsTo -join '; '
                Deletes      = [bool]($rule.DeleteMessage -or $rule.SoftDeleteMessage)
                MoveToFolder = $rule.MoveToFolder
                MarkAsRead   = $rule.MarkAsRead
                Description  = ($rule.Description -replace '\s+', ' ').Trim()
            }
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'No inbox rules were found in user or shared mailboxes.'
    } else {
        $report | Sort-Object Mailbox, Rule |
            Export-Csv -Path './inbox-rules.csv' -NoTypeInformation -Encoding utf8
        $flagged = @($report | Where-Object { $_.Hidden -or $_.Forwards -or $_.Deletes })
        Write-Output "$($report.Count) rules exported, $($flagged.Count) to review first."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

The CSV has 1 row per rule. Forwards covers forwarding, forwarding as an attachment and redirecting, with SendsTo saying where. A rule that moves mail to Junk Email or RSS Subscriptions, a common sign of a compromised mailbox, shows in MoveToFolder. Add 'RoomMailbox' to $types to widen the export. A mailbox Exchange will not read is skipped with a warning.

Check a single mailbox

Reconnect with Connect-ExchangeOnline first: the export above disconnects when it finishes.

# Run while connected to Exchange Online. Replace the example mailbox.
Get-InboxRule -Mailbox 'person@example.com' -IncludeHidden |
    Format-List Name,Enabled,RedirectTo,Forward*,DeleteMessage,MoveToFolder,Identity

A nonblank RedirectTo, ForwardTo or ForwardAsAttachmentTo means the rule sends mail on.

Option 2

Find inbox rule changes in the Purview portal

1. Sign in to the Microsoft Purview portal for the correct tenant.
2. Select Audit. If it is not shown, select View all solutions and find Audit under Core.
3. On the Search page, set Date and time range (UTC) to the period to check, up to 180 days.
4. In Activities - operations names, enter New-InboxRule,Set-InboxRule,UpdateInboxRules, then select Search.
5. When the search shows Completed, open it and select a record. ObjectId names the mailbox and rule, Parameters holds its conditions and actions, and UserId is who made the change.
6. Select Export to save the results as a CSV file.

The portal keeps each search in its list for 30 days; to remove yours, select it and select Delete.

This suits finding who made a rule and when. It does not list the rules a mailbox holds now: a rule made before the period searched does not appear, and records for users without an E5 licence can be missing.

Common questions

Why does Get-InboxRule fail for a Global Reader account?

Microsoft does not let the Global Reader role or the View-Only Organization Management role group run it. Use an account in Organization Management, or check which roles hold the cmdlet in your tenant with Get-ManagementRole -Cmdlet Get-InboxRule.

Why is a rule in the export but not in the person's Outlook?

A rule made in Outlook on the web or the new Outlook with some actions, such as marking a message as read, does not appear in classic Outlook's Rules and Alerts, yet it still runs. Check it in Outlook on the web.

Does this find mailbox forwarding too?

No. Forwarding set on the mailbox itself is a separate setting. See how to find mailbox forwarding.