How to find mailbox forwarding in Exchange Online

Before you start

Use an Exchange account with permission to read the relevant mailboxes and rules. Have the Exchange Online PowerShell module installed if you use the script. The examples read configuration and export it; they do not change forwarding.

Separate the questions: where is forwarding configured, and will messages actually be delivered? Remote domain settings and outbound policies can block automatic external forwarding. A configured destination is not proof of successful delivery.

Option 1

Find mailbox forwarding with PowerShell

Install the module once, then connect to the tenant and export its forwarding settings. The Delivery property set explicitly requests the forwarding properties.

# Install once, if the module is not already installed.
Install-Module ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline
try {
    $mailboxes = Get-EXOMailbox -ResultSize Unlimited -PropertySets Delivery
    $report = @($mailboxes | Where-Object {
        $_.ForwardingAddress -or $_.ForwardingSmtpAddress
    } | Select-Object DisplayName,PrimarySmtpAddress,ForwardingAddress,
        ForwardingSmtpAddress,DeliverToMailboxAndForward)
    if ($report.Count -eq 0) {
        Write-Output 'No mailbox-level forwarding was found. Inbox rules were not checked.'
    } else {
        $report | Export-Csv -Path './mailbox-forwarding.csv' -NoTypeInformation -Encoding utf8
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

ForwardingSmtpAddress records an SMTP destination. ForwardingAddress can identify a directory recipient, including a mail contact that delivers externally, so resolve that recipient before classifying it as internal. DeliverToMailboxAndForward indicates whether a copy is retained in the original mailbox.

Also inspect forwarding inbox rules

Reconnect with Connect-ExchangeOnline, then run this read for a specific mailbox. The main export above disconnects when it finishes.

# Run while connected to Exchange Online. Replace the example mailbox.
Get-InboxRule -Mailbox 'person@example.com' -IncludeHidden |
    Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } |
    Select-Object Name,Enabled,ForwardTo,ForwardAsAttachmentTo,RedirectTo

The rule's Enabled value matters. A disabled rule is configuration to review, not an active forwarding action. Mail flow rules are another separate route for copying or redirecting messages; a mailbox and inbox-rule review alone is not a complete mail-flow audit.

Option 2

Inspect forwarding in the admin centre

1. Open the Exchange admin centre for the correct tenant.
2. Go to Recipients > Mailboxes and select the mailbox.
3. Open Mailbox > Email forwarding > Manage email forwarding.
4. Read the current forwarding setting, destination and whether the mailbox retains a copy. Close the pane without changing or saving anything.

This is a straightforward check for a single account. It does not replace a separate inbox-rule review or a report across all mailboxes.

Common questions

Why is there no CSV after the forwarding script?

The script writes a CSV only when it finds mailbox-level forwarding. Its console message explicitly says that inbox rules were not checked, so an empty forwarding result must not be read as a clean rule audit.

Does finding an external address prove an account was compromised?

No. Confirm the account owner, business purpose and relevant audit records. The report identifies settings to investigate; it does not determine intent.

Can forwarding remain after a user leaves?

Yes, a forwarding configuration can remain while the mailbox exists. Include it in your account review alongside licence assignments and mailbox access.