It is possible to track whether the email was forwarded

it is possible to track whether an email was forwarded, but the level of detail depends on your Microsoft 365 configuration and the type of mailbox involved.

For both personal and shared mailboxes, you can use Message Trace in the Microsoft 365 Defender or Exchange Admin Center to see if an email was forwarded internally or externally. The trace results include the “RecipientStatus” and “Event” fields, where actions like MailForwarded or MailDeliveredToMailbox are logged. If the message was auto-forwarded, the trace will show the forwarding rule or connector that triggered it. For manual forwards, you can identify them using Audit Logs (in Purview or Unified Audit Log), which capture user actions such as SendOnBehalf, SendAs, or ForwardedMessage.

In shared mailboxes, these logs also record which user initiated the forward if mailbox auditing is enabled. To ensure visibility, confirm that auditing is enabled for all mailboxes and that forwarding events are included in your retention policy. If you use Microsoft Purview DLP or Exchange Transport Rules, you can take it a step further and trigger alerts whenever an email containing sensitive data is forwarded externally.

In summary, yes, tracking forwarded emails is fully possible across personal and shared mailboxes through Message Trace, audit logs, and DLP reports. Please hit like if you like the solution.