How do I report on mails that have been blocked by my AutoForwarding to external domain block rules?

Brass Contributor



We have a rule setup on Exchange online which successfully blocks emails that satisfy a "Block Automatic forwarding of mail to external domains" policy rule.


I can see the report which shows a "rule hit" and get an email notification every time the rule is hit as well. I don't, however, see a report of the evidence of the blocked emails. Is this possible? 


So "Show me a list of actual blocked emails" rather than "show me a list of rule hits" if that makes sense. 

The problem is I cannot distinguish between rule hits and blocks, as currently, the notification shows:

"Rule Hit: Block Client Forwarding to an external domain, Action: AuditSeverityLevel, RejectMessage, GenerateIncidentReport"  but it shows the same message for auto-forwarded emails inside the domain as well.


Hope that makes sense


Thanks in advance


2 Replies

@Christo De Lange  Solution/Workaround - 


1. Create a Shared Mailbox dedicated for this specific purpose.

2. In your existing Transport rule for blocking auto-forward to external domains  < Add additional action < send a copy / bcc the email to < .

3. Apply < ok < Enforced < High Severity audit.


This gives you the copy of email (which are actually blocked from being auto-forwarded)

Test to see if it works, else we can probably go for another workaround in that case. You can have many actions to corresponding conditions defined in a Transport Rule.



Cheers !

Ankit Shukla