SOLVED

User based forwarding detection

%3CLINGO-SUB%20id%3D%22lingo-sub-1673716%22%20slang%3D%22en-US%22%3EUser%20based%20forwarding%20detection%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1673716%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20all%20know%20that%20there%20is%20backend%20stuff%20in%20365%20that%20we%20can%20do%20to%20enable%20forwarding%20of%20a%20users%20mailbox%20to%20another%20individual%2FDL%2C%20and%20via%20powershell%20we%20can%20view%2Freport%20on%20it.%20But%20what%20if%20the%20user%20enables%20it%20inside%20their%20own%20mailbox%2C%20how%20can%20we%20see%20that%3F%20or%20change%20it%20if%20need%20be%3F%20I%20dont%20see%20those%20setting%20in%20get-mailbox%20or%20get-inboxrule%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20team%20often%20is%20tasked%20with%20doing%20this%20config%20however%20users%20of%20late%20are%20doing%20it%20themselves%2C%20fortunately%20we%20have%20safeguards%20to%20prevent%20auto-forwarding%20to%20external%20parties%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eso%20is%20this%20data%20visible%20via%20powershell%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1673716%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1673777%22%20slang%3D%22en-US%22%3ERe%3A%20User%20based%20forwarding%20detection%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1673777%22%20slang%3D%22en-US%22%3E%3CP%3EHow%20exactly%20is%20forwarding%20enabled%20by%20the%20end%20user%3F%20If%20he%20enables%20it%20via%20OWA%20settings%2C%20it's%20visible%20via%20Get-Mailbox%20properties.%20If%20he%20enables%20it%20via%20rules%2C%20it's%20visible%20via%20Get-InboxRules.%20Any%20other%20methods%20dont%20count%20as%20%22native%22%20and%20are%20not%20covered%20by%20the%20management%20tools%2C%20not%20much%20you%20can%20do%20there.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1673788%22%20slang%3D%22en-US%22%3ERe%3A%20User%20based%20forwarding%20detection%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1673788%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3Bit%20is%20via%20OWA%2C%20however%20when%20I%20look%20at%20their%20mailbox%20in%20powershell%2C%20I%20dont%20see%20anything...if%20I%20set%20it%20via%20ECP%20as%20an%20admin%2C%20then%20I%20see%20it%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

We all know that there is backend stuff in 365 that we can do to enable forwarding of a users mailbox to another individual/DL, and via powershell we can view/report on it. But what if the user enables it inside their own mailbox, how can we see that? or change it if need be? I dont see those setting in get-mailbox or get-inboxrule

 

My team often is tasked with doing this config however users of late are doing it themselves, fortunately we have safeguards to prevent auto-forwarding to external parties

 

so is this data visible via powershell?

4 Replies
Highlighted

How exactly is forwarding enabled by the end user? If he enables it via OWA settings, it's visible via Get-Mailbox properties. If he enables it via rules, it's visible via Get-InboxRules. Any other methods dont count as "native" and are not covered by the management tools, not much you can do there. 

Highlighted

@Vasil Michev it is via OWA, however when I look at their mailbox in powershell, I dont see anything...if I set it via ECP as an admin, then I see it

Highlighted
Best Response confirmed by Russell Meyer (Occasional Contributor)
Solution

Setting it via OWA will be reflected, are you checking all the relevant properties? Here's a short article I wrote on this a while back: https://www.enowsoftware.com/solutions-engine/simplified-forwarding-settings-in-office-365

Highlighted

@Vasil Michev very nice write up! I just tested it again and its there...dont know what happen the last 2 times...thanks for this info!