Exchange Online Transport Rules With External Recipients

The question it answers: Which Exchange Online transport rules redirect, add or copy mail to recipients outside the verified domains?

Important: This report only Exchange Online Transport Rules. Mailbox Forwarding rules or rules created from within Outlook are covered by separate reports!

Note

Internal means a verified domain from Get-MgDomain (exact match, any case). A rule is listed when one of its RedirectMessageTo, AddToRecipients, CopyTo or BlindCopyTo recipients has another domain. A recipient given by name or alias is resolved with Get-Recipient first: a mail contact or mail user counts with its external address, a mailbox or group with its primary address; a name that cannot be resolved is not counted as external.

At a glance

Where in the app	Exchange Online › Security › Transport Rules With External Recipients
Workload	Exchange Online
Kind	Table
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online.
Report id (API and MCP)	exchange.security.exo-transport-rules-with-external-recipients

Columns

Column	Key	Type
Identity (Display Name)	Identity	Text
State	State	Text
Redirect Message To	RedirectMessageTo	Text
Sent To	SentTo	Text
Add To Recipients	AddToRecipients	Text
Copy To	CopyTo	Text
Blind Copy To	BlindCopyTo	Text
Created By	CreatedBy	Text
Last Modified By	LastModifiedBy	Text
Changed	WhenChanged	DateTime
Description	Description	Text

What it needs

Licence: Exchange Online.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application	+ View-Only Configuration, View-Only Recipients
Domain.Read.All	Microsoft Graph	Read domains

Data sources it reads

• PowerShell: Get-MgDomain -All (GET /v1.0/domains)
• PowerShell: Get-TransportRule -ResultSize Unlimited
• PowerShell: Get-Recipient (recipients given by name)

Through the API and MCP

GET /ir-api/v1/reports/exchange.security.exo-transport-rules-with-external-recipients?size=100

An AI assistant reads it with the MCP tool get_report and the id exchange.security.exo-transport-rules-with-external-recipients. The client needs the Read grant for Exchange Online. See Using the API.