External Forwarding Rules On Mailbox Level

The question it answers: Which mailboxes forward mail to an address outside the verified domains?

Important: This report only shows forwarding rules on a mailbox level. Exchange Online Transport rules or rules created from within Outlook are covered by separate reports! More Details At: Microsoft Learn.

Note

Every mailbox with a ForwardingSmtpAddress is checked (-ResultSize Unlimited); it is listed when the forwarding domain is not a verified domain from Get-MgDomain (exact match, any case). Only ForwardingSmtpAddress (set by users or admins) is read; ForwardingAddress (forwarding to a mail contact) is not.

At a glance

Where in the app	Exchange Online › Security › Mailboxes With External Forwarding
Workload	Exchange Online
Kind	Table · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online.
Report id (API and MCP)	exchange.security.mailbox-level-external-forwarding-rules

Columns

Column	Key	Type
Display Name	DisplayName	Text
Primary Smtp Address	PrimarySmtpAddress	Text
Forwarding Smtp Address	ForwardingSmtpAddress	Text

What it needs

Licence: Exchange Online.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application	+ View-Only Recipients
Domain.Read.All	Microsoft Graph	Read domains

Data sources it reads

• PowerShell: Get-MgDomain -All (GET /v1.0/domains)
• PowerShell: Get-Mailbox -ResultSize Unlimited -Filter 'ForwardingSmtpAddress -ne $null'

Through the API and MCP

GET /ir-api/v1/reports/exchange.security.mailbox-level-external-forwarding-rules?size=100

An AI assistant reads it with the MCP tool get_report and the id exchange.security.mailbox-level-external-forwarding-rules. The client needs the Read grant for Exchange Online. See Using the API.