Outlook Rules With External Recipients

The question it answers: Which inbox rules forward or redirect mail to an address outside the tenant’s accepted domains?

Inbox rules that forward or redirect mail to an address outside the tenant’s accepted domains. Mailbox-level forwarding and Exchange transport rules are covered by separate reports.

Note

Exchange.ManageAsApp is on the Office 365 Exchange Online API; the app also needs an Exchange read role (Global Reader is enough). One inbox-rule lookup per mailbox, so this runs as a scan.

At a glance

Where in the app	Exchange Online › Security › Outlook Rules With External Forwarding
Workload	Exchange Online
Kind	Table · dashboard tile
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online.
Report id (API and MCP)	exchange.security.outlook-clients-with-external-forwarding-rules
An empty result means	No inbox rule forwards or redirects mail to an external address.

Columns

Column	Key	Type
Mailbox	Mailbox	Link
Rule Name	RuleName	Text
Forward To (external)	ForwardTo	Text
Forward As Attachment To (external)	ForwardAsAttachmentTo	Text
Redirect To (external)	RedirectTo	Text

What it needs

Licence: Exchange Online.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application	Office 365 Exchange Online API

Data sources it reads

• Get-AcceptedDomain
• Get-EXOMailbox
• Get-InboxRule -IncludeHidden (per mailbox)

Through the API and MCP

GET /ir-api/v1/reports/exchange.security.outlook-clients-with-external-forwarding-rules?size=100
POST /ir-api/v1/reports/exchange.security.outlook-clients-with-external-forwarding-rules/scan

An AI assistant reads it with the MCP tool get_report and the id exchange.security.outlook-clients-with-external-forwarding-rules. The client needs the Run scan grant for Exchange Online. See Using the API.