Find external forwarding rules

Script 2 min read Windows PowerShell 5.1 and PowerShell 7

Written and tested by Dhrub Bharali · Updated 02 October 2026

Every mailbox is enumerated, and for each one Get-InboxRule is called against its primary SMTP address with errors suppressed so mailboxes that cannot be reached are skipped quietly.

The script

1PS> Get-EXOMailbox -ResultSize Unlimited | ForEach-Object { Get-InboxRule -Mailbox $_.PrimarySmtpAddress -ErrorAction SilentlyContinue | Where-Object { $_.ForwardTo -or $_.RedirectTo } | Select-Object MailboxIdentity,Name,ForwardTo,RedirectTo }

Script reader

Inspect before you run

Inspection only

Inspect the script below. It does not run in this browser.

Get-EXOMailbox -ResultSize Unlimited | ForEach-Object { Get-InboxRule -Mailbox $_.PrimarySmtpAddress -ErrorAction SilentlyContinue | Where-Object { $_.ForwardTo -or $_.RedirectTo } | Select-Object MailboxIdentity,Name,ForwardTo,RedirectTo }

Inspection only — no command has run.

Show reference output

1 MailboxIdentity Name ForwardTo RedirectTo

2 --------------- ---- --------- ----------

3 user@contoso.example Forward invoices {billing@external.example}

Inspect this example’s structure

Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.

Get-EXOMailbox -ResultSize Unlimited | ForEach-Object { Get-InboxRule -Mailbox $_.PrimarySmtpAddress -ErrorAction SilentlyContinue | Where-Object { $_.ForwardTo -or $_.RedirectTo } | Select-Object MailboxIdentity,Name,ForwardTo,RedirectTo }

Stage 1Get-EXOMailbox-ResultSize
Stage 2ForEach-ObjectPositional values or no named parameters

How it works

Every mailbox is enumerated, and for each one Get-InboxRule is called against its primary SMTP address with errors suppressed so mailboxes that cannot be reached are skipped quietly. The filter is meant to keep rules that set either a ForwardTo or a RedirectTo target, reporting the owning mailbox with the rule name and its destinations.

Adapting it

Narrow the outer enumeration to the mailboxes an alert actually flagged instead of the whole tenant, because a full sweep of inbox rules is measured in hours.

Requirements

ExchangeOnlineManagement module with rights to read inbox rules across mailboxes.

If the result is unexpected

External-forwarding rules are not found even though messages leave the organization.

Rules may use different forwarding actions, and destination classification needs an authoritative domain policy.

Inspect ForwardTo, RedirectTo and related actions for a known rule and review the destination domain.

Validate the result

Each finding names the rule, action and destination used for classification.

Keep the check reliable

Maintain the approved internal-domain list and avoid classifying solely by display name.

Primary documentation

Microsoft 365, Entra and Azure documentation

Continue