---
name: Mailbox Delegation and Forwarding Audit
description: Audit Exchange Online mailbox delegations, full-access permissions, and auto-forwarding to external recipients to close a data-exfiltration vector.
---

# Mailbox Delegation and Forwarding Audit

> **TL;DR:** This skill reviews Exchange Online mailbox delegations, full-access and send-as permissions, and auto-forwarding rules that send mail to external recipients, then ranks each finding by data-exfiltration risk so you can confirm every grant and forward is legitimate.

## What Exchange Online exposes about delegation and forwarding

Exchange Online holds the mailbox permissions, send-as and send-on-behalf grants, and the forwarding settings and inbox rules that decide where a user's mail can flow. Auto-forwarding to external recipients is a well-known data-exfiltration vector that attackers set up after compromising an account, while broad full-access delegation can quietly expose sensitive correspondence. Microsoft Purview audit signals and Microsoft Defender for Office 365 outbound policies add context, but the authoritative delegation and forwarding state lives in Exchange Online itself, which this skill inspects read-only.

## When should you run this skill?

- "Show me every mailbox that auto-forwards to an external domain."
- "Which users hold full-access or send-as rights on someone else's mailbox?"
- "Did anyone create an inbox rule that forwards mail outside the tenant?"
- "Audit delegation on our executive and finance mailboxes before quarter end."
- "Find forwarding set up by an account we suspect was compromised."
- "List send-on-behalf and send-as grants that no longer match a business need."
- "Prepare a delegation and forwarding evidence pack for our security review."

## How this skill works, step by step

1. Confirm you hold a read-only Exchange role such as View-Only Recipients so the audit changes no mailbox configuration.
2. Enumerate mailboxes in scope and collect their delegation entries: full-access, send-as, and send-on-behalf permissions.
3. Read each mailbox's forwarding configuration, including `ForwardingAddress`, `ForwardingSmtpAddress`, and the deliver-and-forward flag.
4. Inspect inbox rules for forward, redirect, and send-external actions that move mail off the tenant.
5. Resolve each forwarding target and classify it as internal or external to the accepted domains.
6. Cross-check delegations against your expected delegate roster and each forward against approved business exceptions.
7. Derive a risk score by weighting external forwarding highest, then broad full-access on sensitive mailboxes, recency of the change, and absence of an approval record.
8. Rank findings from highest to lowest risk and group repeated grants by delegate or target domain.
9. Produce the findings table and summary, noting items that need follow-up confirmation or removal by an administrator.

## Output format

The output is a ranked table of delegation and forwarding findings followed by a short summary.

| Mailbox | Finding type | Detail | Target | Risk |
| --- | --- | --- | --- | --- |
| `finance.lead@contoso` | External auto-forward | ForwardingSmtpAddress set | `archive@external-mail.example` | High |
| `exec.sam@contoso` | Full-access delegation | Granted to non-roster user | `temp.contractor@contoso` | Medium |
| `support@contoso` | Send-on-behalf | Long-standing shared-mailbox grant | `agent.lee@contoso` | Low |

Summary highlights:

- Total mailboxes reviewed and the count flagged High or Medium risk.
- External forwarding targets found and the domains they reach.
- Delegations not matching the approved delegate roster that require follow-up.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Exchange Online mailbox permission and forwarding inspection | Exchange Online Plan 1 (or Microsoft 365 Business Basic) |
| Outbound spam and external-forwarding policy context in Microsoft Defender for Office 365 | Microsoft 365 E3 with Exchange Online Protection (E5 for advanced reporting) |

### Least-privilege roles

- View-Only Recipients (read-only visibility of mailbox permissions and forwarding settings)
- Global Reader (read-only tenant-wide context where broader visibility is needed)

### Microsoft Graph permissions (read-only)

This skill is typically run through the Exchange Online PowerShell module (for example `Get-Mailbox`, `Get-MailboxPermission`, and `Get-InboxRule`) rather than Microsoft Graph, so no Graph scopes are required for the core audit. If you instead read mailbox settings and rules programmatically through Microsoft Graph, use:

- `MailboxSettings.Read` - reads mailbox forwarding and automatic-processing settings
- `MailboxFolder.Read.All` - reads inbox rules that may forward or redirect mail

## Scope and safety

This skill is read-only by default and makes no changes to mailbox permissions, forwarding settings, inbox rules, or transport policies. It only inspects existing Exchange Online configuration.

This skill does NOT:

- Remove, add, or alter any full-access, send-as, or send-on-behalf delegation.
- Disable, create, or modify mailbox forwarding or inbox rules.
- Change Microsoft Defender for Office 365 outbound spam or external-forwarding policies.
- Block, quarantine, or release any individual message.

## Sources and compliance

- [Manage permissions for recipients in Exchange Online](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-permissions-for-recipients)
- [Control automatic external email forwarding in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding)
- Supports Essential Eight mitigation strategies for restricting administrative privileges and reviewing access, aligned with ISM controls for email security, data-exfiltration prevention, and review of account configuration.
- [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model)
- Output in Australian English.