Auto forwarded messages report in the new EAC in Exchange Online

The Auto-forwarded messages report in the new Exchange admin center (new EAC) displays information on messages that are automatically forwarded from your organization to recipients in external domains. You can use this report to look for potential data leaks.

Note

By default, the report shows data for the last 7 days. If the report is empty, try changing the date range.

The summary page allows you to query up to the last 90 days of data. The new activity page shows the activity of the last 7 days. The request report feature has a limit of the last 30 days.

For permissions that are required to use this report, see Permissions required to view mail flow reports.

The overview section contains the following charts:

• Forwarding type: Typical values are:
  • Mail flow rules
  • Inbox rules
  • SMTP forwarding: This is automatic forwarding that admins can configure on a mailbox as described in Configure email forwarding for a mailbox.
• Recipient domain
• Forwarding users

If you hover over a specific color in the chart, you'll see the associated numbers for that specific forwarding type, recipient domain, or forwarding user.

The Auto forwarded message details section shows the following information about each-specific forwarder (the user account that's doing the forwarding):

• Forwarders
• Forwarding type
• Recipient name
• Recipient domain
• Details: If the message was auto-forwarded by a Transport rule, the ID of the rule is shown. Otherwise, this value is blank. In Exchange Online PowerShell, you can use the Get-TransportRule cmdlet to identify the rule by running the following command: Get-TransportRule -Identity <RuleIDParameter>. For example, Get-TransportRule -Identity 8754395095991580000.
• Forward count
• First forward date

Click Export to export the displayed results to a .csv file.

Insights

Two insights are generated based on the report data: New domains being forwarded email and New users forwarding email. Each insight provides a summary of the number of new forwarders or domains with a link back to this report.

See also

For more information about other mail flow reports, see Mail flow reports in the modern EAC.