How to Find Which Users are Forwarding their emails in Microsoft 365.
In this guide, we will show you how to find which users are forwarding emails to external e-mail addresses on Microsoft 365, using the Microsoft 365 Admin Center and PowerShell.
Email forwarding in Microsoft 365 can be a useful feature, but it can lead to serious security risks when done illegally. If you're an IT administrator and responsible for cybersecurity in an organization, it's important to know how to identify which users are forwarding emails externally.
Part 1. Check Email Forwarding for a Specific User.
Part 2. Find All Users who are Forwarding their emails.
Part 1. How to check if a particular user is forwarding emails in Office 365 (Microsoft 365)
To find out if a individual user promotes his email to another internal or external address, follow the instructions in the following methods.*
Method 1. Check Email Forwarding in Users from Microsoft 365 Admin Center.
1. Go to the Microsoft 365 Admin Center.
2. In the left menu, select Users > Active Users.
3. On the right, click the user account that you want to check the email forwarding.
4. On the Mail tab click Manage email forwarding.
Method 2. Check Email Forwarding in Mailboxes from Exchange Admin Center (EAC).
1. Go to the Microsoft 365 Exchange Admin Center.
2. In the left menu, select Recipients > Mailboxes.
3. On the right, click the mailbox that you want to check the email forwarding.
4. On the Mailbox tab click Manage email forwarding.
Method 3. Check email Forwarding in PowerShell.
To see if an individual user is forwarding their emails to another email address, using PowerShell:
1. Connect to Exchange Online from PowerShell using this command:
- Connect-ExchangeOnline -UserPrincipalName admin@example.com -ShowProgress $true
* Note: In the command replace "admin@example.com" with your Microsoft 365 Admin account.
2. Issue the following command to find out if a specific user (mailbox) is forwarding emails:
- Get-Mailbox -Identity user@example.com | select UserPrincipalName,ForwardingSmtpAddress
* Note: In the command, replace "user@example.com" with the mailbox name that you want to check mail forwarding.
Part 2. How to List All Users with Email Forwarding in Office 365 (Microsoft 365)
Method 1. List All Mailboxes with Email Forwarding to External users Enabled in the Exchange Admin Center.
To view all users that forwarding their emails to an external domain (email address), use the instructions below.
1. Go to the Microsoft 365 Exchange Admin Center.
2. In the left menu, select Reports > Mail flow.
3. Then, in the right click Auto forwarded message report.
4. In the options on the "Automatic forwarded messages" page, select e.g. "90 days" or more to see which users forwarded their messages during this period and to which address.
Method 2. Find All Mailboxes that Forwarding emails using PowerShell.
To get a list of all users that forwarding their emails internally or externally from PowerShell:
1. Connect to Exchange Online from PowerShell using this command:
- Connect-ExchangeOnline -UserPrincipalName admin@example.com -ShowProgress $true
* Note: In the command replace "admin@example.com" with your Microsoft 365 Admin account.
2. Issue the following command to see a list of all users that forwarding their email to an external or internal email address.
- Get-Mailbox -Filter { ForwardingSmtpAddress -ne $null} | select UserPrincipalName,ForwardingSmtpAddress
Identifying users who are forwarding email messages in Microsoft 365 is critical for both operational efficiency and security. But with the instructions above, you'll learn how to perform this task for either individual users or all users in your organization.
That's it! Which method worked for you?
Let me know if this guide has helped you by leaving your comment about your experience. Please like and share this guide to help others.
Frequently Asked Questions
How can I check if a specific user is forwarding emails in Microsoft 365?
To check if a specific user is forwarding emails, you can use the Microsoft 365 Admin Center. Go to the Microsoft 365 Admin Center, select 'Users > Active Users' from the left menu, click on the user account, and under the 'Mail' tab, click 'Manage email forwarding'.
How can I find all users forwarding emails externally in Microsoft 365?
You can find all users forwarding emails externally by using the Microsoft 365 Exchange Admin Center. Navigate to 'Reports > Mail flow' from the left menu and click on the 'Auto forwarded message report.' Select a time range like '90 days' to view users and addresses involved in email forwarding.
What PowerShell command can I use to check if a user is forwarding emails?
Use the command `Get-Mailbox -Identity user@example.com | select UserPrincipalName,ForwardingSmtpAddress` in PowerShell, after connecting to Exchange Online. Replace 'user@example.com' with the relevant mailbox name to check forwarding settings.
How can I list all mailboxes with email forwarding enabled using PowerShell?
Connect to Exchange Online in PowerShell and use the command `Get-Mailbox -Filter { ForwardingSmtpAddress -ne $null} | select UserPrincipalName,ForwardingSmtpAddress` to list all users forwarding emails internally or externally.
- How to Securely Allow SMTP Sending through Microsoft 365 using SMTP RELAY. - May 26, 2026
- How to Add a Shared Calendar in Outlook for Web (OWA) - May 20, 2026
- How to Stop Windows 11 from Downgrading GPU Drivers. - May 18, 2026
