(Solved) 550 5.7.520 Access denied. Your organization does not allow external forwarding in Microsoft 365.
If after setting up email forwarding in Office365 you receive the error "Remote server returned 550 5.7.520 Access denied, Your organization does not allow external forwarding", continue below to fix the problem.
Sometimes there is the need to forward Office365/Microsoft365 emails to a user outside of your organization (e.g. to a GMAIL account). But, after enabling the email forwarding in Office365 Exchange Admin Center users will receive the error "Remote server returned '550 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)'.
This is happening, because by default Microsoft 365 does not allow the external forwarding and administrators must enable it in Microsoft 365 security center. More specifically in Microsoft 365 Defender there is a default Anti-spam outbound policy which sets the Automatic Forwarding to "Automatic – System-controlled" which is the same as OFF.
So, to fix the error "550 5.7.520 Access denied" in Microsoft 365 you have to allow the external forwarding for all users on your organization by modifying the default "Anti-spam outbound policy", or to create a new Outbound policy which will be allow the external forwarding for certain users on your organization.
How to Allow External Forwarding in Microsoft 365/Office 365 to fix Error '550 5.7.520 Access denied'.
1. Navigate to Office365 Security center (aka "Microsoft Defender").
2. Select Policies and rules on the left and then click to open the Anti-spam Policies on the right. (or click this link: Manage outbound anti-spam policies).
3. In the Anti-Spam Policies section, follow the instructions on the corresponding part below, according to what you want to do.
1. Allow External Forwarding for Individual Users in Office 365/Microsoft 365.
2. Allow External Forwarding for All Users in Office 365/Microsoft 365.
Part 1. Enable External Forwarding for Specific Users.
If you want only certain Office365 users in your organization to be able to forward their emails to external recipients (outside your organization), do the following:
1. Click Create policy and select Outbound.
2. Type a name for the new policy and click Next.
3. At the next screen, add the users that you want to allow forwarding and click Next.
4. At Protection Settings options change the Automatic forwarding rules setting from "Automatic – System-controlled" to "On – Forwarding is enabled" and then click Next.
5. Finally review the rule settings and click Create to create the new outbound rule for the email forwarding.
Part 2. Enable Forwarding for All Users in your Organization.
If you want to allow all users in your organization to forward their email to external recipients (outside your organization), do the following:*
* Note: For security reasons this method is not suggested.
1. Click to open the Anti-spam outbound policy (Default).
2. Click Edit Protection settings.
3. Change the Automatic forwarding rules setting from "Automatic – System-controlled" to "On – Forwarding is enabled" and then click Save.
That's it! Let me know if this guide has helped you by leaving your comment about your experience. Please like and share this guide to help others.
October 8, 2025 @ 8:58 pm
thank you!
May 22, 2024 @ 10:07 am
Thanks for this clearly worded article as this issue was certainly generating problems for our non-profit.