How Small Businesses Can Check for Suspicious Email Forwarding Rules in Microsoft 365

For many small businesses, Microsoft 365 is the centre of day-to-day work. Email, calendars, files, Teams messages and customer communication often sit behind a single user login. That makes life easier when everything is working properly, but it also means one compromised mailbox can create far more risk than most directors realise.

One issue that is often missed is suspicious email forwarding. This happens when emails are automatically sent on to another address, sometimes without the account owner noticing. In some cases it is set up for convenience years ago and simply forgotten. In other cases, it is added after an account has been compromised so that an outsider can quietly monitor messages in the background.

For a busy SME, that can mean sensitive emails, invoices, password resets, client details or internal conversations being copied elsewhere without any obvious warning. The good news is that this is one of those areas where a simple review can make a real difference.

What an email forwarding rule actually means

An email forwarding rule tells Microsoft 365 to send messages on automatically to another inbox. It might be a personal address, a second work account, a shared mailbox or an external contact.

There are also inbox rules, which can move, delete, redirect or hide messages based on certain conditions.

Neither of these tools is bad in itself. They can be useful when set up properly for a clear business reason. The problem comes when:

• nobody remembers why the rule was created
• it forwards to a personal or unknown external address
• it hides messages by moving them into folders
• it was added after someone clicked a phishing email or reused a weak password

This is why forwarding rules matter from both an IT support and cybersecurity point of view. They affect visibility, control and trust in your email system.

Why this matters to a small business owner

A suspicious forwarding rule does not just create a technical issue. It creates a business risk.

Imagine a director's mailbox is compromised. The attacker sets a rule to forward messages about payments, new customer enquiries or password resets to an external address. Nothing dramatic happens on day one. The mailbox still works. Staff keep sending and receiving messages. But behind the scenes, someone else may be reading enough information to prepare invoice fraud, impersonation emails or account takeover attempts.

Now imagine the same thing in a 15-person business in Bolton or Bury. The finance lead receives a supplier change request. The attacker has already been quietly reading earlier email threads, so they know the names, tone and timing involved. That makes the fraud attempt far more believable.

This is exactly why calm, regular checking matters. Your Technology, Managed the Right Way means not only keeping systems running, but also making sure small hidden risks do not turn into expensive problems later.

What to check first

You do not need to make this overly technical. Start with a practical review.

Look for:

• any mailbox forwarding to an external email address
• inbox rules that automatically redirect or delete messages
• rules that move emails into unusual folders so they are less likely to be spotted
• old rules created for staff who have changed roles or left the business
• personal inbox forwarding that was set up as a convenience workaround

If your business uses Microsoft 365 across several users, it is worth checking both individual mailboxes and any shared mailboxes that handle enquiries, accounts or support.

Signs that something needs closer attention

Some forwarding rules are legitimate. Others deserve a second look straight away.

Pay extra attention if:

• the forwarding address is unfamiliar
• nobody in the business can explain why the rule exists
• staff say they are missing replies or not seeing expected messages
• the mailbox has recently had suspicious sign-in activity or unexpected MFA prompts
• there has been a recent phishing scare involving that user

A rule on its own does not always prove compromise. But it should always have a clear reason. If it does not, treat it as something worth investigating promptly.

Good practice for UK SMEs

For most small businesses, the goal is not to ban every rule. It is to make sure email handling stays controlled, visible and easy to manage.

Good practice usually means:

• keeping business email inside managed business accounts rather than personal inboxes
• limiting who can create or approve external forwarding where possible
• reviewing forwarding and inbox rules as part of regular account checks
• making sure MFA is enabled and working properly
• separating admin access from everyday user accounts
• including mailbox rule checks in your incident response and leaver processes

This is especially important if your team works remotely, uses mobile phones for email, or relies heavily on Microsoft 365 for client communication.

A simple next step if you have never reviewed this before

If this has not been checked in a while, do not panic. Start small.

Pick a handful of priority accounts first:

• directors
• finance users
• shared mailboxes
• sales or customer service inboxes

Review those accounts for forwarding and inbox rules, confirm anything that is still needed, and remove anything outdated or unexplained. Once that is done, build the same check into your wider Microsoft 365 housekeeping.

For many SMEs, this is the sort of quiet improvement that reduces risk without creating disruption. It is not flashy, but it is practical, sensible and worth doing.

Final thought

Cybersecurity problems do not always announce themselves loudly. Sometimes they sit in the background as a small unchecked setting that nobody has looked at for years.

Email forwarding rules are a good example of that. A short review can help you spot weak points, tighten control and feel more confident that business communication is staying where it should.

If you would like a second pair of eyes on your Microsoft 365 setup, Managed IT Support can help you review the basics, reduce avoidable risk and make sure your environment is being managed the right way.