CISA.MS.EXO.1.1 - Automatic forwarding to external domains SHALL be disabled.

Contributed by Michael Soule with Merill FernandoAll contributors →

Overview

Automatic forwarding to external domains SHALL be disabled.

Rationale: Adversaries can use automatic forwarding to gain persistent access to a victim's email. Disabling forwarding to external domains prevents this technique when the adversary is external to the organization but does not impede legitimate internal forwarding.

Remediation action:

To disable automatic forwarding to external domains:

1. Sign in to the Exchange admin center.
2. Select Mail flow, then Remote domains.
3. Select Default.
4. Under Email reply types, select Edit reply types.
5. Clear the checkbox next to Allow automatic forwarding, then click Save.
6. Return to Remote domains and repeat steps 4 and 5 for each additional remote domain in the list.

Related links

• Exchange admin center - Remote domains
• CISA 1 Automatic Forwarding to External Domains - MS.EXO.1.1v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.EXO.1.1
Severity	High
Suite	CISA
Product	Exchange Online
Feature	Mail flow
Area	Email and collaboration protection
Resource type	Domain
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1114.003 Email Forwarding Rule, T1048 Exfiltration Over Alternative Protocol, T1567 Exfiltration Over Web Service
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.1.1
Criticality	SHALL
Upstream requirement	MS.EXO.1.1v2
Supports controls	cisa-scuba:MS.EXO.1.1, nist-800-53-r5:AC-4
PowerShell test	Test-MtCisaAutoExternalForwarding
Services	ExchangeOnline

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.1.1.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.1.1.md