Information
You should set your Exchange Online mail transport rules to not forward email to domains outside of your organization.
Rationale:
Attackers often create these rules to exfiltrate data from your tenancy.
Impact:
Care should be taken before implementation to ensure there is no business need for case-by-case auto-forwarding. Disabling auto-forwarding to remote domains will affect all users and in an organization.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To alter the mail transport rules so they do not forward email to external domains, use the Microsoft 365 Admin Center:
Select Exchange.
Select Mail Flow and Rules.
For each rule that forwards email to external domains, select the rule and click the 'Delete' icon.
To perform remediation you may also use the Exchange Online PowerShell Module:
Connect to Exchange Online user Connect-ExchangeOnline.
Run the following Powershell command:
Remove-TransportRule {RuleName}
To verify this worked you may re-run the audit command as follows:
Get-TransportRule | Where-Object {$_.RedirectMessageTo -ne $null} | ft Name,RedirectMessageTo