Information
You should disable automatic forwarding to prevent users from auto-forwarding mail through Outlook and Outlook on the Web.
Rationale:
In the event that an attacker gains control of an end-user account they could create rules to ex-filtrate data from your environment.
Impact:
Care should be taken before implementation to ensure there is no business need for case-by-case auto-forwarding. Disabling auto-forwarding to remote domains will affect all users and in an organization.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To perform remediation you may use the Exchange Online PowerShell Module:
Connect to Exchange online using Connect-ExchangeOnline.
Run the following Powershell to disable auto-forwarding to remote domains:
Set-RemoteDomain Default -AutoForwardEnabled $false
Run the following Powershell to verify AutoForwardEnabled is now set to False.
Get-RemoteDomain Default | fl AllowedOOFType, AutoForwardEnabled
Default Value:
True