Defender for Office 365 - Anti-spam outbound policy - AutoForwardingMode
MDO Auto Forwarding Mode
Query
EmailEvents
| where isnotempty( ForwardingInformation)
| extend ForwardingType = parse_json(ForwardingInformation)["ForwardingType"]
| extend ForwardingUser = parse_json(ForwardingInformation)["ForwardingUser"]
| extend SenderIPAddress = coalesce(SenderIPv4, SenderIPv6,"")
| extend IPGeo = geo_info_from_ip_address(SenderIPAddress)
| extend IPcountry = tostring(IPGeo.country)
| project TimeGenerated, SenderFromAddress, SenderFromDomain,SenderMailFromAddress, SenderMailFromDomain, RecipientEmailAddress, ForwardingType, ForwardingUser, SenderIPAddress, IPcountryAbout this query
Explanation
This KQL query is designed to monitor changes in the AutoForwardingMode setting of outbound anti-spam policies in Microsoft Defender for Office 365. Here's a simple breakdown of what the query does:
-
Identify Changes: It looks for operations where the outbound spam filter policy is modified, specifically focusing on the "AutoForwardingMode" setting.
-
Extract Information: The query extracts the current configuration value of AutoForwardingMode, which can be "Automatic," "On," or "Off."
-
Provide Descriptions: Based on the configuration value, it provides a human-readable description:
- "Automatic": Forwarding is system-controlled and effectively disabled.
- "On": Forwarding is enabled, allowing automatic external forwarding.
- "Off": Forwarding is disabled, blocking automatic external forwarding and resulting in a non-delivery report (NDR) to the sender.
-
Display Results: The query projects relevant information such as the time of change, setting name, configuration value, and description.
Additionally, the query checks for email events with forwarding information, extracting details like forwarding type, forwarding user, sender's IP address, and geographical location based on the IP address.
Overall, this query helps administrators monitor and understand changes to email forwarding settings, which can be crucial for security and compliance purposes.
Details
Alex Verboon
Released: March 16, 2026
Tables
Keywords
Operators