External email forwarding being disabled by default
Like most email services, it’s possible to configure Microsoft 365 email to be automatically forwarded to another address. This is useful if you want to see all your incoming Microsoft 365 email in another inbox.
Increasingly, this feature is being taken advantage of by attackers. If they gain access to a business email account and enable this feature, they can then forward incoming mail to an external address of their choice. This then means they can reset passwords, receive security tokens, and more. For this to happen, an attacker needs to gain access to an account in the first place. Therefore, there is no immediate threat.
However, since automatic email forwarding is not a feature everyone uses, from 1st September Microsoft will be disabling this feature by default – as a precaution. iBizify is of course applying this recommendation to all client accounts – unless we know there is a need for automatic forwarding within that organisation.
For this reason, if you knowingly automatically forward your emails to an address that is outside of your Microsoft 365 organisation (such as a personal email address) then please reply to this message and let us know.
If this is not the case, then you do not need to take any action.
If you do use external mail forwarding and do not take action, the forwarding will cease from 1st September.