Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland

Office 365 – Find Users Forwarding Emails (PowerShell)

Office 365 - Inbox Rules

I saw today someone posting a script that allow you to find Inbox Rules that have forward rules setup in Microsoft Office 365. This is actually pretty common scenario and some people do this without proper approval of management or even against organization policies. Below you can find my version of it. If you want to see original you can find it at GitHub. Below script includes couple of steps:

Connect to Office 365
Get all Exchange Mailboxes from Office 365
Get all Inbox Rules (from all user mailboxes)
Get all Inbox Rules that have forwarding defined
Finally export to Excel file in 3 worksheets.
Office 365 - PowerShell Script to get Inbox Rules
Import-Module PSWriteExcel
Import-Module PSSharedGoods

$Configuration = @{
    Tenant     = @{
        UserName         = ''
        Password         = 'C:\Support\GitHub\Ignore\MySecurePassword.txt'
        PasswordSecure   = $true
        PasswordFromFile = $true
        ConnectionURI    = ''
        Authentication   = 'Basic'
        SessionAzure     = 'SessionAzure'
        SessionAzureAD   = 'SessionAzureAD'
        SessionExchange  = 'SessionExchange'
    Steps      = @{
        ConnectTenant  = @{
            Azure          = $false
            AzureAD        = $false
            ExchangeOnline = $true
        FindInboxRules = $true
    OutputFile = "$Env:USERPROFILE\Desktop\myReport.xlsx"

if ($Configuration.Steps.ConnectTenant.Azure) {
    $SessionAzure = Connect-WinAzure -SessionName $Configuration.Tenant.SessionAzure -Username $Configuration.Tenant.UserName -Password $Configuration.Tenant.Password -AsSecure:$Configuration.Tenant.PasswordSecure -FromFile:$Configuration.Tenant.PasswordFromFile
if ($Configuration.Steps.ConnectTenant.AzureAD) {
    $SessionAzureAD = Connect-WinAzureAD -SessionName $Configuration.Tenant.SessionAzureAD -Username $Configuration.Tenant.UserName -Password $Configuration.Tenant.Password -AsSecure:$Configuration.Tenant.PasswordSecure -FromFile:$Configuration.Tenant.PasswordFromFile
if ($Configuration.Steps.ConnectTenant.ExchangeOnline) {
    $Session = Connect-WinExchange -SessionName $Configuration.Tenant.SessionExchange -Username $Configuration.Tenant.UserName -Password $Configuration.Tenant.Password -AsSecure:$Configuration.Tenant.PasswordSecure -FromFile:$Configuration.Tenant.PasswordFromFile -ConnectionURI $Configuration.Tenant.ConnectionURI -Authentication $Configuration.Tenant.Authentication
    Import-PSSession $Session -AllowClobber

if ($Configuration.Steps.FindInboxRules) {
    $Mailboxes = get-mailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Select-Object UserPrincipalName, PrimarySMTPAddress, SamAccountName, DisplayName, Name, Identity

    $InboxRules = @()
    $i = 1
    foreach ($Mailbox in $Mailboxes) {
        Write-Color -Text "$($i) of $($totalMailbox)", ' | ', "$($mailbox.UserPrincipalname)", ' | ' -Color Yellow, White, Blue, White
        $InboxRules += Get-InboxRule -Mailbox $mailbox.UserPrincipalName | Select-Object *

    $InboxRulesForwarding = @()
    foreach ($Mailbox in $Mailboxes) {
        $UserRules = $InboxRules | Where-Object { ($Mailbox.Identity -eq $_.MailboxOwnerID) -and (($_.ForwardTo -ne $null) -or ($_.ForwardAsAttachmentTo -ne $null) -or ($_.RedirectsTo -ne $null)) }
        foreach ($Rule in $UserRules) {
            $InboxRulesForwarding += [pscustomobject] @{
                UserPrincipalName     = $Mailbox.UserPrincipalName
                DisplayName           = $Mailbox.DisplayName
                RuleName              = $Rule.Name
                Description           = $Rule.Description
                Enabled               = $Rule.Enabled
                Priority              = $Rule.Priority
                ForwardTo             = $Rule.ForwardTo
                ForwardAsAttachmentTo = $Rule.ForwardAsAttachmentTo
                RedirectTo            = $Rule.RedirectTo
                DeleteMessage         = $Rule.DeleteMessage

    $Mailboxes | ConvertTo-Excel -FilePath $Configuration.OutputFile -ExcelWorkSheetName 'All Mailboxes' -AutoFilter -AutoFit
    $InboxRules | Select-Object * -ExcludeProperty PSComputerName, RunspaceID, PSShowComputerName, PSComputerName, IsValid, ObjectState | ConvertTo-Excel -FilePath $Configuration.OutputFile -ExcelWorkSheetName 'Inbox Rules' -AutoFilter -AutoFit
    $InboxRulesForwarding | ConvertTo-Excel -FilePath $Configuration.OutputFile -ExcelWorkSheetName 'Inbox Rules with Forwarding' -AutoFilter -AutoFit
You will need those

Below are 3 modules that I use to Connect to Office 365, to export to Microsoft Excel, and finally to use colorful output. You still will need standard modules required to connect to Office 365 because PSSharedGoods provides just a wrapper that allow easy connection setup. While you could skip those (and the script that is linked above doesn't require it) I've wrote some simple wrappers that allow me to manage things in easy way, and the way I want it.

Install-Module PSSharedGoods
Install-Module PSWriteExcel
Install-Module PSWriteColor

Related Posts