Microsoft 365 "550 5.7.520 ... does not allow external forwarding": fix

What it means

Someone in a Microsoft 365 organization set up automatic forwarding (an Inbox rule or mailbox forwarding) to an address outside the organization, for example a personal Gmail address. When a message arrived and Microsoft 365 tried to forward it, its outbound spam policy blocked the forward and sent a bounce. Microsoft documents this text:

5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)

Who receives the bounce can be confusing: it is sent to the original sender, who may be outside the organization and did nothing wrong. The fix is always on the side of the organization that does the forwarding.

Why it happens

Automatic forwarding to outside addresses is a classic data leak: attackers who take over a mailbox often add a hidden rule that copies all mail to themselves. Microsoft therefore controls it in the outbound spam filter policy, with three settings:

• Automatic - System-controlled (the default). Since 2021 this behaves like "Off" for new organizations and for most existing ones, so forwarding is blocked unless someone allowed it.
• On - Forwarding is enabled: external forwarding is allowed.
• Off - Forwarding is disabled: external forwarding is blocked and produces the 5.7.520 bounce.

Two other controls can also block forwarding: remote domains (the "Allow automatic forwarding" option per external domain) and mail flow rules. When one control allows and another blocks, the block wins.

How to check

1. Confirm the bounce contains 5.7.520 and AS(7555). Note the forwarding mailbox shown in the bounce (it is the recipient of the original message, not the final address).
2. In the Microsoft Defender portal, open Email & collaboration > Policies & rules > Threat policies > Anti-spam, open the outbound policy that applies to that user, and look at Automatic forwarding rules. Or in PowerShell:

   Get-HostedOutboundSpamFilterPolicy | Format-List Name,AutoForwardingMode
   Get-HostedOutboundSpamFilterRule | Format-List Name,HostedOutboundSpamFilterPolicy,From,FromMemberOf

3. List who forwards externally with the Auto forwarded messages report in the Exchange admin center, and check the mailbox itself:

   Get-Mailbox user@yourdomain.com | Format-List ForwardingSmtpAddress,DeliverToMailboxAndForward
   Get-InboxRule -Mailbox user@yourdomain.com | Where-Object {$_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo}

4. If nobody remembers creating the rule, treat the account as compromised before doing anything else: see a hacked email account is sending spam.

How to fix it

Option 1: do not forward (often the best answer)

Give the user access another way: the Outlook app on their phone, a shared mailbox, or a delegate. Forwarding also has a deliverability cost: forwarded messages often fail SPF at the final destination and can land in spam, as explained in email forwarding breaks SPF.

Option 2: allow forwarding only for the people who need it

Do not switch the default policy to "On" for everyone. Create a custom outbound policy that only applies to the allowed users or group:

New-HostedOutboundSpamFilterPolicy -Name "Allow forwarding" -AutoForwardingMode On
New-HostedOutboundSpamFilterRule -Name "Allow forwarding" `
  -HostedOutboundSpamFilterPolicy "Allow forwarding" -From user@yourdomain.com

You can do the same in the Defender portal (create an outbound policy, choose the users, set Automatic forwarding rules to On - Forwarding is enabled). Set the default policy explicitly to Off so the behavior is clear, rather than "Automatic".

Option 3: restrict where mail can go

Use remote domains to allow automatic forwarding only to specific partner domains and block it for the default remote domain (*). Remember that a block anywhere wins over an allow.

If you are the outside sender

There is nothing to change on your side: your email reached the recipient's mailbox, only the forward failed. Tell the recipient (by another channel) that their forwarding rule is blocked so they can talk to their administrator.

Check that it is fixed

• Policy changes can take a while to apply. Then send a test email to the forwarding mailbox from an outside address and check that the copy arrives at the external address.
• To see what the forwarded copy looks like to filters, set the forward temporarily to the unique address on the Delivmail home page: the report shows whether SPF, DKIM and ARC survive the forward.
• Review the Auto forwarded messages report regularly, so a forgotten or malicious rule does not stay active.