Ensure mail forwarding rules are reviewed at least weekly

Why This Matters

Automatic email forwarding is a legitimate business tool, but it is also a common vector for data exfiltration and insider threats. Without regular oversight, compromised accounts or malicious insiders can silently siphon sensitive information to external domains. Weekly reviews help administrators differentiate between normal forwarding patterns and suspicious activity, enabling faster detection of security incidents.

What Aether365 Checks

This check verifies that your organization has a process to review mail forwarding rules at least once per week. It appears in the Aether365 dashboard under microsoft-365 checks, alerting you if forwarding activity has not been audited within the recommended timeframe.