How to view users' mailbox rules in Exchange Online

Why audit mailbox rules in Microsoft 365?

When a user's account is compromised, attackers often create inbox rules to hide their tracks or exfiltrate data. These rules can automatically forward emails to an external address, delete specific messages, or move them to other folders.

For administrators, manually checking the rules for every user is an impossible task, especially in large organizations. Without a centralized way to list them, it's difficult to identify suspicious forwarding rules, ensure compliance with company policies, and troubleshoot delivery problems effectively.

Method 1: How to get a list of mailbox rules using Exchange Online PowerShell

Note: The option to view and manage inbox rules for other users in the Exchange Admin Center (EAC) is deprecated. Exchange Online PowerShell is now the only native method for running this audit organization-wide.

Prerequisites

Before using Exchange Online PowerShell, please verify that:

• The ExchangeOnlineManagement PowerShell module is installed. If not, install it using this script:
  Copy

  Install-Module ExchangeOnlineManagement -Scope CurrentUser
  					Update-Module ExchangeOnlineManagement
  					

• Connect to the Exchange Online module using this script:
  Copy

  Connect-ExchangeOnline

• You have the Exchange Administrator role assigned. This role is required to run the Get-InboxRule cmdlet across mailboxes.

Use the Get-InboxRule to export a list of inbox rules in Exchange Online

The Get-InboxRule cmdlet can be used with Get-Mailbox to retrieve all inbox rules for all users in your organization. The script first retrieves all mailboxes and then loops through each one to collect its associated rules. The syntax for retrieving a list of all inbox rules is given below:

Get-Mailbox -ResultSizeUnlimited | 
    ForEach-Object { 
        Get-InboxRule -Mailbox $_.PrimarySmtpAddress | 
        Select-Object @{Name="Mailbox";Expression={$_.MailboxOwnerId}}, 
                      Name, Enabled, Priority, Description 
    } | Export-Csv "C:\Reports\InboxRules_AllMailboxes.csv" -NoTypeInformation -Encoding UTF8

Use the new Get-EXOMailbox cmdlet with Get-InboxRule per Microsoft's recommendation

Microsoft recommends using Get-EXOMailbox instead of Get-Mailbox in Exchange Online. The EXO cmdlets are optimized for the cloud service, offer better throttling management, and will continue to be updated, whereas the older cmdlets are maintained mainly for backward compatibility.

Get-EXOMailbox -ResultSizeUnlimited | 
    ForEach-Object { 
        Get-InboxRule -Mailbox $_.UserPrincipalName | 
        Select-Object @{Name="Mailbox"; Expression={$_.MailboxOwnerId}}, 
                      Name, Enabled, Priority, Description 
    } | Export-Csv "C:\Reports\InboxRules_AllMailboxes_EXO.csv" -NoTypeInformation -Encoding UTF8

Supported parameters

The following table contains some parameters that can be used with the Get-InboxRule cmdlet to provide details on users' inbox rules.

An example use case for the Get-InboxRule cmdlet: Internal audits

Scenario: An IT administrator needs to conduct a quarterly audit of all inbox rules that forward emails to external addresses to ensure they comply with company data security policies.

This is the cmdlet you will have to run to generate a report of all inbox rules with external forwarding actions.

Get-EXOMailbox -ResultSizeUnlimited |
ForEach-Object {
Get-InboxRule -Mailbox $_. UserPrincipalName |
Where-Object { $_.ForwardTo -ne $null -or $_.RedirectTo -ne $null } |
Select-Object @{Name="Mailbox";Expression={$_.MailboxOwnerId}},
Name, Enabled, Priority, Description
 } | Export-Csv"C:\Reports\InboxRules_ExternalForwarding.csv" -NoTypeInformation -EncodingUTF8

Method 2: How to get a list of mailbox rules using M365 Manager Plus

1. Log in to M365 Manager Plus and click the Reports tab.
2. Navigate to Exchange Online > Mailbox Content Reports.
3. Select the Inbox Rules report to view and export inbox rules across all users in your organization.

Monitor inbox rules with M365 Manager Plus

Important tips

Frequently asked questions