550 5.7.520 Access denied, Your organization does not allow external forwarding

Common causes

• A user set up an inbox rule or mailbox forwarding to a personal or partner address.
• The default outbound anti-spam policy has automatic forwarding set to Automatic, which behaves as Off.
• An attacker created a forwarding rule on a compromised mailbox.

How to fix it

1. Check the rule is legitimate; attackers often add forwarding rules to hijacked mailboxes.
2. To allow it, create a custom outbound anti-spam policy in Microsoft Defender for just those users with automatic forwarding set to On.
3. Otherwise, remove the forwarding rule and share mail another way, such as delegate access.