Exchange Online Inbox Rules: Automate Mail, Control Forwarding, and Audit for Compromise

Most guides say "rules let you sort your mail." That undersells them. A rule is a stored instruction that Exchange evaluates for every message that arrives (and, for some rules, every message sent). Because that instruction can move, copy, forward, delete, flag, categorize, reply, or start another process, rules sit at the intersection of productivity, security, and compliance. This guide covers all three.

What an Inbox Rule Is

An inbox rule has three parts:

1. Conditions: what the message must look like (from a person, subject words, size, importance, recipients, header text, attachment present, and more).
2. Actions: what to do when it matches (move to a folder, flag, categorize, forward, redirect, delete, reply with a template, mark as read, stop processing).
3. Exceptions: cases where the rule must not fire even though the conditions match (for example, "except if it is from my manager").

Rules are stored in the mailbox itself. They are evaluated at delivery time by Exchange for *server-side* rules, and by the Outlook program for *client-side* rules. That difference drives most of the problems people hit.

Where Rules Run: Server, Client, and Hidden

• Server-side rules run in Exchange Online when the message is delivered, whether or not any Outlook is open. They work for everyone who looks at the mailbox, on phones, the web, and every desktop. This is the kind you want.
• Client-only rules run only in Outlook for Windows while it is open and connected. They include actions that need the computer: playing a sound, printing, moving to a PST file, running a script or application, and some "mark as" actions. If the computer is off, the rule does not run. Outlook labels these "client only" in the rules list.
• Hidden rules are rules that do not show in the normal interface. They can come from add-ins and from attackers. They show in PowerShell with Get-InboxRule -IncludeHidden, and in tools such as MFCMAPI.
• Rules in Outlook on the web are always server-side. In the new Outlook, rules you create are server-side too. When a rule uses a client-only action, the web interface will not let you create it.

When a user says "my rule stopped working," ask: is it a client-only rule, is Outlook closed, did a different rule above it already move the message, or did the sender's address differ from what the rule expected?

How Users Build a Rule

Outlook on the web and new Outlook. Open Settings, Mail, Rules, Add new rule. Name it, add a condition, add an action, optionally add an exception, tick Stop processing more rules if this should be the last one, and save. You can also create a rule from a message: right-click it and choose Rules, Create rule.

Outlook for Windows (classic). Open Home, Rules, Manage Rules and Alerts, New Rule, choose a template under *Stay Organized* or *Stay Up to Date* or start from a blank rule, then choose conditions, actions, and exceptions in the wizard. The final page shows a summary and, importantly, tells you whether the rule runs only on the computer.

Order and flow. Rules run top to bottom. The first rule that matches does its actions, and then the next rule is tried unless *Stop processing more rules* is set. Put narrow rules above broad ones, and put "stop" rules (the final word) high up where they belong. A catch-all rule at the top that moves everything defeats all the rules below.

Practical Rule Patterns

Beyond "move invoices to a folder," these are the patterns that make a real difference.

1. Triage by sender. From your manager or a key client: flag, apply a *High importance* category, and keep in the inbox. Everything else flows into folders.
2. Newsletters and notifications. If the message contains an unsubscribe header, or comes from a notifications address, move it to *Read later* and mark it as read, so the inbox shows only mail that needs a decision.
3. Hand-offs. Forward a message to a delegate and flag your own copy for follow-up, so you keep a visible reminder. For repeated delegation, forward as attachment when you want the delegate to keep the original header.
4. Meeting spam control. Move meeting responses ("Accepted:" or "Declined:") to a *Meeting replies* folder, so they do not bury real mail.
5. Project folders. Match on a project code in the subject line or a distribution list address in the CC line, and move to that project's folder. Combine with a category color.
6. Directly-to-me vs CC. A rule with the condition *Where my name is in the To box* can separate mail addressed to you from mail where you are only copied.
7. Mailbox hygiene. Move older automated reports to a folder and use a retention tag on that folder so they age out. See retention policies.
8. Auto-categorize for reports. Apply a category to everything from a customer, so that a search by category gives you the full history.
9. Alert on VIP mail. Use *Display a New Item Alert* or push a notification to a phone using the Outlook mobile app's notifications settings, which is a client-side behavior, so test it.
10. Shared mailbox sorting. In a shared mailbox, sort mail by address or keyword into team folders so each person sees their stream. See shared mailboxes.

Rules, Sweep, Focused Inbox, and Other Tools

Outlook offers several ways to reduce clutter, and they overlap:

Tool	What it does	Best for
Inbox rule	Applies actions to new mail based on conditions	Precise, predictable automation
Sweep (Outlook on the web)	Cleans a sender's mail in the inbox on a schedule	Newsletters and bulk senders
Focused Inbox	Learns which mail is important and splits the inbox	General noise reduction
Categories and flags	Manual marking, searchable	Personal task tracking
Mail flow (transport) rule	Applies to mail across the organization	Policy, disclaimers, routing, blocks
Power Automate flow	Triggers on new mail and does actions in other apps	Cross-app workflows

Use a rule when the logic is simple and the action stays in the mailbox. Use Power Automate when the mail should create a ticket, save an attachment to SharePoint, or post to Teams.

Limits That Surprise People

• The rules quota. Rules are stored in a limited space in the mailbox. In Exchange Online the default is 256 KB, and complex rules with long lists of senders or words use a lot of it. When it is full, Outlook says it cannot save the rule. Admins can see and change the quota with Get-Mailbox and Set-Mailbox -RulesQuota, up to a limit set by Microsoft. Check the current maximum in Microsoft's documentation, because it has changed over time.
• Rule complexity. A rule that lists hundreds of addresses costs far more than a rule that matches a domain. Use a domain or a distribution list in the condition rather than pasting a list.
• Evaluation conflicts. A server-side rule and a client-side rule can fight. The server moves a message before the client rule sees it.
• Messages that skip the inbox. A rule can only act on a message that arrives where the rule applies. Mail the filter sends to Junk Email is not processed by inbox rules.
• Reply actions. The *reply using template* action can create loops with other auto-responders. Test carefully, and avoid replying to automated mail.
• Delegate rules. A delegate cannot see or edit the owner's rules unless they have access to the mailbox, and rules created by a delegate run for the mailbox they were created in.

Forwarding and Redirecting

There are three different actions that look similar:

• Forward sends a copy to someone, with the original attached or inline, and appears to come from the owner.
• Redirect sends the message on as if it came directly from the original sender, and the mailbox owner does not keep the "forwarded" mark.
• Forward as attachment sends the original as an attached message.

External forwarding is blocked by default. The outbound spam filter policy controls automatic forwarding to outside addresses, and the default setting ("Automatic - System-controlled") blocks it. It is a deliberate defense: when an attacker takes over a mailbox they often create a hidden rule that copies everything to themselves. To allow forwarding for specific people, edit the policy in the Microsoft Defender portal (Email & collaboration, Policies & rules, Threat policies, Anti-spam policies, Anti-spam outbound policy), create a separate policy for those mailboxes, and keep the default for everyone else. When users need to hand mail to a partner, a shared mailbox, a mail contact with a distribution group, or a share of the specific content is safer than automatic forwarding.

Separate from rules, a mailbox has its own forwarding address setting (ForwardingAddress for internal and ForwardingSmtpAddress for external). Check both when you audit.

Rules and Mailbox Compromise

In a business email compromise, attackers rarely stay in the inbox. They create rules that:

• Forward or redirect mail containing words such as *invoice*, *payment*, *wire*, or *bank* to an outside address.
• Move replies from a target to the RSS Feeds, Archive, or Conversation History folders so the real user never sees the victim's answers.
• Mark messages as read and delete them, so security warnings vanish.
• Use a name made of one dot or one space, so the rule is easy to overlook.

Detect them. Search the audit log for rule creation and changes:

Defender for Office 365 and Microsoft Defender for Cloud Apps also raise alerts for *suspicious inbox forwarding rules* and *suspicious inbox manipulation rules*. Make sure those alerts reach someone who will act.

Audit every mailbox.

On a large tenant run this in batches, because it is slow. Also look for forwarding set at the mailbox:

Respond. When you find a malicious rule: disable it with Disable-InboxRule, remove it with Remove-InboxRule, reset the password, revoke sessions, require MFA, check for added app consents and delegates, and review what was sent from the mailbox. Removing the rule without resetting the account only fixes the symptom.

Managing Rules With PowerShell

Admins can see and manage rules for any mailbox:

Rules reference folders, so the folder must already exist. Use New-MailboxFolder to create it. Admins can also export a user's rules before a migration or a rebuild:

Importing rules back is not one command; you recreate them with New-InboxRule from the exported properties, or the user re-creates them in Outlook. For classic Outlook, File, Manage Rules and Alerts, Options, Export Rules produces an .rwz file that can be imported on another profile.

Mail Flow Rules: When an Inbox Rule Is the Wrong Tool

A mail flow rule (also called a transport rule) lives in the Exchange admin center, Mail flow, Rules, and is applied to mail as it passes through the service, before it reaches mailboxes. It is the right tool for anything that must happen for *everyone*:

• Append a legal disclaimer to outbound mail.
• Mark mail from outside the organization with a warning banner or an *[External]* subject prefix.
• Route mail with certain words to a reviewer.
• Block attachments of certain types, or encrypt mail containing sensitive words.
• Bypass spam filtering for a trusted partner (carefully).

An inbox rule cannot do these things reliably, because it works per mailbox, users can change it, and it does not see mail rejected before delivery. Do not ask a hundred users to create the same inbox rule.

Rules in Migrations and Moves

Rules are a common loss in migrations:

• Client-only rules are stored on the computer's profile and usually do not move with the mailbox.
• Server-side rules often come across in a mailbox move, but references to folders, addresses, or the old Exchange organization (legacy distinguished names) may break. After a migration to Exchange Online, open Manage Rules and Alerts and look for rules marked as broken or showing an old address.
• Outlook's /cleanrules switch (outlook.exe /cleanrules) removes client and server rules from a profile. Use it only when rules are corrupt, and warn the user first, because it deletes them.
• When a user has too many rules, export the rules before changing anything.

Related: migrating Exchange to Microsoft 365 with PST import.

Writing a Rules Policy for the Organization

A short policy prevents most trouble:

1. Rules that forward outside the organization are prohibited unless approved in writing.
2. Automatic external forwarding stays blocked in the outbound spam policy.
3. Admins audit rules monthly with the script above and after any account compromise.
4. Security alerts for suspicious rules go to a monitored mailbox.
5. Organization-wide behavior uses mail flow rules, owned by IT.
6. Leaver mailboxes have their rules and forwarding reviewed as part of offboarding.

How to Check It Worked

• Send a test message that matches the rule while Outlook is closed on your computer, and confirm the action on your phone or in Outlook on the web (a server-side rule).
• Confirm the order: the rule list shows the expected sequence, and no broad rule sits above a specific one.
• Run the audit scripts and confirm there is no forwarding, redirect, or delete rule you did not create.
• Confirm that an attempt to forward to an external address is blocked by the outbound policy, using a test mailbox.
• Check the rules quota use on a heavy user's mailbox before it fills.

Troubleshooting

Symptom	Likely cause
Rule works only sometimes	It is client-only, Outlook is closed, or an earlier rule moved the message
Rule never fires	Condition wording differs from the real message (display name vs address), or the message went to Junk
"Rules quota exceeded"	Too many or too large rules. Merge them, use domains instead of long lists, or raise RulesQuota within Microsoft's limits
Rule shows an error or "Unknown" folder	The destination folder was renamed or deleted. Recreate the folder or edit the rule
Forwarded mail never arrives	External forwarding is blocked by the outbound spam policy
Rule vanished after a migration	Client-only rules did not move, or the rules were corrupt and cleaned
User sees rules they did not make	Compromise, an add-in, or an admin or delegate created them. Check audit logs
Messages loop between two mailboxes	Two forwarding or reply rules point at each other. Disable both and add an exception
Rule on shared mailbox not running	It was created in the wrong mailbox profile, or it is client-only

A Short Decision Guide

• Personal organizing, simple actions: an inbox rule built in Outlook on the web.
• Behavior needed for the whole company: a mail flow rule.
• Cross-app workflow (ticket, SharePoint, Teams): Power Automate.
• Suspected account takeover: audit rules and forwarding first, then reset the account.
• Moving users to a new platform: export rules, then rebuild and test after the move.

Related guides: recovering deleted email, Exchange Online protection, and access from anywhere.

Defender portal paths, alert names, and quota limits change over time. Confirm them in Microsoft's current documentation and your tenant before you act, and test any bulk change on a pilot mailbox. If you want help auditing a tenant after a suspected compromise or writing a mail flow rule set, get in touch.