Disable external forwarding rule in Microsoft 365
Automatically disable an external forwarding rule on a Microsoft 365 mailbox from a Slack request with Stepwork, and confirm it is gone.
- Use case
- Security response & remediationInfoSec & Compliance
- Best for
- Security Analyst
- Applications used
Microsoft 365
Slack
- Business outcome
- Risk reduction
The problem
Mail is already leaving the company.
An external auto-forwarding rule is a classic compromise path. Security finds it, then waits for the full incident process before anyone opens the mailbox rules.
Every hour it stays on, mail keeps copying outside. The fix is a few clicks in the admin center, but it sits behind triage while the rule keeps running.
The outcome
Exfiltration paths cut when they are found
Stepwork removes the external auto-forwarding rule on the specified mailbox and confirms deletion. The path closes with the request, and the run records who asked and which mailbox was fixed.
- The external forwarding rule is removed.
- Deletion is confirmed before the run succeeds.
- If the rule cannot be found, the run stops.
The process
From Slack request to a removed forwarding rule
Security posts the mailbox in Slack. Stepwork opens the mailbox rules in Microsoft 365 and removes the external forward.
- Step 1
Request it in Slack
A security teammate posts the mailbox address in the security channel. That message starts the flow, and Stepwork records who asked and when.
- Step 2
Open mailbox rules
Stepwork signs in to the Microsoft 365 admin center and opens the mailbox’s forwarding rules. If the mailbox cannot be found, the run stops.
- Step 3
Remove the external forward
Stepwork deletes the external auto-forwarding rule, the same control an admin uses by hand.
- Step 4
Confirm and reply in Slack
Stepwork checks that the rule is gone, then posts the result back in Slack.
Why Stepwork
The rule dies when security asks
Stepwork runs only the disable path you recorded. It does not wait for the full incident process to finish before cutting the forward.
Similar use cases
Similar use cases
- Remove license and convert mailbox to shared in Microsoft 365Converts a departed user's mailbox to a shared mailbox and removes their paid license in the admin center.
- Assign license to user in Microsoft 365Opens the Microsoft 365 admin center, locates the user, and assigns the specified license SKU.
Revoke view share link in AirtableRevokes a specified share link and confirms it no longer loads.
FAQ