A mail rule is an instruction that acts on incoming messages, like moving or forwarding them. A connected app is a program a user approves to work with their account, usually through an “allow access” screen. That approval is called consent.

Microsoft lists suspicious rules among the signs of a compromised mailbox. Its examples are rules that forward mail to unknown addresses and rules that move messages into folders people rarely open, like Notes, Junk Email or RSS Subscriptions [1]. It also lists recently added external forwarding [1]. Its response steps include checking mailbox forwarding and every rule, including hidden ones [1]. Rules can also be abused to launch harmful programs, which current Outlook versions block [2].

For forwarding outside the company:

• Microsoft 365: an outbound spam policy controls automatic forwarding to outside addresses. The default setting, “Automatic - System-controlled,” has blocked it for new organizations since 2021, but older organizations may still allow it [3]. Microsoft recommends choosing On or Off on purpose [3]. Off disables user rules and admin forwarding that send mail outside the company; forwarding between coworkers still works [3].

• Google Workspace: users can set up automatic forwarding unless an admin turns it off. It’s on by default [4].

• CISA’s secure baseline for Gmail says automatic forwarding should be disabled, especially to outside domains, because it can give an intruder lasting access to someone’s email [5]. For federal agencies on Microsoft 365, CISA requires outside forwarding to be allowed only domain by domain [6].

For connected apps, Microsoft describes the “illicit consent grant”: an attacker builds an app that asks for access to email, contacts or documents, then tricks a user into approving it [7]. Once approved, the app can reach that data without the user’s password [7]. By default, Microsoft lets any user approve apps for permissions that don’t need an admin [8]. Microsoft recommends allowing user approval only for apps from verified publishers, and offers an admin consent workflow so users can request apps an admin then reviews [8]. CISA requires federal agencies to let only administrators approve apps and to set up that workflow [6]. Google Workspace shows admins every app users have approved, lets them mark each one Trusted, Limited or Blocked, and can restrict high-risk Gmail permissions [9].