Tag: Vulnerability

Can’t Forward Emails From Office 365 Account 550 5.7.520 Access denied

Posted on | by WebLuke | Leave a Comment on Can’t Forward Emails From Office 365 Account 550 5.7.520 Access denied

In the past few months, Microsoft updated security settings by default that breaks the ability for users of Office 365 to use the feature of forwarding their emails to another external account. This was done with good intentions to help stop hackers from logging into an account and forwarding emails to their account so they could get the password reset messages without staying logged into the vulnerable account.

But there are real reasons people use forwarding of their mail to other addresses, and the security setting can be changed. It would be best if you questioned the users who do forward their email about it as they should keep their emails for the organization in that organization.

You may find that if you send an email to someone who uses the forwarding settings, Office 365 email sends you back a message with the following error.

Remote Server returned ‘550 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)’

Microsoft did document this recently after the change took effect and caused many people problems, including me. https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/external-email-forwarding?view=o365-worldwide

But let’s help you out with a quick and clean set of steps.

  1. Log in as an administrator at https://protection.office.com/
  2. On the left menu, select Threat management > Policy
  3. On the page under Policies, click on the Anti-spam link
  4. On the next page, click the drop-down the Outbound spam filter policy (always ON), then click Edit Policy
  5. On the pop-over, expand Automatic forwarding and chose from the drop-down On – Forwarding is enabled, then click Save
  6. You can now close that pop over, and the settings can take anywhere from 5 minutes to 24 hours.

I hope this helps. Keep in mind it may be better to change the user’s behavior to increase security, than change this setting.

I have also planned to document more of these fixes to problems as I figure them out with the rest of the Internet, so this may be one of a lot more to come of these help style posts.