Automatically protected by:
Adversaries set up forwarding rules on your users email inboxes to exfiltrate sensitive data and as a form of insurance in case they lose access to their victim’s email account.
Check forwarding reports
Navigate to https://admin.exchange.microsoft.com
Click on Reports > Mail Flow
Click on Auto forwarded message report
Review all forwarding rules for suspicious email recipients