550 5.7.520: Microsoft 365 Says Your Organisation Doesn't Allow External Forwarding

A 550 5.7.520 bounce means Microsoft 365 stopped an email being forwarded automatically to an address outside your organisation. Microsoft blocks automatic outside forwarding by default, because it is one of the first things criminals set up in a hacked mailbox. The bounce comes back to the mailbox that tried to forward.

550 5.7.520 Access denied, Your organization does not allow
external forwarding. Please contact your administrator for
further assistance. AS(7555)

The code 5.7.520 is what matters.

Somewhere, a mailbox in your Microsoft 365 is set to pass emails on automatically to an outside address: a personal Gmail, an accountant, a ticket or invoice system. Microsoft 365’s outbound spam policy decides whether that is allowed, and its default setting (“Automatic – System-controlled”) blocks it.

Each email that would have been forwarded bounces back to the mailbox with this message. The original email still arrived in that mailbox; only the forwarded copy was stopped.

If nobody can say who set up the forwarding, or why, don’t allow it. Treat it as a possible hacked mailbox: change the password, check two-step sign-in, and remove the forward and any inbox rules you don’t recognise. My guide to what to do if your business email has been hacked has the steps.

1. A forward set up years ago to a personal address, which stopped when Microsoft’s default changed.
2. An inbox rule that forwards certain emails (for example invoices) to an outside system.
3. A forward to a business tool such as a help desk, accounts or document system.
4. A hacked mailbox, as above.

1. Find the forward. In Outlook on the web: Settings, Mail, Forwarding; and Settings, Mail, Rules. An administrator can also see it in the Microsoft 365 admin centre, under the user’s Mail settings.
2. Decide whether it is still needed. Often it isn’t. If a person wants to read work email elsewhere, adding the Microsoft 365 mailbox to their phone’s Outlook app is safer than forwarding.
3. If it is needed, allow it for that mailbox only. An administrator opens the Microsoft Defender portal, then Email & collaboration, Policies & rules, Threat policies, Anti-spam, and creates a new outbound spam policy that applies only to that mailbox, with “Automatic forwarding rules” set to “On – Forwarding is enabled”. Leave the default policy blocking everyone else.
4. Or let the outside system collect the email instead. Many help desk and accounts systems can connect to the mailbox directly, so nothing needs forwarding.
5. Test it by sending an email that should be forwarded, from an outside address.

Changes to the policy can take up to an hour to work.

Send an email from a personal address to the mailbox. It should arrive there and at the forwarding address, and no 5.7.520 bounce should come back to the mailbox.

Removing a forward is quick. Allowing one safely needs an administrator and a careful look at whether the mailbox has been tampered with. If you’re not sure who set the forward up, get it checked before allowing it.

• Why Emails Bounce (and What the Bounce Message Is Telling You).
• Think your business email has been hacked?.
• Emails to info@ going missing?, if forwarding was being used in place of an alias.

Need help fixing this?

I provide:

• Free initial assessment
• Clear explanation of the issue
• Fixed-price solutions
• UK-based support

Tell me which mailbox is forwarding and where to, and I’ll check it’s safe and set it up the right way.