Microsoft 365 / Outlook

Microsoft 365 550 5.7.520 — "Your organization does not allow external forwarding"

550 5.7.520

The full text is "Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)". A Microsoft 365 mailbox has a rule or setting that automatically forwards mail to an address outside its organization, and the organization's outbound spam filter policy blocks automatic external forwarding. Exchange Online stopped the forwarded copy and sent this report. Microsoft blocks automatic external forwarding by default because attackers often add forwarding rules to compromised mailboxes to steal mail.

How to fix it

  1. 1

    If you sent the original message

    Your message was most likely delivered to the original recipient's mailbox; only their automatic forward was blocked. Nothing on your side needs fixing. If you need it to reach the forwarded-to address, email that address directly.

  2. 2

    If you set up the forward

    Your organization doesn't allow mail to be forwarded outside automatically. Remove the forwarding rule (Outlook rules or the mailbox's forwarding setting) and ask your admin whether forwarding is allowed for your account, or use another way to share mail, such as giving a colleague access to the mailbox.

  3. 3

    If you're the admin and the forward is legitimate

    In the Microsoft Defender portal, create an outbound spam filter policy that allows automatic forwarding, scoped only to the users who need it, and leave forwarding off for everyone else. Avoid turning it on for the whole organization.

  4. 4

    If nobody expected a forward to exist

    Treat it as a possible compromise. Unexpected forwarding rules are a common sign that a mailbox was taken over: reset the password, check sign-in activity, enforce MFA and remove rules the user didn't create.

Meaning current as of 2026-10-24, cross-checked against the provider's own documentation. Providers do occasionally redefine codes — if this doesn't match what you're seeing, the source link is the authoritative reference.

Common questions

Why did I get a bounce if the recipient received my email?+

The block applies to the forwarded copy, not to the original delivery. Exchange Online sends the report to the sender of the message, which is why someone who did nothing wrong can see this bounce.

Does this affect forwarding inside the organization?+

No. The policy blocks automatic forwarding to external addresses. Forwarding to colleagues in the same Microsoft 365 organization isn't affected.

Is this related to SPF or DMARC?+

No. It's an outbound policy decision by the forwarding organization. Authentication on your domain doesn't change it.