# 18 Disable user auto-forwarding & mailbox delegation

> v0.1.3 · role: Prevent · [policy: #27 · #29, #30](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

After a mailbox compromise the attacker's next move is persistence that survives a password reset: an auto-forward to an external address, a mailbox delegate, or — with admin rights — a routing rule that quietly BCCs mail off-tenant. Auto-forwarding is the single most common quiet-exfiltration and business-email-compromise mechanism. This control turns off user forwarding and delegation, confirms POP/IMAP and Google Workspace Sync are still off on the same screen ([№33](disable-legacy-auth.md)), and checks the admin-plane Routing table for rules nobody authorised.

## Caveats

- The toggle only prevents new forwarding — forwards a user already configured and Gmail filters with a 'forward to' action survive it, so sweep the existing state (GAM `print forwards` / `print filters`).
- Mail delegation is the executive-assistant workflow — killing it org-wide breaks real work, so scope the OFF setting to the high-risk OU and leave a documented, monitored exception elsewhere.
- Routing rules are admin-plane, invisible to the user, and survive password resets — prevention here is only half of it; the alert on filter, delegate and routing changes (№59, №61) is the other.

## Setup steps

1. Turn off users' ability to auto-forward mail to external addresses — this is the single most common quiet-exfiltration and business-email-compromise (BEC) persistence mechanism. — `Apps › Google Workspace › Gmail › End User Access › Automatic forwarding`

   Allow users to automatically forward email to another address = Off (unchecked)

   docs: [Let users automatically forward their own Gmail emails](https://knowledge.workspace.google.com/admin/gmail/let-users-automatically-forward-their-own-gmail-emails)

2. Turn off mail delegation so a compromised account cannot silently grant a second reader. (Delegation is limited to users in the domain by design — there is no internal-vs-external toggle.) — `Apps › Google Workspace › Gmail › User settings › Mail delegation`

   Let users delegate access to their mailbox to other users in the domain = Off; if required: On, with 'Allow users to grant their mailbox access to a Google group' = Off and sender information set to 'Show the account owner and the delegate who sent the email'

   docs: [Let users delegate access to a Gmail account](https://knowledge.workspace.google.com/admin/gmail/let-users-delegate-access-to-a-gmail-account)

3. While here, confirm POP/IMAP and Google Workspace Sync remain off ([№33](disable-legacy-auth.md)) — the same screen governs them, and re-enabling one re-opens the legacy-auth path. — `Apps › Google Workspace › Gmail › End User Access`

   - **POP and IMAP access** = Off
   - **Google Workspace Sync (GWSMO)** = Off

   docs: [Turn POP & IMAP on or off for users](https://knowledge.workspace.google.com/admin/sync/turn-pop-and-imap-on-or-off-for-users) · [Get ready & install GWSMO](https://knowledge.workspace.google.com/admin/sync/get-ready-and-install-gwsmo)

4. Check Routing for admin-created rules that forward or BCC mail off-tenant. — `Apps › Google Workspace › Gmail › Routing`

   No unexplained Routing rules; any legitimate ones documented and watched by the config-drift sentinel (№59)

   docs: [Add Gmail routing settings](https://knowledge.workspace.google.com/admin/gmail/advanced/add-gmail-routing-settings) · [Email routing and delivery options for Google Workspace](https://knowledge.workspace.google.com/admin/gmail/advanced/email-routing-and-delivery-options-for-google-workspace)

## Ongoing maintenance

- **[automatable: script]** Monthly: re-run both enumerations and diff — a new forward on a finance mailbox is a classic persistence move.

## How to verify

1. Enumerate live forwards and delegates tenant-wide — both lists should be empty or match the approved register.

   ```
   gam all users print forwards
   gam all users print delegates
   ```

## Settings screens

- Apps > Google Workspace > Gmail > End User Access
  - console: https://admin.google.com/ac/apps/gmail/enduseraccess
  - screenshot: ../screenshots/admin.google.com/ac/apps/gmail/enduseraccess.png
- Apps > Google Workspace > Gmail > Routing (check for admin-created forwarding/routing rules)
  - console: https://admin.google.com/ac/apps/gmail/routing
  - screenshot: ../screenshots/admin.google.com/ac/apps/gmail/routing.png