18 Disable user auto-forwarding & mailbox delegation

After a mailbox compromise the attacker's next move is persistence that survives a password reset: an auto-forward to an external address, a mailbox delegate, or — with admin rights — a routing rule that quietly BCCs mail off-tenant. Auto-forwarding is the single most common quiet-exfiltration and business-email-compromise mechanism. This control turns off user forwarding and delegation, confirms POP/IMAP and Google Workspace Sync are still off on the same screen (№33), and checks the admin-plane Routing table for rules nobody authorised.

Caveats

The toggle only prevents new forwarding¹
Mail delegation is the executive-assistant workflow²
Routing rules are admin-plane, invisible to the user, and survive password resets³

Setup steps

Apps › Google Workspace › Gmail › End User Access › Automatic forwarding
Turn off users' ability to auto-forward mail to external addresses — this is the single most common quiet-exfiltration and business-email-compromise (BEC) persistence mechanism.

Allow users to automatically forward email to another address = Off (unchecked)

Let users automatically forward their own Gmail emails ↗
Apps › Google Workspace › Gmail › User settings › Mail delegation
Turn off mail delegation so a compromised account cannot silently grant a second reader. (Delegation is limited to users in the domain by design — there is no internal-vs-external toggle.)

Let users delegate access to their mailbox to other users in the domain = Off; if required: On, with 'Allow users to grant their mailbox access to a Google group' = Off and sender information set to 'Show the account owner and the delegate who sent the email'

Let users delegate access to a Gmail account ↗
open ↗
https://admin.google.com/ac/apps/gmail/enduseraccess · captured 2026-07-15
Apps › Google Workspace › Gmail › End User Access
While here, confirm POP/IMAP and Google Workspace Sync remain off (№33) — the same screen governs them, and re-enabling one re-opens the legacy-auth path.

POP and IMAP access
Off
Google Workspace Sync (GWSMO)
Off

Turn POP & IMAP on or off for users ↗ Get ready & install GWSMO ↗
open ↗
https://admin.google.com/ac/apps/gmail/routing · captured 2026-07-15
Apps › Google Workspace › Gmail › Routing
Check Routing for admin-created rules that forward or BCC mail off-tenant.

No unexplained Routing rules; any legitimate ones documented and watched by the config-drift sentinel (№59)

Add Gmail routing settings ↗ Email routing and delivery options for Google Workspace ↗

Ongoing maintenance

automatable: script Monthly: re-run both enumerations and diff — a new forward on a finance mailbox is a classic persistence move.

How to verify

Enumerate live forwards and delegates tenant-wide — both lists should be empty or match the approved register.
```
gam all users print forwards
gam all users print delegates
```

v0.1.3Prevent policy #27 · #29, #30 ↗