17 Disable user auto-forwarding & mailbox delegation

After a mailbox compromise the attacker's next move is persistence that survives a password reset: an auto-forward to an external address, a mailbox delegate, or — with admin rights — a routing rule that quietly BCCs mail off-tenant. Auto-forwarding is the single most common quiet-exfiltration and business-email-compromise mechanism. This control turns off user forwarding and delegation, confirms POP/IMAP and Google Workspace Sync are still off on the same screen (№35), and checks the admin-plane Routing table for rules nobody authorised.

Caveats

Routing rules are admin-plane, invisible to the user, and survive password resets — prevention here is only half of it; the alert on filter, delegate and routing changes (№61, №63) is the other.

Setup steps

Turn off users' ability to auto-forward mail to external addresses — this is the single most common quiet-exfiltration and business-email-compromise (BEC) persistence mechanism.

Apps › Google Workspace › Gmail › End User Access › Automatic forwarding

Allow users to automatically forward email to another address = Off (unchecked)

The toggle only prevents new forwarding — forwards a user already configured and Gmail filters with a 'forward to' action survive it, so sweep the existing state (GAM `print forwards` / `print filters`).

Let users automatically forward their own Gmail emails
Turn off mail delegation so a compromised account cannot silently grant a second reader. (Delegation is limited to users in the domain by design — there is no internal-vs-external toggle.)

Apps › Google Workspace › Gmail › User settings › Mail delegation

Let users delegate access to their mailbox to other users in the domain = Off; if required: On, with 'Allow users to grant their mailbox access to a Google group' = Off and sender information set to 'Show the account owner and the delegate who sent the email'

Delegation is the executive-assistant workflow — killing it org-wide breaks real work, so scope the OFF setting to the high-risk OU and leave a documented, monitored exception elsewhere.

Let users delegate access to a Gmail account
While here, confirm POP/IMAP and Google Workspace Sync remain off (№35) — the same screen governs them, and re-enabling one re-opens the legacy-auth path.

open ↗

https://admin.google.com/ac/apps/gmail/enduseraccess · captured 2026-07-15

Apps › Google Workspace › Gmail › End User Access

POP and IMAP access

Off

Google Workspace Sync (GWSMO)

Off

Turn POP & IMAP on or off for users Get ready & install GWSMO
Check Routing for admin-created rules that forward or BCC mail off-tenant.

open ↗

https://admin.google.com/ac/apps/gmail/routing · captured 2026-07-15

Apps › Google Workspace › Gmail › Routing

No unexplained Routing rules; any legitimate ones documented and watched by the config-drift sentinel (№61)

Add Gmail routing settings Email routing and delivery options for Google Workspace

Ongoing maintenance

automatable: script Monthly: re-run both enumerations and diff — a new forward on a finance mailbox is a classic persistence move.

How to verify

Enumerate live forwards and delegates tenant-wide — both lists should be empty or match the approved register.
```
gam all users print forwards
gam all users print delegates
```

v0.1.3 Prevent policy #27 · #29, #30 ↗