Mail forwarding Low-severity alert....

Hi there,

I'm trying to setup the following.

This person has already an existing mail adress from company 1 (tenant), we are trying to create a shared mailbox from company 2 (tenant)

He wants to use his existing mailbox from company 1, to receive all mails as a copy from company 2 (Shared mailbox).

I've tried to forward all mails in the shared mailbox to an external mailbox.

I've put myself as full control of the shared mailbox - opened the outlook in owa enviroment -settings - mail - account - forwarding.

After setting this up, sending a test mail to see if everything worked, all admins in the tenant received a low severity alert message:

Details: MailRedirect. This alert is triggered whenever someone gets access to read your user's email.

Description: This alert is triggered when someone in your organization creates an email forwarding or redirect inbox rules using Outlook web app or Powershell -V1.0.0.2

I couln't find any alert policies that i can adjust to stop this alert message from sending to our admins.

Is this a single alert message? to warn admins, or wil this alert acquire everytime a mail gets forwarded?

I've also tried a different method through the admin exchange panel directly in the shared mailbox but the mail adress cant be found, this mailbox is already added as guest in the contacts as you can see.

Kind regards,



Question Info

Last updated December 24, 2019 Views 10,561 Applies to:

Hi Ram,


This is because of a feature Alerts in Security & Compliance center (SCC). There is a default template Creation of forwarding/redirect rule: Generates an alert when someone in your organization creates an inbox rule for their mailbox that forwards or redirects messages to another email account. This policy only tracks inbox rules that are created using Outlook Web App or Exchange Online PowerShell. This policy has a Low severity setting.


There are two options you or your admin can try in SCC.


1.Try to reduce the email notifications it sends. In SCC>Alerts>Alert policies>choose this policy>Edit policy>Daily notification limit>then select an appropriate number and Save.


2.Suppress the email notification. SCC>Alerts>View alerts>choose the one your admin just received>Suppress>then choose the appropriate duration>Save.


For the detailed information regarding Alerts and Alert policies, please refer to this following article:




If you feel a reply works for you, please kindly vote or mark it as it will be beneficial to other community members reading this thread.

1 person was helped by this reply


Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.