SOLVED: VIDEO: Microsoft Exchange Online 550 5.7.520 Access Denied Organization Does Not Allow External Forwarding

NOTE: Oct 30 2023 – We had a client who thought the bounce was occurring ON A REPLY. It was not; it was simply that the bounce (NDR) on the original message was RECEIVED AFTER they had replied. the bounce was taking 3+ minutes to be received and in that time they had replied, so it was natural for them to think the bounce related to the reply. We proved this by changing the subject line on the reply and then noting that the bounce noted the subject line of the original message.

If a user is receiving a 550 5.7.520 email bounce relating to External Forwarding.  The problem is likely related to the default Microsoft Office 365 Exchange Online Exchange Online Protection Anti Spam filters.

Delivery has failed to these recipients or groups: <User> (<user email>)
Your message wasn’t delivered because the recipient’s email provider rejected it.

Diagnostic information for administrators:
Generating server: CO1PR13MB4949.namprd13.prod.outlook.com
<user email>
Remote Server returned ‘550 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)’

The solution is to:

1. Surf to security.microsoft.com
2. Expand POLICIES & RULES
3. Click THREAT POLICIES
4. Click ANTI-SPAM
5. Click ANTI-SPAM OUTBOUND POLICY (DEFAULT)
6. Click EDIT PROTECTION SETTINGS
7. Change FORWARDING RULES > AUTOMATIC FORWARDING RULES to ON – FORWARDING IS ENABLED

However, there are very good reasons to have this setting set to OFF-FORWARDING IS DISABLED and we explain why in the video above.