how to get inbox rules for all mailboxes

How To Get Inbox Rules using Get-InboxRule

by

In this post, I’ll show you how to use the Get-InboxRule cmdlet to get inbox rules for Exchange mailboxes. You can use the cmdlet to easily check the rules for a single user or use a script to check all mailboxes.

Table of Contents

What are Inbox Rules

Inbox rules are actions configured on mailboxes that will perform automated actions such as moving email to a folder. These rules are useful to help keep inboxes organized and to automate processing of emails. The inbox rules are typically configured by the end user using the outlook client. Rules can also be configured by a virus which is why it’s good to audit and review them.

Below is an example inbox rule I have configured on my mailbox. Any emails that include the words “Automatic reply” will be moved to a specific folder.

Reasons to Audit Inbox Rules

Below are some key reasons to audit inbox rules in Exchange online.

  • Check for malicious activity: Attackers often create rules to forward your emails to an external account. This can be done automatically if a virus is installed on your computer. Auditing all users inbox rules can help spot unexpected rules. Refer to the article List Mailbox Forwarding Rules to find exchange mailboxes that are forwarding to an external email.
  • Compliance: Many regulations such as GDPR, PCI, and HIPPA require strict handling of data such as emails. Inbox rules that forward to external accounts can violate these regulations and put your company at risk.
  • Troubleshooting: If users are reporting issues finding emails it might be due to an inbox rule. These could be rules the user created or the company pushed out.
  • Prevent Data Leakage: This is similar to compliance but it’s worth mentioning again. Auto forwarding emails to external recipients can lead to the exposure of sensitive company data.

Get-Inbox Syntax

Here is an overview of the syntax for the Get-Inbox cmdlet.

Get-InboxRule
   [[-Identity] <InboxRuleIdParameter>]
   [-BypassScopeCheck]
   [-DescriptionTimeFormat <String>]
   [-DescriptionTimeZone <ExTimeZoneValue>]
   [-DomainController <Fqdn>]
   [-IncludeHidden]
   [-Mailbox <MailboxIdParameter>]
   [-ResultSize <Unlimited>]
   [-SkipCount <Int32>]
   [-SweepRules]
   [-UseCustomRouting]
   [<CommonParameters>]

To learn more about the syntax refer to the Microsoft Get-Inbox documentation.

Get-InboxRule Examples

To use Get-InboxRule, you must be connected the online exchange.

Connect-ExchangeOnline

Example 1: Get single user inbox rules

In this example, I’ll get the rules for a single mailbox. Use the -mailbox parameter followed by the users email address. 

Get-InboxRule -mailbox hayden@activedirectorypro.com

In the above example, you can see the mailbox has 1 inbox rule called Test and it is enabled. Unfortunately, the cmdlet does not show you what the rule does.

Example 2. Get Hidden Inbox Rules

Some rules are hidden by default, to view them use the -IncludeHidden parameter. 

Get-InboxRule -mailbox hayden@activedirectorypro.com -IncludeHidden

In the above example, the Junk E-Mail Rule is the hidden rule.

Example 3: Get all users inbox rules 

This script 

$mailboxes = Get-Mailbox -ResultSize Unlimited

foreach ($mb in $mailboxes) {
    try {
        $rules = Get-InboxRule -Mailbox $mb.Identity -ErrorAction Stop

        if ($rules) {
            Write-Host "Inbox rules for: $($mb.PrimarySmtpAddress)" -ForegroundColor Cyan
            $rules | Format-Table Name, Enabled, Priority, Description -AutoSize
            Write-Host "`n"
        }
    } catch {
        Write-Warning "Could not retrieve rules for $($mb.Identity): $_"
    }
}

In the above screenshot you can see the script found two mailboxes that have inbox rules configured.

Conclusion

In this article, I showed you how to use PowerShell to get the inbox rules in Exchange Online. This can be important for troubleshooting mail flow and maintaining security compliance

Related Articles